What:<\/p>\n
You pulled a docker container that does ACME \/ Letsencrypt automagically for you but does not allow for DNS validation. You use CSF<\/a> and you do not want port 80 exposed to random sources.<\/p>\n Why:<\/p>\n Because CSF<\/a> rocks \ud83d\ude42 You might be hosting an application that only needs to be accessible by an ACL and you do not want to keep port 80 open for ACME \/ Letsencrypt. At the same time you are tired of having certificate renewals fail because port 80 is blocked when the job runs.<\/p>\n How:<\/p>\n Add these two lines:<\/p>\n Then reload with <\/p>\n This will prompt CSF to lookup the IP addresses of these two aliases every 5 minutes and open port 80 to Letsencrypt only.<\/p>\n Letsencrypt discourage the use of these aliases and reserve the right to change their outbound validator IP addresses suddenly, discontinue updating the aliases or deleting them altogether. They would very much prefer for you to use DNS validation. This is a suitable band-aid for many self-hosted projects.<\/p>\n","protected":false},"excerpt":{"rendered":" What: You pulled a docker container that does ACME \/ Letsencrypt automagically for you but does not allow for DNS validation. You use CSF and you do not want port 80 exposed to random sources. Why: Because CSF rocks \ud83d\ude42 You might be hosting an application that only needs to be accessible by an ACL … Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35,34,36],"tags":[],"class_list":["post-367","post","type-post","status-publish","format-standard","hentry","category-csf","category-firewall","category-letsencrypt-acme"],"_links":{"self":[{"href":"https:\/\/7dc.org\/index.php\/wp-json\/wp\/v2\/posts\/367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/7dc.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/7dc.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/7dc.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/7dc.org\/index.php\/wp-json\/wp\/v2\/comments?post=367"}],"version-history":[{"count":4,"href":"https:\/\/7dc.org\/index.php\/wp-json\/wp\/v2\/posts\/367\/revisions"}],"predecessor-version":[{"id":371,"href":"https:\/\/7dc.org\/index.php\/wp-json\/wp\/v2\/posts\/367\/revisions\/371"}],"wp:attachment":[{"href":"https:\/\/7dc.org\/index.php\/wp-json\/wp\/v2\/media?parent=367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/7dc.org\/index.php\/wp-json\/wp\/v2\/categories?post=367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/7dc.org\/index.php\/wp-json\/wp\/v2\/tags?post=367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}vi \/etc\/csf\/csf.dyndns<\/code><\/p>\ntcp|in|d=80|s=outbound1.letsencrypt.org
\ntcp|in|d=80|s=outbound2.letsencrypt.org<\/code><\/p>\ncsf -ra<\/code><\/p>\n