# Required ports to run Let's Encrypt **URL:** \ **Category:** Server\ **Created:** [June 14, 2017, 10:29am UTC](https://community.letsencrypt.org/t/required-ports-to-run-lets-encrypt/36101 "2017-06-14T10:29:53Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![bartlomiej.kania](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@bartlomiej.kania](https://community.letsencrypt.org/u/bartlomiej.kania)\ **Post date:** [June 14, 2017, 10:29am UTC](https://community.letsencrypt.org/t/required-ports-to-run-lets-encrypt/36101/1 "2017-06-14T10:29:53Z")
Hi! I have all ports blocked on my server and can just unblock specific ones. Could you please tell me which ports should I unblock to get Let’s Encrypt work? Best regards, Bart ---
**Author:** ![Nekit](https://avatars.discourse-cdn.com/v4/letter/n/7feea3/32.png) [@Nekit](https://community.letsencrypt.org/u/Nekit)\ **Post date:** [June 14, 2017, 11:04am UTC](https://community.letsencrypt.org/t/required-ports-to-run-lets-encrypt/36101/2 "2017-06-14T11:04:12Z")
None if you can/want to use `DNS-01` challenge, `80` if you want to use `HTTP-01` challenge and `443` if you want to use `TLS-SNI-01` challenge. If you donʼt mind me asking, why do you want a certificate issued by a public CA if your server have _all_ of its ports blocked? ---
**Author:** ![bartlomiej.kania](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@bartlomiej.kania](https://community.letsencrypt.org/u/bartlomiej.kania)\ **Post date:** [June 14, 2017, 1:20pm UTC](https://community.letsencrypt.org/t/required-ports-to-run-lets-encrypt/36101/3 "2017-06-14T13:20:41Z")
I mean the server out ports to handle all communications with Let’s Encrypt servers, not the server in ports. So I have all out traffic blocked on the server and just need to unblock ports for Let’s Encrypt. Regards, Bart ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [June 14, 2017, 2:38pm UTC](https://community.letsencrypt.org/t/required-ports-to-run-lets-encrypt/36101/4 "2017-06-14T14:38:07Z")
> [@bartlomiej.kania](#): > > I mean the server out ports to handle all communications with Let's Encrypt servers The client software needs to make outbound connections to ports 80 and 443. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [June 14, 2017, 6:17pm UTC](https://community.letsencrypt.org/t/required-ports-to-run-lets-encrypt/36101/5 "2017-06-14T18:17:50Z")
> [@danb35](#): > > The client software needs to make outbound connections to ports 80 and 443. Depending on the client software in question, I think potentially only 443. All of the ACME protocol itself runs over HTTPS. Maybe 80 is also useful for features like OCSP stapling? ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [June 14, 2017, 6:27pm UTC](https://community.letsencrypt.org/t/required-ports-to-run-lets-encrypt/36101/6 "2017-06-14T18:27:31Z")
Clients do at least one or two DNS queries as well. So they need to be able to access whatever the system’s configured resolver is, presumably on port 53. (Are there OSes where the standard networking libraries can be configured to use a different port? Does anyone do it?) ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [June 14, 2017, 7:58pm UTC](https://community.letsencrypt.org/t/required-ports-to-run-lets-encrypt/36101/7 "2017-06-14T19:58:48Z")
> [@schoen](#): > > Depending on the client software in question, I think potentially only 443. I thought I saw some http:// calls in dehydrated, but I could be mistaken. Thanks for the clarification. ---
**Author:** ![lsabiiniok](https://avatars.discourse-cdn.com/v4/letter/l/779978/32.png) [@lsabiiniok](https://community.letsencrypt.org/u/lsabiiniok)\ **Post date:** [June 20, 2017, 9:00am UTC](https://community.letsencrypt.org/t/required-ports-to-run-lets-encrypt/36101/8 "2017-06-20T09:00:35Z")
Bart doesn’t think about outgoing traffic The thing is that there is some incoming traffic needed to install letsencrypt using Certbot. Company security policy blocks Internet connection. It can be unblocked but we need to specify IPs and port numbers to hosts that certbot needs to communicate with to successfully install and renew certificates. Or alternatively - find a way to import certificates without internet connection, using csr or sth ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [June 20, 2017, 5:54pm UTC](https://community.letsencrypt.org/t/required-ports-to-run-lets-encrypt/36101/9 "2017-06-20T17:54:51Z")
Hi @lsabiiniok, It sounds like you’re saying that you have a different situation in which you want to know what you need to allow for inbound connections in order to perform the validation. As a matter of policy, Let’s Encrypt does not commit to using particular IP addresses for inbound validation connections, and may change or randomize these without any notice. Therefore, Let’s Encrypt-specific firewall rules are not supported. You can use the DNS-01 challenge method to perform validations without allowing inbound connections. This involves making a requested change to your DNS zones, which some Let’s Encrypt clients can do automatically for some DNS providers. You can find out a lot more information about this method by searching on this forum. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [July 20, 2017, 5:55pm UTC](https://community.letsencrypt.org/t/required-ports-to-run-lets-encrypt/36101/10 "2017-07-20T17:55:37Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.