Whitelisting Let's encrypt domain

Help
1

I am trying to whitelist domains for Let's Encrypt. I'm aware that they do not recommend whitelisting IP addresses, which I understand. However, I cannot find the full scope of domain names. Is that available anywhere?

2

No, there isn't a list of domain names for that anyway because the validation servers don't have domain names as they are outbound traffic only (from their point of view).

See this FAQ topic: FAQ - Let's Encrypt

Also see this excellent writeup for further discussion: Multi-Perspective Validation & Geoblocking FAQ

Generally there are good ways to satisfy cert validation without having to bother with a changing list of IP addresses for the validation servers. That article discusses those but ask if you have questions about it.

3

Thank you. I think I may not have explained the direction of traffic clearly. I'm not looking for the domain names or IP addresses of the validation servers.

I'm trying to whitelist Let's Encrypt destination FQDNs for outbound traffic from my network.

For example, I know acme-v02.api.letsencrypt.org is the production ACME endpoint. I'm trying to determine whether there are any other Let's Encrypt FQDNs that our systems may need outbound access to for certificate issuance and renewal.

Is there a documented list of those destination FQDNs?

4

No, that is the only endpoint used for production ACME outbound requests.

Although, you should also whitelist the LE Staging endpoint too. both production and staging endpoints described here. Getting Started - Let's Encrypt

I am curious ... why do you think there may be other API hostnames? Did you see that somewhere?

5

I did see this in my firewall logs, which is why I was inquiring: prod.api.letsencrypt.org

6

Oh, I see. The URL used by the ACME Client are as shown in the docs page I linked.

In the public DNS those two ACME URL CNAME to other names. The production ACME URL CNAMEs to prod.api and staging to staging.api. Those further CNAME to a cloudflare endpoint as the LE API servers sit behind a CDN. That could change in the future as the only documented Let's Encrypt endpoints are the two in that page I provided.

You wouldn't see queries for those except from a local DNS resolver but you also would have seen the pacloudflare CNAME too. Is that what you saw? Do you whitelist domain names for your DNS resolver?

nslookup acme-v02.api.letsencrypt.org

acme-v02.api.letsencrypt.org    canonical name = prod.api.letsencrypt.org.
prod.api.letsencrypt.org        canonical name = ca80a1adb12a4fbdac5ffcbc944e9a61.pacloudflare.com.
Address: 172.65.32.248
Address: 2606:4700:60:0:f53d:5624:85c7:3a2c