# Sophos Country Blocking blocks LetsEncrypt **URL:** \ **Category:** Help\ **Created:** [July 13, 2021, 10:54am UTC](https://community.letsencrypt.org/t/sophos-country-blocking-blocks-letsencrypt/155629 "2021-07-13T10:54:13Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![s.hasslinger](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@s.hasslinger](https://community.letsencrypt.org/u/s.hasslinger)\ **Post date:** [July 13, 2021, 10:54am UTC](https://community.letsencrypt.org/t/sophos-country-blocking-blocks-letsencrypt/155629/1 "2021-07-13T10:54:13Z")
On Sophos Firewalls, actually SG firewall with version 9.x with enabled country blocking feature: At various sophos community articles the suggested way to get LetsEncrypt working is to exclude the following DNS Group's from the country blocking feature. (In Sophos World, "DNS Group" is a dns entry with multiple ip's if you dont know). DNS Groups - [acme-staging-v02.api.letsencrypt.org](http://acme-staging-v02.api.letsencrypt.org) - [acme-v01.api.letsencrypt.org](http://acme-v01.api.letsencrypt.org) - [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org) For Services - HTTPS - HTTP But the verifications done by let's encrypt servers are still blocked. It seems that there are connections from various amazon cloud servers in addition. So my question is: Does somebody know the "real-list" of all dns addresses of used sources from letsencrypt verification process? ---
**Author:** ![Nummer378](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nummer378/32/49862_2.png) [@Nummer378](https://community.letsencrypt.org/u/Nummer378)\ **Post date:** [July 13, 2021, 12:41pm UTC](https://community.letsencrypt.org/t/sophos-country-blocking-blocks-letsencrypt/155629/2 "2021-07-13T12:41:02Z")
> **[FAQ - Let's Encrypt](https://letsencrypt.org/docs/faq/#what-ip-addresses-does-let-s-encrypt-use-to-validate-my-web-server)** > > This FAQ is divided into the following sections: > General Questions Technical Questions General Questions What services does Let’s Encrypt offer? Let’s Encrypt is a global Certificate Authority (CA). We let people and organizations... ---
**Author:** ![s.hasslinger](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@s.hasslinger](https://community.letsencrypt.org/u/s.hasslinger)\ **Post date:** [July 13, 2021, 1:11pm UTC](https://community.letsencrypt.org/t/sophos-country-blocking-blocks-letsencrypt/155629/3 "2021-07-13T13:11:17Z")
The common FAQ did not help me. I already know: - [Multi-Perspective Validation Improves Domain Validation Security - Let's Encrypt](https://letsencrypt.org/2020/02/19/multi-perspective-validation.html) But i'm searching for the DNS Names, IP-Ranges, Network IDs ... Everything i can transform into a rule for the firewall. I cant disable the whole feature because of Let's Encrypt. ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [July 13, 2021, 1:15pm UTC](https://community.letsencrypt.org/t/sophos-country-blocking-blocks-letsencrypt/155629/4 "2021-07-13T13:15:47Z")
Let's Encrypts validation servers check from many places on the Internet because they need to validate that you own the name as seen from all vantage points on the Internet. They do not and will not publish network ranges because where they check from constantly change. You need to either allow all traffic from everywhere for HTTP (at least while running renewals; some people go so far as to script opening up the firewall at the start of renewing and closing it up again afterwards); or switch to a DNS-01 challenge (where you automate updating your DNS, and assuming you allow access to the DNS server from everywhere even if you don't want to allow HTTP from everywhere). > **[Challenge Types - Let's Encrypt](https://letsencrypt.org/docs/challenge-types/)** > > When you get a certificate from Let’s Encrypt, our servers validate that you control the domain names in that certificate using “challenges,” as defined by the ACME standard. Most of the time, this validation is handled automatically by your ACME... ---
**Author:** ![s.hasslinger](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@s.hasslinger](https://community.letsencrypt.org/u/s.hasslinger)\ **Post date:** [July 13, 2021, 1:22pm UTC](https://community.letsencrypt.org/t/sophos-country-blocking-blocks-letsencrypt/155629/5 "2021-07-13T13:22:22Z")
Okay that's an answer. Sadly a less good one. This really means, I have to drill a big hole in the firewall to get Let's Encrypt working. However, thanks for the answer! ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 13, 2021, 6:00pm UTC](https://community.letsencrypt.org/t/sophos-country-blocking-blocks-letsencrypt/155629/6 "2021-07-13T18:00:50Z")
> [@s.hasslinger](#): > > I have to drill a big hole in the firewall to get Let's Encrypt working. Yes, but no. The (not so big) _hole_ only needs to be for HTTP (if you do HTTP auth and don't redirect the challenge requests to HTTPS). If you do DNS auth, then there is no _HTTP hole_ required. ---
**Author:** ![s.hasslinger](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@s.hasslinger](https://community.letsencrypt.org/u/s.hasslinger)\ **Post date:** [July 14, 2021, 7:46am UTC](https://community.letsencrypt.org/t/sophos-country-blocking-blocks-letsencrypt/155629/7 "2021-07-14T07:46:23Z")
Okay... yes we have a http to https redirection active in the firewall. Okay that means i can create an https exception for our target ip's without http. I will verify that. As far as i saw, all connection came from Amazon AWS servers from the US. But that doesnt mean that another connection will come from another aws server location or another cloud provider. So "any" exception for https in country block is needed. ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [July 14, 2021, 10:05am UTC](https://community.letsencrypt.org/t/sophos-country-blocking-blocks-letsencrypt/155629/8 "2021-07-14T10:05:15Z")
> [@s.hasslinger](#): > > So "any" exception for https in country block is needed. ...unless you use DNS validation. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 14, 2021, 4:04pm UTC](https://community.letsencrypt.org/t/sophos-country-blocking-blocks-letsencrypt/155629/9 "2021-07-14T16:04:46Z")
My suggestion was to allow HTTP from everywhere. Handle the authentication requests in HTTP. Forward all else to HTTPS. [block any/all countries from HTTPS only] ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [August 13, 2021, 4:04pm UTC](https://community.letsencrypt.org/t/sophos-country-blocking-blocks-letsencrypt/155629/10 "2021-08-13T16:04:49Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.