I’m currently running a bunch of services behind a reverse proxy and that proxy is configured to use let’s encrypt for ssl certs using DNS-01 challenges for renewals. All of the services are configured to only work using Tailscale IPs, so, as far as I’m aware, none of the services are open to the internet, except for port 80.

I noticed if I don’t leave port 80 open, when it’s time for renewal, everything fails. This leads to a bunch of logs on my Unifi setup saying intrusion attempts have been blocked on port 80. I thought I could go to Let’s Encrypt’s website and find a list of IPs I could put on an allow list but they don’t post those. So my questions are:

1. If I understand the process correctly, Let’s Encrypt checks the DNS TXT record to verify I own a domain, then sends a new cert to my server over port 80; meaning, I have to have port 80 open during the renewal process, correct? Nope

2. If that’s correct, what do you all do about port 80? Do you just have a script to open the port during the renewal process and close it afterwards or do you just leave it open all the time? Is there maybe a tool that already has this functionality? not if using DNS-01 challenges

3. I think I have port 443 open as well but I don’t remember if that’s needed or if I just did that when I opened port 80 trying to get all my services working again. Does 443 need to be open too? not if using DNS-01 challenges

4. If there is a better way to do all this or if I fucked up somewhere, please share. This was just the first setup I got working. I fucked up, see below

Thanks

EDIT: After deleting the current certificate and going through the process of generating a new one, everything is working without port 80 open. I’m using NGINX Proxy Manager and I must have clicked on “Lets Encrypt via HTTP” and not “Lets Encrypt via DNS” when originally setting this up. Not sure how else this could have happened 😅

  • theit8514@lemmy.worldEnglish
    4·
    4 hours ago

    If you update DNS, that would use DNS-01 challenge and you don’t need port 80 open. I am using this challenge type to generate certs for completely internal services. The only reason to have 80 open would be to use HTTP-01 challenge, which requires your server to host a file on a specific url only via port 80. If your service is already public on 443, you could leave port 80 open with a simple http-to-https redirect.

    Port 443 would need to be open if you want to use TLS-ALPN-01 challenge, but I would avoid this as it is not easy to use or configure.

    My advice for internal services is to setup only DNS-01 challenge and configure your dns to be automatically updated using a dns plug-in. This should almost never fail validation.