I have a dev website using letsencrypt certs that is now failing to renew. Because the website is dev, I limit exposure to the internet at large via apache acls. I have acls entries in place to allow renewal from letsencrypt.org which has worked perfectly in the past. Looking at apache logs after…

[image] sbbeachvball: The documentation still claims that issuances and renewals originate from letsencrypt.org . Documentation should be updated to reflect other domains that authenticator requests may come from. Where do you see that documentation? Because the Let's Encrypt docs clearly say …

FYI, the official announcement of this change was here: [image] ACME v1/v2: Validating challenges from multiple network vantage points API Announcements O…

IMO best practices would be to use your standard ACLs to block access to everything, then allow everyone access to only the .well-known/acme-challenge/ directory which should always be empty except for a few moments during renewal. Or use a different challenge like DNS-01

[image] ski192man: (…) then allow everyone access to only the .well-known/acme-challenge/ directory which should always be empty except for a few moments during renewal. And if that's too "open", you might be able to temporarily allow access to /.well-known/acme-challenge/ during a renewal by…

If you proxy all port 80 connections (or just send them to another server), then your risk is already minimized. Ideally only the /.well-known/acme-challenge/ requests would ever hit your actual web server (and even then, only via proxy).

Webroot challenges now coming from amazonaws.com

Issuance Policy

mnordhoff March 13, 2020, 6:14pm 3

FYI, the official announcement of this change was here:

Topic		Replies	Views
[ACL] Looking for Let'sEncrypt IP Help	4	2017	November 28, 2021
Lets Encrypt certificate automatic renewal Issuance Tech	4	885	March 6, 2025
I can not renew certificate Help	10	971	September 17, 2019
Renewal suddenly stopped two days ago Help	25	1172	April 18, 2024
Renewal fails (auto + manual) though acme-challenge dir is reachable Help	3	1113	February 25, 2017

Webroot challenges now coming from amazonaws.com

Related topics