# Certificate for an internal server (only open from office)
**URL:** https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515
**Category:** Server
**Created:** [June 2, 2016, 4:38pm UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515 "2016-06-02T16:38:28Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@lseo](https://community.letsencrypt.org/u/lseo)
#### Post date: [June 2, 2016, 4:38pm UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515/1 "2016-06-02T16:38:28Z")
Hello,
My company have server to host application for internal use only. So this server is on internet but IP are restricted only from office.
Is it possible to use Let’s Encrypt to have Https ? I ask that because in the FAQ we can’t know the IP of let’s encrypt so how the validation will be done ?
Thanks a lot.
---
### Author:  [@serverco](https://community.letsencrypt.org/u/serverco)
#### Post date: [June 2, 2016, 6:22pm UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515/2 "2016-06-02T18:22:13Z")
Has this server got a fully qualified domain name ?
If it is on the internet, but restricted to your office IP, then the easiest is to allow full access to domain/.well-known/acme-challenge for any IP address, but of course restrict other folders to your office IP.
Alternatively, you could perform a DNS challenge rather than a http challenge.
---
### Author:  [@lseo](https://community.letsencrypt.org/u/lseo)
#### Post date: [June 3, 2016, 7:09am UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515/3 "2016-06-03T07:09:52Z")
Yes the server got two fully qualified domain name : [gitlab.company.com](http://gitlab.company.com) and [jenkins.company.com](http://jenkins.company.com)
I can’t change the rules of restricted IP because it’s a firewall before my server so I will do it with DNS challenge.
Thanks
---
### Author:  [@serverco](https://community.letsencrypt.org/u/serverco)
#### Post date: [June 3, 2016, 7:36am UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515/4 "2016-06-03T07:36:11Z")
If you have a look at the [alternate client](https://github.com/certbot/certbot/wiki/Links)s the Bash clients and the Go clients support the DNS challenge.
---
### Author:  [@lseo](https://community.letsencrypt.org/u/lseo)
#### Post date: [June 3, 2016, 7:56am UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515/5 "2016-06-03T07:56:14Z")
Thanks no client for my DNS Provider Gandi … so the renew will be done manually.
---
### Author:  [@serverco](https://community.letsencrypt.org/u/serverco)
#### Post date: [June 3, 2016, 8:39am UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515/6 "2016-06-03T08:39:11Z")
From a quick look - [https://wiki.gandi.net/en/xml-api](https://wiki.gandi.net/en/xml-api) - gandi has a perfectly good API for dns records, so you should be able to use the DNS method.
---
### Author:  [@lseo](https://community.letsencrypt.org/u/lseo)
#### Post date: [June 3, 2016, 9:01am UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515/7 "2016-06-03T09:01:00Z")
> [@serverco](#):
>
> a quick look - [\ — Gandi Documentation documentation](https://wiki.gandi.net/en/xml-api) - gandi has a perfectly good API for dns records, so you should be able to use the DNS method.
yes but I need to develop the interface 😉
---
### Author:  [@serverco](https://community.letsencrypt.org/u/serverco)
#### Post date: [June 3, 2016, 9:05am UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515/8 "2016-06-03T09:05:14Z")
You only have to write about a dozen lines for that I think. If I get chance later I’ll take a quick look.
---
### Author:  [@serverco](https://community.letsencrypt.org/u/serverco)
#### Post date: [June 3, 2016, 9:15am UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515/9 "2016-06-03T09:15:58Z")
looking at the [go alternate clients](https://github.com/certbot/certbot/wiki/Links#go) - the Lego one already supports gandi dns challenge.
---
### Author:  [@lseo](https://community.letsencrypt.org/u/lseo)
#### Post date: [June 3, 2016, 11:55am UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515/10 "2016-06-03T11:55:28Z")
> [@serverco](#):
>
> rfectly good API for dns records, so you should be able to use the DNS method.
nice !!
Thanks for your help
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [July 3, 2016, 11:55am UTC](https://community.letsencrypt.org/t/certificate-for-an-internal-server-only-open-from-office/16515/11 "2016-07-03T11:55:33Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.