# My Server is Geoblocked and I don't have DNS or Firewall privileges **URL:** \ **Category:** Help\ **Created:** [April 24, 2024, 8:54pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128 "2024-04-24T20:54:22Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![miqrogroove](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/miqrogroove/32/29414_2.png) [@miqrogroove](https://community.letsencrypt.org/u/miqrogroove)\ **Post date:** [April 24, 2024, 8:54pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/1 "2024-04-24T20:54:22Z")
One of my production websites is on an Ubuntu virtual server where I am the root admin and primary developer. However, I do not administer the domain record, DNS, or firewall. This server was installed January 2023 and ran smoothly since. I recently received an email about the TLS certificate expiring in less than 30 days. I logged in to check this today and found an expiration date of 2024-04-30, which is next week. I saw the pinned announcement here > [@Unexpected renewal failures during April 2024? Please read this!](https://community.letsencrypt.org/t/unexpected-renewal-failures-during-april-2024-please-read-this/216830): > > A… I confirmed there is a secondary validation timeout in the logs. But I'm not seeing a solution that would allow me to continue using certbot. I will get in touch with other admins and ISP contacts to see what they can do, otherwise this looks like the end of the road for Let's Encrypt and certbot. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 24, 2024, 8:56pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/2 "2024-04-24T20:56:57Z")
> [@miqrogroove](#): > > I do not administer the domain record, DNS, or firewall. Do you have enough time to reach someone who can makes changes within any of those systems? ---
**Author:** ![miqrogroove](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/miqrogroove/32/29414_2.png) [@miqrogroove](https://community.letsencrypt.org/u/miqrogroove)\ **Post date:** [April 24, 2024, 9:01pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/3 "2024-04-24T21:01:13Z")
We have discussed various problems with the geoblocking before and got nowhere. So from a b2b perspective, no I don't have enough time. I'm optimistic that I can figure out the DNS-01 requirements and forward them to another admin. That takes time. Testing takes time. Renewal should be quick if it works. Fingers crossed. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 24, 2024, 9:02pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/4 "2024-04-24T21:02:19Z")
If it comes to that here's some other free CA's supporting ACME > **[ACME CA Comparison - Posh-ACME](https://poshac.me/docs/v4/Guides/ACME-CA-Comparison/#acme-ca-info)** > > Documentation for the Posh-ACME PowerShell module ---
**Author:** ![miqrogroove](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/miqrogroove/32/29414_2.png) [@miqrogroove](https://community.letsencrypt.org/u/miqrogroove)\ **Post date:** [April 24, 2024, 9:14pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/5 "2024-04-24T21:14:32Z")
Wait, DNS-01 requires a new DNS record for every renewal? This isn't going to work. ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [April 24, 2024, 9:18pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/6 "2024-04-24T21:18:59Z")
> [@miqrogroove](#): > > DNS-01 requires a new DNS @miqrogroove here is a list [DNS providers who easily integrate with Let's Encrypt DNS validation](https://community.letsencrypt.org/t/dns-providers-who-easily-integrate-with-lets-encrypt-dns-validation/86438) may be an option for you. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 24, 2024, 9:20pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/7 "2024-04-24T21:20:36Z")
You could CNAME the "`_acme-challenge`" entry(entries) to some other name that you can handle in a more automated fashion. Right now [in short-term], you only need them to help renew the current cert(s) once. Then you will have 90 days to figure things out [for the long-term plan]. ---
**Author:** ![miqrogroove](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/miqrogroove/32/29414_2.png) [@miqrogroove](https://community.letsencrypt.org/u/miqrogroove)\ **Post date:** [April 24, 2024, 10:00pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/8 "2024-04-24T22:00:11Z")
> [@rg305](#): > > You could CNAME the "`_acme-challenge`" entry That's a clever hack. I will mention it to the other admins if it may be appropriate... but I doubt it would be the preferred solution. ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [April 24, 2024, 10:03pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/9 "2024-04-24T22:03:07Z")
