How do you all handle port 80 and HTTP-01/DNS-01 challenges for Let's Encrypt cert renewals?

Submitted ⁨⁨3⁩ ⁨hours⁩ ago⁩ by ⁨tinfoilsocks@lemmy.ml⁩ to ⁨selfhosted@lemmy.world⁩

I’m currently running a bunch of services behind a reverse proxy and that proxy is configured to use let’s encrypt for ssl certs using DNS-01 challenges for renewals. All of the services are configured to only work using Tailscale IPs, so, as far as I’m aware, none of the services are open to the internet, except for port 80.

I noticed if I don’t leave port 80 open, when it’s time for renewal, everything fails. This leads to a bunch of logs on my Unifi setup saying intrusion attempts have been blocked on port 80. I thought I could go to Let’s Encrypt’s website and find a list of IPs I could put on an allow list but they don’t post those. So my questions are:

If I understand the process correctly, Let’s Encrypt checks the DNS TXT record to verify I own a domain, then sends a new cert to my server over port 80; meaning, I have to have port 80 open during the renewal process, correct?
If that’s correct, what do you all do about port 80? Do you just have a script to open the port during the renewal process and close it afterwards or do you just leave it open all the time? Is there maybe a tool that already has this functionality?
I think I have port 443 open as well but I don’t remember if that’s needed or if I did that when I opened port 80. Does 443 need to be open too?

Thanks

source

Comments

Sort:hotnew top

BennyInc@feddit.org ⁨3⁩ ⁨hours⁩ ago
If you use DNS-01, you don’t need port 80 open.

source
- tinfoilsocks@lemmy.ml ⁨3⁩ ⁨hours⁩ ago
  Oh. So, that’s only needed for HTTP-01 challenges? Doesn’t my server need to receive a file or something from Let’s Encrypt, how does that work?
  
  source
  - theit8514@lemmy.world ⁨3⁩ ⁨hours⁩ ago
    The ACME client generates the private key to keep and a signing request to send to the CA. Once the CA validates your challenge type, the client requests the signed cert over that same channel. It doesn’t interact with 80 or 443 except to complete challenges.
    
    source
theit8514@lemmy.world ⁨3⁩ ⁨hours⁩ ago
If you update DNS, that would use DNS-01 challenge and you don’t need port 80 open. I am using this challenge type to generate certs for completely internal services. The only reason to have 80 open would be to use HTTP-01 challenge, which requires your server to host a file on a specific url only via port 80. If your service is already public on 443, you could leave port 80 open with a simple http-to-https redirect.

Port 443 would need to be open if you want to use TLS-ALPN-01 challenge, but I would avoid this as it is not easy to use or configure.

My advice for internal services is to setup only DNS-01 challenge and configure your dns to be automatically updated using a dns plug-in. This should almost never fail validation.

source
- tinfoilsocks@lemmy.ml ⁨3⁩ ⁨hours⁩ ago
  Thank you for the explanation
  
  source