Hi all I have a client I am busy helping with a setup. For security reasons he does not want open access to port 80 and 443 for the sites I am busy configuring as they are client portals to which he only wants to allow certain IP’s or ranges to access. As a result webroot authentication has been f…

[image] MitchellK: Is there a set of IP’s or an IP block I can provide the client to allow permanent access from LE’s authentication servers? There isn't and such a list won't be made in the future too. Let's Encrypt keeps the right to change the IP addresses used for authentication at will a…

Thanks @Osiris but that does not make sense to me why LE would want to hide their IP’s? Surely they are publicly accessible IP’s anyway in order for authentication to even work? Surely anyone currently generating and renewing certs on their servers can easily trace those incoming IP’s even if they …

This has been discussed several times before on the forum. It’s not so much for security of the Let’s Encrypt services as much as it is Let’s Encrypt not supporting this methodology. If they provided the IPs and they subsequently changed, then it would cause a large number of users who had a working…

If access is going to be restricted to specific addresses, that signals it might be a closed system. The owner may actually be better off using a self-signed certificate or making an internal CA that the approved clients can trust. Let’s Encrypt is great for allowing users to trust an otherwise anon…

hey @MitchellK Any chance you can use DNS validation instead? Serveral of the clients support major DNS providers which is a more workable solution Also you should be whitelisting traffic not ports - if someone tries to SSH on port 80 you are actually not more secure etc. Depending on the firewall…

Or, you could disable the firewall, use the web server’s IP restriction stuff, and whitelist /.well-known/acme-challenge/.

Thanks everyone for the suggestions. For now the client is only going to generate about 8-10 cert’s so for now he is happy to manually open the firewall for issuance and renewals and close it again afterwards and only allow his clients’ IP’s access through the firewall.

Remember that this will need to be repeated every time the certificates are renewed.

@schoen yes absolutely and I’ve made this very clear to the client. I setup a cronjob for him for the renewals and he has made reminders of his own in his calendar to remind him when to do the renewals. Not an optimal situation but the client is well aware of the implications.

Whitelisting LE IP addresses / ranges in Firewall

Server

MitchellK October 28, 2017, 6:04pm 5

Thanks @jared.m and @Osiris I see this has been extensively discussed before IP addresses LE is validating from to build firewall rule

Topic		Replies	Views
IP addresses LE is validating from to build firewall rule Help	22	55125	October 3, 2016
Authentication server IP list Help	2	1046	August 16, 2023
IP's or network's used by letsencrypt for renew Help	5	657	September 4, 2024
Let's Encrypt IP Addresses Used for Validation Help	8	30697	July 12, 2020
The way to connect Lets Encrypt when some of it's IPs are blocked by a FireWall Help	2	1800	June 28, 2021

Whitelisting LE IP addresses / ranges in Firewall

Related topics