> [@miqrogroove](#): > > but I doubt it would be the preferred solution. But can it work until your organization gets better solution in place? ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [April 24, 2024, 10:46pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/10 "2024-04-24T22:46:31Z")
I don't even know as I'd call it a "hack", it's just the normal way of delegating a name to another party. You may also want to investigate tools like [acme-dns](https://github.com/joohoi/acme-dns), where you delegate to a special-purpose DNS server you've set up that's just for answering the challenge. Sticking with HTTP-01 is often simpler for most cases. Even if your network uses geoblocking for port 443, you may be able to convince them to not geoblock on port 80 (since all it normally does is redirect to https and [can generally be left open](https://letsencrypt.org/docs/allow-port-80/), or maybe convince them to at least not geoblock on `/.well-known/acme-challenge` paths. You may have a more fundamental problem, though, if you have responsibility for a website but don't actually have any administrative control over the infrastructure for it, then it's not really _your_ website. ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [April 24, 2024, 10:55pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/11 "2024-04-24T22:55:47Z")
Also if you (HTTP) Specify the User-Agent string as "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)" could help further restrict the window as well, I don't think it would add any real security. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 25, 2024, 12:19am UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/12 "2024-04-25T00:19:09Z")
> [@petercooperjr](#): > > I don't even know as I'd call it a "hack" # "life hack" ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [April 25, 2024, 1:19am UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/13 "2024-04-25T01:19:42Z")
This particular issue (geoblocking results in failed validation) is affecting thousands of users who have merrily geoblocked in the past and thought it would never be a problem, but I think Lets Encrypt are standing firm on the issue. I would doubt anything is going to change, so your solutions include: - remove geoblocking - target geoblocking to specific countries - allow /.well-known-acme/challenge/ http requests from any country (possible if using a web application firewall). - switch to DNS validation DNS validation requires automated DNS updates, so your domain DNS needs an API thats supported by whatever ACME tool you use (cerbot). It needs to add/update/remove the \_acme-challenge record for the domain and any subdomains (e.g. \_acme-challenge.www.yourdomain.com). As an alternative already mentioned you can CNAME a permanent record to another zone, e.g. one you control, in order to delegate challenge response handling to a DNS zone that has a working API). Some people use acme-dns as mentioned, either self hosting or using the unsupported hosted version that the acme-dns project provides. You can also optionally use [Certify DNS](https://docs.certifytheweb.com/docs/dns/providers/certifydns/) (which is a product my company provides) which is a paid, supported product that does much the same as acme-dns but is managed, supported and cloud hosted. Really the immediate workaround is to be much more selective about geoblocking, typically geoblocking is a reaction to concerns about traffic from specific countries. ---
**Author:** ![miqrogroove](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/miqrogroove/32/29414_2.png) [@miqrogroove](https://community.letsencrypt.org/u/miqrogroove)\ **Post date:** [April 25, 2024, 2:04am UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/14 "2024-04-25T02:04:09Z")
> [@petercooperjr](#): > > You may have a more fundamental problem, though, if you have responsibility for a website but don't actually have any administrative control over the infrastructure for it, then it's not really _your_ website. Well, you're not wrong. It also means the decision to stop using Let's Encrypt is moot and its replacement will be decided by the folks who run the hardware. Mine is not the only server affected by the firewall and I've sensed some desire to switch to premium certs. In the meantime, I will make sure the firewall adjustments and DNS delegation are being considered. ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [April 25, 2024, 9:08am UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/15 "2024-04-25T09:08:55Z")
> [@miqrogroove](#): > > I've sensed some desire to switch to premium certs I'm not sure that will solve this issue. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 25, 2024, 1:19pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/16 "2024-04-25T13:19:19Z")
It would only _work-around_ it. And would be a completely manual process. That said, paid certs can last a year. [so, a once-a-year manual process] ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [April 25, 2024, 1:39pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/17 "2024-04-25T13:39:51Z")
