Does Let's Encrypt require IPv6 and forbid IPv4? [no]

Hi @ebonsi,

I moved this post and its replies to a new thread since the topic isn't directly related to the previous thread and there is some confusion to clear up that shouldn't clutter the original thread. Thanks!

I can see how you arrived at this conclusion but it's not quite true! As @DanCvrcek mentions pure IPv4 will work as it always has.

The only thing that has changed is that Let's Encrypt now prefers IPv6 for websites that say they support both IPv4 and IPv6. Previously if your domain said it worked on both IPv6 and IPv4 we would choose IPv4 all the time. Now we choose IPv6 when your domain says it works for both.

Knowing that some user's domains claim IPv6 support with an AAAA record but have some kind of misconfiguration/problem, we intended for the Let's Encrypt service to try IPv6 first, and if it didn't work, try IPv4 after. As you've noticed, this doesn't work in all cases right now and we have documented that in a Boulder issue to try and fix it. We appreciate your patience in the meantime!

If you do not want Let's Encrypt to ever use IPv6 to contact your domain the power is in your hands! You can remove the AAAA record from your DNS Zone for that domain name.

Hope that helps clear things up, I apologize for the trouble you've had as a result of our API change.

4 Likes