We have an very strict firewall policy to block all AWS incoming traffic. We block all IP V4 ranges of AWS. Due new multivalidation process our certificates renew requests fails on Secondary validation. Lookin for info about it I read that this secondary validation initiates on Amazon. I Turned of…

[image] estebanhelpdesk: there is any other work around to this? You might be able to make a setup which can allow access to /.well-known/acme-challenge/ from AWS, but deny every other path.

Hi @estebanhelpdesk there [image] estebanhelpdesk: All certificates renew in seconds. ... there is any other work around to this? is your answer. If you want to use http validation, you have to allow port 80 worldwide. Read [image] Best Practice - Keep Port 80 Open - Let's Enc…

[image] estebanhelpdesk: We block all IP V4 ranges of AWS. The validation servers support IPv6...

[image] estebanhelpdesk: there is any other work around to this? you got at least two valid options, and here's a third: use your client's hooks (--pre-hook and --post-hook usually) to only open port 80 worldwide during the validation.

[image] JuergenAuer: If you want to use http validation, you have to allow port 80 worldwide. Or use tls-alpn-01 which uses port 443 and does not require port 80 to be open at all.

Or use dns-01 which doesn’t require incoming connections at all. :stuck_out_tongue:

dns-01 can be tricky, even if you have full control of your DNS [image] DNS-01 problem with dehydrated Help I…

thank you! I cant do that (allow just .well-kwown… path) , because my hardware firewall caped AWS IP addresses before they arrive to the Software (second firewall and webserver) To whom answered about port 80 and 443, AWS cant see any open any port on our server. Thank you ALL!

I am using Cert the web client, and for DNS validation ask for a code to add in my dns. I have full access to our dns, i can create a TXT record for it, BUT I cant find what really put in these record. I found some entrys talking about it in forums and docs, but none works fine for me. Also some g…

[image] estebanhelpdesk: I am using Cert the web client (…) Web clients aren't recommended, because those cannot be automated.

Work around about AWS in second validation fail

Help

ndilieto March 14, 2020, 7:34pm 8

dns-01 can be tricky, even if you have full control of your DNS

Topic		Replies	Views
HTTP-01 secondary validation coming from AWS Help	5	149	September 3, 2025
HTTP-01 and AWS challenge Feature Requests	18	342	May 30, 2026
Whitelist LetsEncrypt Server IPs Help	18	26279	May 15, 2024
Validation from ip with security issues Help	2	2114	March 12, 2020
Second validation was failing due to my firewall Help	19	430	April 17, 2024

Work around about AWS in second validation fail

Related topics