I understand the reasons that LetsEncrypt won't publish the IP addresses for the challenge servers. I also know about DNS-01 (which will not work for us since we need to manually update DNS with our hosting company). My suggestion is to implement a directive in the renewal configuration file to spe…

This would defeat the purpose of multi-perspective validation. The idea is that, by performing validation from many unpredictable locations around the world, we can reduce the likelihood that a local or targeted BGP hijack attack affects all of our validation perspectives, and thereby prevent the at…

For us, the "many unpredictable locations around the world" will mostly get blocked since all of our clients (and therefore, the only traffic we want to allow) is from the US. Everything else is dropped by default. If it were "many unpredictable locations around the US", we wouldn't see the problem…

[image] kcolagio: "many unpredictable locations around the world" will mostly get blocked since all of our clients (and therefore, the only traffic we want to allow) is from the US. Everything else is dropped by default. @kcolagio that is a choice your organization made. But there is more th…

There will be a hard requirement (from 2026 oct iirc) for CA to validate domain from at least two different RIR zone (slight different but mostly per continent) so blocking outside USA won't work

[image] kcolagio: I don't understand how this is a mitigation of risk considering the ease of obtaining the same information in other ways. (I'm honestly curious, feel free to DM me if you don't want it public.) I think you may be missing the point of what a CA does: Its entire purpose is to …

Although you mentioned DNS-01 won't work for you, this might be helpful to other readers: one way to use DNS-01, even if you can't programatically update records on your main DNS host, is to delegate the _acme-challenge subdomain(s) (using NS records) to another host or service that does offer an AP…

As an organization that needs to meet certain security compliance standards, we don't entirely have a choice in how we block traffic. Thanks for the extra links though. Much appreciated!

[image] kcolagio: As an organization that needs to meet certain security compliance standards, we don't entirely have a choice in how we block traffic. You only have to allow worldwide access to limited resources, ie ${fqdn}/.well-known/acme-challenge via http or _acme-challenge.${fqdn} on dn…

I cant speak for why ISRG requires things, but my opinion is: Responding in reverse, as this order may make more sense: [image] kcolagio: I don't understand how this is a mitigation of risk considering the ease of obtaining the same information in other ways. The multiple validation points …

[image] jvanasco: LetsEncrypt helps secure websites by requiring global validation to ensure a wide array of routing paths are not compromised. By deciding to geofence your network, while your organization limited the number of routing paths that can be compromised, it also restricted itself out…

Specify source country for http-01 challenge

Feature Requests

Bruce5051 April 15, 2024, 6:41pm 9

@kcolagio here is a list of DNS providers who easily integrate with Let's Encrypt DNS validation

Topic		Replies	Views
Alternative for allowing letsencrypt file auth connections for a geo-restricted server Feature Requests	40	533	December 17, 2024
Firewall Geoblocking and LetsEncrypt Help	12	1345	February 19, 2025
Whitelist LetsEncrypt Server IPs Help	18	26441	May 15, 2024
Some challenges have failed due to geographic blocking Help	5	785	April 9, 2024
DNS name for validation endpoints Feature Requests	12	384	September 1, 2025

Specify source country for http-01 challenge

Related topics