We are currently using the Let’s Encrypt official client with standalone and webroot plugins on hosts which are not providing a HTTP(S) service like SMTP, XMPP, FTPS or IRC servers. We would like to filter the port used to authenticate the domain only to Let’s Encrypt outbound validators IP address…

[image] IP addresses LE is validating from to build firewall rule Help W…

The validation addresses are specifically not guaranteed to be stable over time, and we are likely to validate from multiple IP addresses in the future. If you use the dns-01 challenge instead of the http-01 or tls-sni-01 challenges, you can avoid leaving HTTP ports open. Though I realize dns-01 is…

[image] jsha: The validation addresses are specifically not guaranteed to be stable over time, and we are likely to validate from multiple IP addresses in the future. If you use the dns-01 challenge instead of the http-01 or tls-sni-01 challenges, you can avoid leaving HTTP ports open. Though I…

BTW, a port with no software bound is not “open”.

We finally settled down to a solution, every HTTP host is proxying /.well-known/acme-challenge/ to our letsencrypt validator container and every HTTPS host is forbidding /.well-known/acme-challenge/ queries to prevent users to hit the rate limit on our domain name. For all services on public IP add…

[image] gradator: Or I am missing something ?, from my understanding tls-sni-01 only works in standalone mode if the validator server can directly connect to the letsencrypt client As I understand it, the connection doesn't need to be "direct" as long as the proxy doesn't break the TLS channe…

[image] jmorahan: As I understand it, the connection doesn't need to be "direct" as long as the proxy doesn't break the TLS channel. Since the SNI information is sent outside of the encrypted channel, a sufficiently intelligent proxy could probably inspect that information and if the request is …

IP addresses of outbound validators stability over time

Issuance Tech

jmorahan March 1, 2016, 12:04am 2

Topic		Replies	Views
Outbound traffic - stability of IP address of acme-v01.api.letsencrypt.org Issuance Tech	9	7224	October 6, 2016
Validation servers' DNS records Issuance Tech	2	2688	May 19, 2016
Let's Encrypt server addresses for certificate renewal Issuance Tech	8	132851	February 20, 2019
DNS name for validation endpoints Feature Requests	13	341	October 1, 2025
Certonly to use 443? Help	12	8096	December 25, 2015

IP addresses of outbound validators stability over time

Related topics