# Webroot challenges now coming from amazonaws.com **URL:** \ **Category:** Issuance Policy\ **Created:** [March 13, 2020, 6:09pm UTC](https://community.letsencrypt.org/t/webroot-challenges-now-coming-from-amazonaws-com/116314 "2020-03-13T18:09:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![sbbeachvball](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@sbbeachvball](https://community.letsencrypt.org/u/sbbeachvball)\ **Post date:** [March 13, 2020, 6:09pm UTC](https://community.letsencrypt.org/t/webroot-challenges-now-coming-from-amazonaws-com/116314/1 "2020-03-13T18:09:37Z")
I have a dev website using letsencrypt certs that is now failing to renew. Because the website is dev, I limit exposure to the internet at large via apache acls. I have acls entries in place to allow renewal from [letsencrypt.org](http://letsencrypt.org) which has worked perfectly in the past. Looking at apache logs after the failure, I see requests to the .well-known directory from [amazonaws.com](http://amazonaws.com). I am assuming they requests are legit and will add an acl entry for it. The documentation still claims that issuances and renewals originate from [letsencrypt.org](http://letsencrypt.org). Documentation should be updated to reflect other domains that authenticator requests may come from. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 13, 2020, 6:13pm UTC](https://community.letsencrypt.org/t/webroot-challenges-now-coming-from-amazonaws-com/116314/2 "2020-03-13T18:13:09Z")
> [@sbbeachvball](#): > > The documentation still claims that issuances and renewals originate from [letsencrypt.org](http://letsencrypt.org). Documentation should be updated to reflect other domains that authenticator requests may come from. Where do you see that documentation? Because the Let's Encrypt docs clearly say you shouldn't use ACLs because Let's Encrypt explicitly doesn't list the sources it's validating from! [FAQ - Let's Encrypt](https://letsencrypt.org/docs/faq/) ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [March 13, 2020, 6:14pm UTC](https://community.letsencrypt.org/t/webroot-challenges-now-coming-from-amazonaws-com/116314/3 "2020-03-13T18:14:49Z")
FYI, the official announcement of this change was here: > [@ACME v1/v2: Validating challenges from multiple network vantage points](https://community.letsencrypt.org/t/acme-v1-v2-validating-challenges-from-multiple-network-vantage-points/112253): > > O… ---
**Author:** ![ski192man](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@ski192man](https://community.letsencrypt.org/u/ski192man)\ **Post date:** [March 13, 2020, 6:16pm UTC](https://community.letsencrypt.org/t/webroot-challenges-now-coming-from-amazonaws-com/116314/4 "2020-03-13T18:16:39Z")
IMO best practices would be to use your standard ACLs to block access to everything, then allow everyone access to only the .well-known/acme-challenge/ directory which should always be empty except for a few moments during renewal. Or use a different challenge like DNS-01 ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 13, 2020, 6:20pm UTC](https://community.letsencrypt.org/t/webroot-challenges-now-coming-from-amazonaws-com/116314/5 "2020-03-13T18:20:30Z")
> [@ski192man](#): > > (…) then allow everyone access to only the .well-known/acme-challenge/ directory which should always be empty except for a few moments during renewal. And if that's too "open", you might be able to temporarily allow access to `/.well-known/acme-challenge/` during a renewal by scripting something. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [March 13, 2020, 6:29pm UTC](https://community.letsencrypt.org/t/webroot-challenges-now-coming-from-amazonaws-com/116314/6 "2020-03-13T18:29:19Z")
If you proxy all port 80 connections (or just send them to another server), then your risk is already minimized. Ideally only the `/.well-known/acme-challenge/` requests would ever hit your actual web server (and even then, only via proxy). ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [April 12, 2020, 6:29pm UTC](https://community.letsencrypt.org/t/webroot-challenges-now-coming-from-amazonaws-com/116314/7 "2020-04-12T18:29:29Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.