# How to renew for Dynamic DNS host with no port 80? **URL:** \ **Category:** Issuance Tech\ **Created:** [January 7, 2019, 4:54pm UTC](https://community.letsencrypt.org/t/how-to-renew-for-dynamic-dns-host-with-no-port-80/81818 "2019-01-07T16:54:35Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![quanah](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/quanah/32/19485_2.png) [@quanah](https://community.letsencrypt.org/u/quanah)\ **Post date:** [January 7, 2019, 4:54pm UTC](https://community.letsencrypt.org/t/how-to-renew-for-dynamic-dns-host-with-no-port-80/81818/1 "2019-01-07T16:54:35Z")
Now that TLS-SNI-01 has been deprecated, I’m curious as to how one is supposed to renew their cert when using a system where port 80 is not accessible and DNS is controlled by an external entity (Dynamic DNS)? ---
**Author:** ![cpu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/cpu/32/84514_2.png) [@cpu](https://community.letsencrypt.org/u/cpu)\ **Post date:** [January 7, 2019, 5:01pm UTC](https://community.letsencrypt.org/t/how-to-renew-for-dynamic-dns-host-with-no-port-80/81818/2 "2019-01-07T17:01:24Z")
Hi Quanah, > [@quanah](#): > > a system where port 80 is not accessible and DNS is controlled by an external entity (Dynamic DNS)? If you can't use the DNS-01 domain validation challenge or the HTTP-01 domain validation challenge your only remaining option at this time is TLS-ALPN-01. This is a new challenge type that operates over port `443`. Client/webserver support is not yet universal. Your best bet is to refer to this thread: [Which client support tls-alpn challenge?](https://community.letsencrypt.org/t/which-client-support-tls-alpn-challenge/75859) If your DNS provider allows you to add CNAME records you may be able to use DNS-01 challenges by delegating the `_acme-challenge` record through a CNAME to a different DNS provider that you can update programmatically with an API. [ACME-DNS](https://github.com/joohoi/acme-dns) is one example of a project that could help with this. Hope this helps! ---
**Author:** ![quanah](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/quanah/32/19485_2.png) [@quanah](https://community.letsencrypt.org/u/quanah)\ **Post date:** [January 7, 2019, 5:06pm UTC](https://community.letsencrypt.org/t/how-to-renew-for-dynamic-dns-host-with-no-port-80/81818/3 "2019-01-07T17:06:33Z")
Thank for the answer, but it doesn’t appear to help. I should have mentioned I’m using Apache HTTPD, where TLS-SNI-01 worked fine. It does not appear that certbot’s TLS-ALPN is supported with Apache HTTPD even though Apache HTTPD has TLS-ALPN support ([https://httpd.apache.org/docs/2.4/mod/mod\_http2.html](https://httpd.apache.org/docs/2.4/mod/mod_http2.html)) ---
**Author:** ![cpu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/cpu/32/84514_2.png) [@cpu](https://community.letsencrypt.org/u/cpu)\ **Post date:** [January 7, 2019, 5:10pm UTC](https://community.letsencrypt.org/t/how-to-renew-for-dynamic-dns-host-with-no-port-80/81818/4 "2019-01-07T17:10:17Z")
> [@quanah](#): > > It does not appear that TLS-ALPN is supported with Apache. Unfortunately not. You may have to shut down the webserver (to free up port 443), use an ACME client with a standalone TLS-ALPN-01 challenge server, and then start the webserver again. If you can't open port 80 and you can't use TLS-ALPN-01 I would recommend purchasing a domain you can fully control and using DNS-01. Unfortunately TLS-SNI-01 is not an option moving forward because [of the security issues that forced its deprecation](https://community.letsencrypt.org/t/february-13-2019-end-of-life-for-all-tls-sni-01-validation-support/74209). ---
**Author:** ![quanah](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/quanah/32/19485_2.png) [@quanah](https://community.letsencrypt.org/u/quanah)\ **Post date:** [January 7, 2019, 5:11pm UTC](https://community.letsencrypt.org/t/how-to-renew-for-dynamic-dns-host-with-no-port-80/81818/5 "2019-01-07T17:11:51Z")
That seems a limitation of certbot, not Apache. As I noted above, Apache supports TLS-ALPN via the mod\_http2 module. So shouldn’t it be possible to make it so certbot can do TLS-ALPN with Apache2? ---
**Author:** ![cpu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/cpu/32/84514_2.png) [@cpu](https://community.letsencrypt.org/u/cpu)\ **Post date:** [January 7, 2019, 5:12pm UTC](https://community.letsencrypt.org/t/how-to-renew-for-dynamic-dns-host-with-no-port-80/81818/6 "2019-01-07T17:12:51Z")
> [@quanah](#): > > As I noted above, Apache supports TLS-ALPN via the mod\_http2 module. So shouldn’t it be possible to make it so certbot can do TLS-ALPN with Apache2? Unfortunately no, Apache supports the TLS ALPN field but it does not support the ACME TLS-ALPN-01 challenge type. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [January 7, 2019, 5:16pm UTC](https://community.letsencrypt.org/t/how-to-renew-for-dynamic-dns-host-with-no-port-80/81818/7 "2019-01-07T17:16:52Z")
Also, some dynamic DNS services, such as [Duck DNS](https://www.duckdns.org/), _do_ let you set `TXT` records to perform ACME DNS validation. ---
**Author:** ![quanah](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/quanah/32/19485_2.png) [@quanah](https://community.letsencrypt.org/u/quanah)\ **Post date:** [January 7, 2019, 5:29pm UTC](https://community.letsencrypt.org/t/how-to-renew-for-dynamic-dns-host-with-no-port-80/81818/8 "2019-01-07T17:29:58Z")
I had to dig a bit, but apparently the service I’m using does as well. I’ll switch to that until such a time as Apache HTTPD implements TLS-ALPN. 😉 Thanks! ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [February 6, 2019, 5:30pm UTC](https://community.letsencrypt.org/t/how-to-renew-for-dynamic-dns-host-with-no-port-80/81818/9 "2019-02-06T17:30:03Z")
Closed on February 6, 2019, 5:30pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.