> [@rg305](#): > > And would be a completely manual process. Paid certs aren't necessarily manual; many CAs have automated systems (some even including ACME) and can allow for easier centralized management of an organization's certificates and getting them all installed where they need to go, plus centralized alerting and tech support and such. > [@9peppe](#): > > I'm not sure that will solve this issue. But yes, paid certs need to follow the same rules for validating domain control as a free CA, and the industry is moving to validating from multiple perspectives in general. So I wouldn't suggest switching to a paid CA just based on this. If you want to use a different CA as a temporary workaround, there are plenty of other free ones. > [@miqrogroove](#): > > It also means the decision to stop using Let's Encrypt is moot and its replacement will be decided by the folks who run the hardware. Yeah, probably in general certificates should be considered part of an organization's infrastructure, and I would expect them to be managed by the same team that handles the firewalls and DNS and other key infrastructure. ---
**Author:** ![jvanasco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jvanasco/32/55900_2.png) [@jvanasco](https://community.letsencrypt.org/u/jvanasco)\ **Post date:** [April 25, 2024, 1:57pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/18 "2024-04-25T13:57:30Z")
> [@miqrogroove](#): > > Well, you're not wrong. It also means the decision to stop using Let's Encrypt is moot and its replacement will be decided by the folks who run the hardware. Mine is not the only server affected by the firewall and I've sensed some desire to switch to premium certs FYI, the max lifetimes of premium/paid certificates are increasingly getting shorter. It was dropped from 2 years to 1 year a few years ago, and is expected to drop again. Eventually the options will likely be 90 day or 10 day certificates. In other words, the switch will be temporary and you'll likely have this same problem in a few years. > [@petercooperjr](#): > > You may also want to investigate tools like [acme-dns](https://github.com/joohoi/acme-dns), where you delegate to a special-purpose DNS server you've set up that's just for answering the challenge. I suggest @miqrogroove reads the acme-dns docs. They best explain all the setup required for advanced delegation techniques – even if you don't use acme-dns. With the acme-dns technique, you set up a FQDN to act as a nameserver, then CNAME records from your primary DNS onto that nameserver. Certbot then automates manipulating those records - which are isolated away from the primary/normal dns system. You don't need to self-host or use acme-dns for this type of setup, you can use a commercial/third-party dns server like Cloudflare or Amazon. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 25, 2024, 6:15pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/19 "2024-04-25T18:15:38Z")
> [@miqrogroove](#): > > the end of the road for Let's Encrypt and certbot Please note that Certbot is just an ACME client and is not causing any rate limit or geoblocking or whatever limitation imposed by the ACME server (i.e., the CA). Certbot can be configured to work with any ACME server out there. (See the list mentioned earlier.) It's probably good to know that in time when the CA/Browser Forum ballot [SC-067: Require Multi-Perspective Issuance Corroboration (Version 1)](https://github.com/cabforum/servercert/pull/487) passes, all publicly trusted CAs need to do some kind of multi-perspective validation to keep issuing publicly trusted certificates. While these perspectives might or might not be more or less problematic with geoblocking, it's good to realise that. > [@jvanasco](#): > > You don't need to self-host or use acme-dns for this type of setup, you can use a commercial/third-party dns server like Cloudflare or Amazon. Yup, I've tried it myself once with a NS RR for the `_acme-challenge` label pointing to the Cloudflare nameservers for that domain and using the `certbot-dns-cloudflare` plugin. Works quite nicely. With a NS instead of CNAME you also don't need a separate zone/domain for the ACME stuff. ---
**Author:** ![miqrogroove](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/miqrogroove/32/29414_2.png) [@miqrogroove](https://community.letsencrypt.org/u/miqrogroove)\ **Post date:** [April 25, 2024, 6:17pm UTC](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128/20 "2024-04-25T18:17:29Z")
Switched to ZeroSSL with their EAB parameters for certbot. Problem solved. [Next page](https://community.letsencrypt.org/t/my-server-is-geoblocked-and-i-dont-have-dns-or-firewall-privileges/217128.md?page=2)