# TLS-SNI-01 validation is reaching end-of-life

**URL:** <https://community.letsencrypt.org/t/tls-sni-01-validation-is-reaching-end-of-life/82970>\
**Category:** Help\
**Created:** [January 18, 2019, 11:34am UTC](https://community.letsencrypt.org/t/tls-sni-01-validation-is-reaching-end-of-life/82970 "2019-01-18T11:34:51Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [January 18, 2019, 11:47am UTC](https://community.letsencrypt.org/t/tls-sni-01-validation-is-reaching-end-of-life/82970/5 "2019-01-18T11:47:19Z")

</div>

You should be safe, then.

Certbot 0.23.0 is new enough that it supports HTTP validation, but old enough that it will continue to use TLS-SNI validation by default until Let's Encrypt disables it.

You could upgrade to a newer version of Certbot that uses HTTP validation by default, but you don't really have to.

[https://certbot.eff.org/lets-encrypt/ubuntubionic-nginx](https://certbot.eff.org/lets-encrypt/ubuntubionic-nginx)

If you run "`grep pref_challs /etc/letsencrypt/cli.ini /etc/letsencrypt/renewal/*`", are any of your certificates forcing TLS-SNI validation?

Edit:

For posterity, the `grep` command above only half works. It should have been:

```
grep preferred-challenges /etc/letsencrypt/cli.ini
grep pref_challs /etc/letsencrypt/renewal/*

```

See also:

> [@How to stop using TLS-SNI-01 with Certbot](https://community.letsencrypt.org/t/how-to-stop-using-tls-sni-01-with-certbot/83210):
>
> L…

---

_[View the full topic](https://community.letsencrypt.org/t/tls-sni-01-validation-is-reaching-end-of-life/82970)._