I’m currently running a bunch of services behind a reverse proxy and that proxy is configured to use let’s encrypt for ssl certs using DNS-01 challenges for renewals. All of the services are configured to only work using Tailscale IPs, so, as far as I’m aware, none of the services are open to the internet, except for port 80.
I noticed if I don’t leave port 80 open, when it’s time for renewal, everything fails. This leads to a bunch of logs on my Unifi setup saying intrusion attempts have been blocked on port 80. I thought I could go to Let’s Encrypt’s website and find a list of IPs I could put on an allow list but they don’t post those. So my questions are:
1. If I understand the process correctly, Let’s Encrypt checks the DNS TXT record to verify I own a domain, then sends a new cert to my server over port 80; meaning, I have to have port 80 open during the renewal process, correct? Nope
2. If that’s correct, what do you all do about port 80? Do you just have a script to open the port during the renewal process and close it afterwards or do you just leave it open all the time? Is there maybe a tool that already has this functionality? not if using DNS-01 challenges
3. I think I have port 443 open as well but I don’t remember if that’s needed or if I just did that when I opened port 80 trying to get all my services working again. Does 443 need to be open too? not if using DNS-01 challenges
4. If there is a better way to do all this or if I fucked up somewhere, please share. This was just the first setup I got working. I fucked up, see below
Thanks
EDIT: After deleting the current certificate and going through the process of generating a new one, everything is working without port 80 open. I’m using NGINX Proxy Manager and I must have clicked on “Lets Encrypt via HTTP” and not “Lets Encrypt via DNS” when originally setting this up. Not sure how else this could have happened 😅
Again, nobody is asking for the high level view or an analogy. They’re asking for a specific fix.
No they weren’t, how did you get that idea? Nowhere did they ask for a specific fix, nor did they provide the details necessary for a specific fix. The OP asked how it works, and according to my reading of both their post and their comment, they seemed quite curious about what was going on (which is a good mindset to have when attempting to solve a problem) so my intention was to answer some of that curiosity by explaining “how”. You’re the one who decided someone should just provide a fix (which, in this case, would’ve been basically impossible)
Especially when a problem arises because of misunderstanding or ignorance (which is not a shameful thing, it’s simply the default state of understanding), an improved and better understanding of the situation often helps lead one quite quickly to the solution to the problem, and in this case, it seems like OP did solve their own problem once they had a better understanding, so… seems like a successful effort to me? Any particular reason we need to argue about this?
We don’t have OP’s config so we can’t identify their exact misconfiguration.