26
How do you all handle port 80 and HTTP-01/DNS-01 challenges for Let's Encrypt cert renewals? (lemmy.ml)
submitted 2 days ago* (last edited 1 day ago) by tinfoilsocks@lemmy.ml to c/selfhosted@lemmy.world
11 comments fedilink hide all child comments

I'm currently running a bunch of services behind a reverse proxy and that proxy is configured to use let's encrypt for ssl certs using DNS-01 challenges for renewals. All of the services are configured to only work using Tailscale IPs, so, as far as I'm aware, none of the services are open to the internet, except for port 80.

I noticed if I don't leave port 80 open, when it's time for renewal, everything fails. This leads to a bunch of logs on my Unifi setup saying intrusion attempts have been blocked on port 80. I thought I could go to Let's Encrypt's website and find a list of IPs I could put on an allow list but they don't post those. So my questions are:

~~1. If I understand the process correctly, Let's Encrypt checks the DNS TXT record to verify I own a domain, then sends a new cert to my server over port 80; meaning, I have to have port 80 open during the renewal process, correct?~~ Nope

~~2. If that's correct, what do you all do about port 80? Do you just have a script to open the port during the renewal process and close it afterwards or do you just leave it open all the time? Is there maybe a tool that already has this functionality?~~ not if using DNS-01 challenges

~~3. I think I have port 443 open as well but I don't remember if that's needed or if I just did that when I opened port 80 trying to get all my services working again. Does 443 need to be open too?~~ not if using DNS-01 challenges

~~4. If there is a better way to do all this or if I fucked up somewhere, please share. This was just the first setup I got working.~~ I fucked up, see below

Thanks

EDIT: After deleting the current certificate and going through the process of generating a new one, everything is working without port 80 open. I'm using NGINX Proxy Manager and I must have clicked on "Lets Encrypt via HTTP" and not "Lets Encrypt via DNS" when originally setting this up. Not sure how else this could have happened 😅

top 11 comments
sorted by: hot top new old
[-] BennyInc@feddit.org 25 points 2 days ago

If you use DNS-01, you don’t need port 80 open.

[-] tinfoilsocks@lemmy.ml 3 points 2 days ago

Oh. So, that's only needed for HTTP-01 challenges? Doesn't my server need to receive a file or something from Let's Encrypt, how does that work?

[-] theit8514@lemmy.world 9 points 2 days ago

The ACME client generates the private key to keep and a signing request to send to the CA. Once the CA validates your challenge type, the client requests the signed cert over that same channel. It doesn't interact with 80 or 443 except to complete challenges.

[-] mhzawadi@lemmy.horwood.cloud 4 points 2 days ago

When you use DNS for the authentication, a token is stored in DNS and lets encrypt will go and look that up and issue a certificate if everything lines up.

[-] spankysalmon@fedinsfw.app -5 points 2 days ago

The question is how does that, "issue a certificate" step work and does it require port 80, not what is the 10000 foot view.

[-] cecilkorik@lemmy.ca 3 points 2 days ago

It works the same way it normally works. You generate the certificate, give it to them, tell them who you are, they verify who you are, then they sign it and give it back to you. Very routine and straightforward, except for the challenge part that they use to verify your identity.

Think of it in terms of delivering a pizza. The signed certificate is the pizza in this analogy, and they don't want to send it to you until they're sure it's going to the right place. Either the store can send it to you (you have to give them your address and have port 80 open for when they arrive) or you can go pick it up at the store (you give them your address, they verify it through DNS, no port 80 required).

There's never been anything preventing you from establishing a conversation with the certificate-issuer. You don't need port 80 open for that. However, unless you have port 80 open the issuer cannot reach out to you, and that's how they verify you are who you say you are. DNS challenges avoid them having to reach out to you directly, instead they reach out to DNS on your behalf and verify you are who you say you are that way instead.

[-] spankysalmon@fedinsfw.app -5 points 1 day ago* (last edited 1 day ago)

Again, nobody is asking for the high level view or an analogy. They're asking for a specific fix.

[-] cecilkorik@lemmy.ca 2 points 1 day ago

No they weren't, how did you get that idea? Nowhere did they ask for a specific fix, nor did they provide the details necessary for a specific fix. The OP asked how it works, and according to my reading of both their post and their comment, they seemed quite curious about what was going on (which is a good mindset to have when attempting to solve a problem) so my intention was to answer some of that curiosity by explaining "how". You're the one who decided someone should just provide a fix (which, in this case, would've been basically impossible)

Especially when a problem arises because of misunderstanding or ignorance (which is not a shameful thing, it's simply the default state of understanding), an improved and better understanding of the situation often helps lead one quite quickly to the solution to the problem, and in this case, it seems like OP did solve their own problem once they had a better understanding, so... seems like a successful effort to me? Any particular reason we need to argue about this?

[-] frongt@lemmy.zip 1 points 1 day ago* (last edited 1 day ago)

We don't have OP's config so we can't identify their exact misconfiguration.

[-] theit8514@lemmy.world 10 points 2 days ago

If you update DNS, that would use DNS-01 challenge and you don't need port 80 open. I am using this challenge type to generate certs for completely internal services. The only reason to have 80 open would be to use HTTP-01 challenge, which requires your server to host a file on a specific url only via port 80. If your service is already public on 443, you could leave port 80 open with a simple http-to-https redirect.

Port 443 would need to be open if you want to use TLS-ALPN-01 challenge, but I would avoid this as it is not easy to use or configure.

My advice for internal services is to setup only DNS-01 challenge and configure your dns to be automatically updated using a dns plug-in. This should almost never fail validation.

[-] tinfoilsocks@lemmy.ml 3 points 2 days ago

Thank you for the explanation

this post was submitted on 21 Oct 2026
26 points (96.4% liked)

Selfhosted

63158 readers
496 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world