<p>You just can <strong>not</strong> because from Let's Encrypt FAQ:</p>

<blockquote>
  <ul>
  <li><p><strong>What IP addresses does Let’s Encrypt use to validate my web server?</strong></p>
  
  <p>We don’t publish a list of IP addresses we use to validate, because
  they may change at any time. In the future we may validate from
  multiple IP addresses at once.</p></li>
  </ul>
</blockquote>

<p>You will need a reverse proxy (usually a WAF), routing /.well-know/acme to a machine and answering the challenges (from anywhere) and doing the IP filtering before forwarding to your application all other requests.</p>

CC BY-SA 3.0
2018-03-08T10:57:27.280Z
2018-03-08T10:57:27.280Z
Tensibai
<p>I want to add a rule to my <code>aws</code> security group to allow for incoming traffic from the acme server (I guess it is <code>acme-v01.api.letsencrypt.org</code>) to issue and automate the renewal of my cert;</p>

<p>What is the best way of doing this, given that sg rules do not support hostnames but only IPs?</p>

CC BY-SA 3.0
2018-03-08T11:05:56.453Z
Wildcard (0.0.0.0) is definitely an option provided that  security measures are taken care.
Barath
<amazon-web-services><certbot>
AWS Security group rule for certbot renewal
pkaramol
# AWS Security group rule for certbot renewal

(Asked by: username_0 on 2018-03-08)

I want to add a rule to my `aws` security group to allow for incoming traffic from the acme server (I guess it is `acme-v01.api.letsencrypt.org`) to issue and automate the renewal of my cert;

What is the best way of doing this, given that sg rules do not support hostnames but only IPs?

**Tags:** amazon-web-services, certbot

> **Comments:**
> **username_1**: Wildcard (0.0.0.0) is definitely an option provided that  security measures are taken care.  

---

## 1 answers

### Answer by username_2 on 2018-03-08. Score: 3

You just can **not** because from Let's Encrypt FAQ:

> * **What IP addresses does Let’s Encrypt use to validate my web server?**
>
>   We don’t publish a list of IP addresses we use to validate, because
>   they may change at any time. In the future we may validate from
>   multiple IP addresses at once.

You will need a reverse proxy (usually a WAF), routing /.well-know/acme to a machine and answering the challenges (from anywhere) and doing the IP filtering before forwarding to your application all other requests.


---

