Domain Validation without HTTPS

[jvanasco]

@schoen

If you can control your firewall from software somehow, you could make the Let's Encrypt client open port 80 on the firewall right before the challenge and close port 80 again afterward. With Certbot, you can use --pre-hook and --post-hook for this (to make it run commands before and after attempting the domain validation challenges).

My main production systems have a pre/post hook that opens the firewall for an iptables ruleset on port-53 and starts an acme-dns server; then shuts it all down. This lets us run dns-01 challenges for wildcard certs, with traffic open for only very very very small amounts of time. running this in a ruleset that is early-on also lets us run fail2ban, and aggressively ban network blocks.