IP Location + Let's encrypt renewal

[cracksilver78 (jack wolfskin)]

Hi
I run NGINX Proxy Manager on my Proxmox Server to route to the different services on the server.

Yeasterday we tried to renew manually different certificate from Let’s encrypt. It failed at all untill we deactivated Location Filter.

So after my research about this problem I see I’m not allone. This is a proble to any of us IPFire users.

So do we really only have this 2 options?

with opening whole usa in Location filter:

Exception for acme.sh in location based filter

I guess my restrictive settings in mask Location based Filter prevented the acme.sh script to automatically renew my domain certificates. As a workaround i manually forced renewal after disabling the Location based Filter. I do not know the origin of the validation servers (i guess US with a .org domain) but anyway i would prefer to insert an exception rule only for these servers instead of disabling the whole US within the location based filter. How do i extract the needed servers to create …

or very complicate with cronjob and special firewall rules:

Let's Encrypt - Location filter and firewall rule (command)

Hello all, I have a question regarding the “Location Filter” and firewall rule. I have a VM running on my router that hosts NextCloud. For NextCloud I have manually renewed the certificate from Let’s Encrypt every 3 months. Now I want to automate this and use the “acme.sh” which does this by itself. But now I have activated the Location FIlter on my router and only Germany is allowed, and I have deactivated the incoming port 80. When I had always manually extended the certificate, I activate…

thx.

[bonnietwin (Adolf Belka)]

@cracksilver78

with opening whole usa in Location filter:

That is likely to not be good enough because LetsEncrypt are using locations around the world and they have said that they will move to using multiple locations from multiple areas for an update and they will not provide any list of the servers they use.

So the two options are all I can think of and option 1 will likely need to be more open than just USA as they now use servers from all over the world and the ones they use are not restricted to the location you are in.

EDIT:
Actually there is a third option which is what LetsEncrypt recommend when you have corporate requirements to only open up ports to defined IP’s and that is to use the DNS-01 Challenge instead of the HTTP-01 Challenge.
https://letsencrypt.org/docs/challenge-types/

or LetsEncrypt have also suggested to have a separate server specifically for certificate validation and place it in the DMZ and then extract the updated certs from the DMZ machine if they change.

[nickh (Nick Howitt)]

Or, perhaps, hack the renewal script to insert an extra firewall rule to open port 80 to everywhere when it starts and delete it at the end?

[cracksilver78 (jack wolfskin)]

yes I have to check that. I don’t know really how and when NGINX Proxy Manager does the renewal script.

[cracksilver78 (jack wolfskin)]

Ok thx adolf

It sounds interesting with DNS-01 Challenge. But then we have another security risk in Keeping API credentials on webserver.

So I prefer to go with option 2: Firewall rules and cronjob

I think first I have to know when NGINX Proxy Manager starts the renewal for the Let’s encrypt. Later I can construct some rules here.

[bbitsch (Bernhard Bitsch)]

BTW Location Block is a IPFire side project. Discussion is also on the Location maling list.
See also Blog article