Firewall Module – Improvements in LetsEncrypt certificate management

[sorvani (Jared Busch)]

This is great to see completed, but the blog post verbiage is poorly chosen. That, or the Sangoma tea has a poor understanding of Let’s Encrypt.

Calling this a new behavior from Let’s Encrypt is 100% not true. This change was announced 5 years ago. This was even pointed out in the thread on this community back in March.

Let's Encrypt Certificate renewals failing

Just to be clear, this is NOT a recent “change in policy” [image] jshaLet’s Encrypt engineer Dec '15 We plan to frequently change the set of IPs from which we validate, and will validate from multiple IPs in the future. Any host answering challenges should have port 80 or 443 available to the Internet. the 443 bit was removed in 2018 So either its 80 to the world for acme challenges or if you have control over your nameserver, the better solution of DNS-01 challenges which doesnt need an…

Then this bit..

Let’s Encrypt has offered DNS based authentication for years now. It is strictly the choice of Sangoma’s team to use an ACME compatible tool that does not offer that option.