# Certbot, force IPv4? **URL:** \ **Category:** Help\ **Created:** [September 16, 2019, 6:33am UTC](https://community.letsencrypt.org/t/certbot-force-ipv4/102102 "2019-09-16T06:33:38Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Hermanverschooten](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/hermanverschooten/32/23817_2.png) [@Hermanverschooten](https://community.letsencrypt.org/u/Hermanverschooten)\ **Post date:** [September 16, 2019, 6:33am UTC](https://community.letsencrypt.org/t/certbot-force-ipv4/102102/1 "2019-09-16T06:33:38Z")
Hi, Is there a way to force certbot to use only IPv4 for renewals? I have a setup in which the domain is hosted on an IPv6-only VPS, renewal for this works fine. For IPv4 the domain is shared with others and NGINX is used as a reverse proxy, here is where it fails. Trying to renew the certificate make let’s encrypt try to find the information on the IPv6 host. Tx, Herman ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [September 16, 2019, 6:54am UTC](https://community.letsencrypt.org/t/certbot-force-ipv4/102102/2 "2019-09-16T06:54:00Z")
Hi @Hermanverschooten > [@Hermanverschooten](#): > > Is there a way to force certbot to use only IPv4 for renewals? not directly. You can - remove the ipv6 entry - add a redirect ipv6 domain -\> other domain (or new subdomain) only with ipv4 on your ipv4 config and use that. Letsencrypt follows such redirects (port 80 or 443) ---
**Author:** ![Hermanverschooten](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/hermanverschooten/32/23817_2.png) [@Hermanverschooten](https://community.letsencrypt.org/u/Hermanverschooten)\ **Post date:** [September 16, 2019, 6:59am UTC](https://community.letsencrypt.org/t/certbot-force-ipv4/102102/3 "2019-09-16T06:59:33Z")
Hi @JuergenAuer Thanks for the speedy reply, but sadly that is not an option, too many other parts use only the IPv6 and they too need the security. If only you could supply a `-4` option to tell let’s encrypt to ignore the IPv6 and use the IPv4 DNS-entry. It would not compromise security and boy, I think it would make life easier for a lot of admins. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [September 16, 2019, 7:22am UTC](https://community.letsencrypt.org/t/certbot-force-ipv4/102102/4 "2019-09-16T07:22:40Z")
> [@Hermanverschooten](#): > > but sadly that is not an option, too many other parts use only the IPv6 and they too need the security. Isn't it possible to copy the certificate? Ipv6 server backup -\> copy it to your ipv4 configuration. It's not required to create two different certificates, you can use the same certificate with multiples servers. > [@Hermanverschooten](#): > > It would not compromise security It would. Ipv6 has additional features. There exists no NAT translation. So such a switch could be one "critical step" that a hacker is able to create a certificate. Sample: A hacker who controls the router, but not the correct domain. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [September 16, 2019, 7:38am UTC](https://community.letsencrypt.org/t/certbot-force-ipv4/102102/5 "2019-09-16T07:38:07Z")
I think Let’s Encrypt have previously stated that they are opposed to adding any flags like this, as it can only give potential attackers more tools to work with. I think that @JuergenAuer’s suggestion is on the right line of thinking. What stops you just adding a special IPv4-only host on your nginx to direct the request to the IPv6 server? ```nginx # On your IPv4 server server { server_name example.com; listen 0.0.0.0:80; location / { return 404; } location ~ ^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)$ { return 302 http://[2001:db8::1]/.well-known/acme-challenge/$1; } } ``` ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [September 16, 2019, 11:50am UTC](https://community.letsencrypt.org/t/certbot-force-ipv4/102102/6 "2019-09-16T11:50:12Z")
> [@\_az](#): > > ```nohighlight > return 302 http://[2001:db8::1]/.well-known/acme-challenge/$1; > > ``` IP address URLs aren't allowed, so it would have to be [http://ipv6-only-hostname.example.org/](http://ipv6-only-hostname.example.org/), but ---
**Author:** ![Hermanverschooten](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/hermanverschooten/32/23817_2.png) [@Hermanverschooten](https://community.letsencrypt.org/u/Hermanverschooten)\ **Post date:** [September 17, 2019, 2:24pm UTC](https://community.letsencrypt.org/t/certbot-force-ipv4/102102/7 "2019-09-17T14:24:28Z")
The issue is the other way around, the IPv6 needs to forward to the IPv4. I think I may be able to do this. ---
**Author:** ![Hermanverschooten](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/hermanverschooten/32/23817_2.png) [@Hermanverschooten](https://community.letsencrypt.org/u/Hermanverschooten)\ **Post date:** [September 25, 2019, 2:33pm UTC](https://community.letsencrypt.org/t/certbot-force-ipv4/102102/8 "2019-09-25T14:33:36Z")
I managed to get it working. On the IPv6 host, check to see if the file exists, if not reverse-proxy to the IPv4 host. On the IPv4 host use `certbot certonly --webroot` and make sure your webserver serves up `/.well-known/acme-challenge` from the `--webroot-path` you give certbot. You cannot use the nginx plugin, because it creates a temporary config that will listen on the IPv6 certbot wants to check. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 25, 2019, 2:41pm UTC](https://community.letsencrypt.org/t/certbot-force-ipv4/102102/9 "2019-10-25T14:41:56Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.