Perhaps this topic is already discussed but I did’nt find any information in forum or by search engine… For a firewall setup on Domain-Site that is configured in whitelisting manner the client possibly can’t connect like in my first tests. The Cert build completed successfully when I opened port 80…

yes, need this too, but better way would be if there is a way that the LE asks external DNS records for validation. I need also certs for internal services which aren’t available from external.

Just find them out by yourself. SSLLabs also shows the IPs of the server quite well… Here is the “v1” server I found here : https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2Facme-v01.api.letsencrypt.org&latest And here the staging/testing server: https://www.ssllabs.com/ssltest/analyze…

[image] rugk: Just find them out by yourself. If they are going in a firewall rule somewhere that means the LE team needs to acknowledge they aren't going to change, which is different than just YOLO-ing it up :slight_smile:

Well… yes of course. But for now you can already set the rule up. I don’t think they’ll change their IPs in the next tree months.

We plan to frequently change the set of IPs from which we validate, and will validate from multiple IPs in the future. Any host answering challenges should have port 80 or 443 available to the Internet.

[image] rugk: Just find them out by yourself. SSLLabs also shows the IPs of the server quite well... You can just query the DNS entries for that, you don't need SSLLabs. Additionally, that shows you the IP of the API server, not necessarily the Validation Authority. As @jsha already said, IPs…

[image] jsha: Any host answering challenges should have port 80 or 443 available to the Internet. For me it isn't about the ports being open or not, I want to use iptables REDIRECT rules for mediating access to the ACME client. The avoids a lot of the issues where the normal LE client has to …

I have a similar want. Right now we have bitbucket calling the single public IP address on port 80 to activate web hooks that trigger CI builds.. Traffic to port 80 from bitbuckets provided network ranges is routed to the CI server. From their documentation : If you want your server to check that …

IP addresses LE is validating from to build firewall rule

Help

coderanger December 4, 2015, 8:03pm 2

Would love to see this too. Also [Suggestion] List of IP addresses LE is connecting from is requesting the same thing.

Topic		Replies	Views
Whitelisting LE IP addresses / ranges in Firewall Server	10	91396	October 31, 2017
Feature Request: List of Source IPs Used In HTTP-01 Challenge Feature Requests	16	28258	January 17, 2020
Is this an actual LE validation server, or someone pretending to be you? Issuance Tech	41	1526	December 21, 2025
[Suggestion] List of IP addresses LE is connecting from Client dev	1	10685	December 5, 2015
HTTPS Authentication behind a firewall Help	9	13224	May 31, 2019

IP addresses LE is validating from to build firewall rule

Related topics