2

When using Let’s Encrypt Certbot, the Let’s Encrypt server makes a HTTP request to the temporary file on the web server to validate that the requested domain resolves to the server where certbot runs.

However, my provider blocks port 80 in its firewall and will not open it, not even temporarily. Neither can I use DNS validation, because I cannot edit the DNS record.

(How) Can I use the Let’s Encrypt validation process over https (with Apache listening on Port 443 with a self-signed certificate) instead of over http?

Improve this question
1

1 Answer 1

Reset to default
3

Letsencrypt recommends to keep port 80 open:

Allowing port 80 doesn’t introduce a larger attack surface on your server, because requests on port 80 are generally served by the same software that runs on port 443.

But they got this scenario covered:

Unfortunately, you might not have control over whether port 80 is blocked for your site. Some (mostly residential) ISPs block port 80 for various reasons. If your ISP does this but you’d still like to get certificates from Let’s Encrypt, you have two options: You can use DNS-01 challenges or you can use one of the clients that supports TLS-ALPN-01 challenges (on port 443).

So the recommended way is to use tls-alpn-challenge

Improve this answer
1
  • 1
    Clarification: Certbot requires port 80 to remain open, otherwise the HTTP-01 challenge will fail verification... you can 301 redirect those requests to port 443 and thus HTTPS but port 80 must remain open if you're using Certbot. serverfault.com/a/1018199/144798
    – Jesse Nickles
    Dec 11, 2022 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .