# LetsEncrypt IP Addresses... It's Actually pretty important

**URL:** <https://community.letsencrypt.org/t/letsencrypt-ip-addresses-its-actually-pretty-important/129760>\
**Category:** Feature Requests\
**Created:** [July 29, 2020, 10:58pm UTC](https://community.letsencrypt.org/t/letsencrypt-ip-addresses-its-actually-pretty-important/129760 "2020-07-29T22:58:22Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [July 29, 2020, 11:10pm UTC](https://community.letsencrypt.org/t/letsencrypt-ip-addresses-its-actually-pretty-important/129760/2 "2020-07-29T23:10:42Z")

</div>

Disclaimer first: all contents are personal, I'm not affiliated  
with Let's Encrypt or ISRG.

> [@TravisR](#):
>
> It wouldn’t be so bad if I could simply script the firewall rules on the system itself, but as I stated, I’m not permitted to make any changes to it.

I think you could always attempt to get the certificate via DNS validation, which definitely don't need HTTP port 80 access.

> [@TravisR](#):
>
> The entire point of the system is to help bring security and encrypt to the masses, but then requiring unsecured ports be left open and exposed to the entire world in order for it to function really seems like it’s defeating the purpose. Users shouldn’t have to open up security holes in order to secure their systems.

I don't think port 80 will be a security hole if you already have other ports open (if you don't have other ports, probably DNS based will be better in your use case if allowed). As many people suggested before, port 80 is a common port and in most cases only serve as a redirection port nowadays.

I think what Let's Encrypt want for not disclosing a list of IP and multi-va are all for avoid much worse security vulnerabilities (spoofing, for example), and Let's Encrypt provides at least another way for you to complete these challenges (through DNS TXT records, which can be used with acme-dns or something else if your company don't allow you to modify current NS/API). I know these can be hard for large corporations and some sensitive business / government, but HTTP based validation isn't your only choice.

---

_[View the full topic](https://community.letsencrypt.org/t/letsencrypt-ip-addresses-its-actually-pretty-important/129760)._