Http0 GKE Validation IPV4 Only

Help
1

If I create a test environment I'm able to get a valid certificate without any issues. My Staging and Production environment has IPV6 as a requirement, so what I ended up using is to follow this pattern in order to get an IPv6 Address in GKE.

Is there a flag I could be able to add to force IPv4?

Failing that, I would need DNS validation as I'm not using a standard DNS service provider, is there a guide on how to setup a custom app to write the DNS entries required for DNS validation that ties into GKE to succeed?

Here's a ticket I created a while back for more context if anyone would like to read.

2

No, there is not. The Let's Encrypt validation servers prefer IPv6 if an AAAA record exists. Although it's not clear to me why that would be an issue at all?

1 Like
3

I'm not sure either but the LB is the only thing I can see that's different between the two environments. It's supposed to forward all requests but maybe the multiple layers of SSL is breaking it?

IPv6 has a different SSL certificate while I'm trying to obtain a LetsEncrypt one for the IPv4 stack.

4

Are they separate load-balancers?
Can't they use the same cert?

5

Well, GKE currently doesn't support IPv6 as far as I can tell so unfortunately not.

6

hmm...

If you proxied the IPv6 HTTPS connections as streams then they could always reach the IPv4 systems

If a stream proxy is not an option, then you could:

  • renew original FQDN(1) via IPv6 systems [twice a day cron job renewal check]
  • redirect FQDN(1) challenge requests to an IPv4 only FQDN(2) [triggered upon IPv6 renewals]
  • renew original FQDN(1) via FQDN(2) systems [triggered after redirection]
  • remove redirection [triggered upon IPv4 renewals]
7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.