Answers: <p>You just can <strong>not</strong> because from Let's Encrypt FAQ:</p>
  
  <blockquote>
    <ul>
    <li><p><strong>What IP addresses does Let’s Encrypt use to validate my web server?</strong></p>
    
    <p>We don’t publish a list of IP addresses we use to validate, because
    they may change at any time. In the future we may validate from
    multiple IP addresses at once.</p></li>
    </ul>
  </blockquote>
  
  <p>You will need a reverse proxy (usually a WAF), routing /.well-know/acme to a machine and answering the challenges (from anywhere) and doing the IP filtering before forwarding to your application all other requests.</p>
  
Answers: CC BY-SA 3.0
Answers: 2018-03-08T10:57:27.280Z
Answers: 2018-03-08T10:57:27.280Z
Answers: Tensibai
Body: <p>I want to add a rule to my <code>aws</code> security group to allow for incoming traffic from the acme server (I guess it is <code>acme-v01.api.letsencrypt.org</code>) to issue and automate the renewal of my cert;</p>
  
  <p>What is the best way of doing this, given that sg rules do not support hostnames but only IPs?</p>
  
Comments: CC BY-SA 3.0
Comments: 2018-03-08T11:05:56.453Z
Comments: Wildcard (0.0.0.0) is definitely an option provided that  security measures are taken care.
Comments: Barath
Tags: <amazon-web-services><certbot>
Title: AWS Security group rule for certbot renewal
UserDisplayName: pkaramol
ThreadText: # AWS Security group rule for certbot renewal
  
  (Asked by: username_0 on 2018-03-08)
  
  I want to add a rule to my `aws` security group to allow for incoming traffic from the acme server (I guess it is `acme-v01.api.letsencrypt.org`) to issue and automate the renewal of my cert;
  
  What is the best way of doing this, given that sg rules do not support hostnames but only IPs?
  
  **Tags:** amazon-web-services, certbot
  
  > **Comments:**
  > **username_1**: Wildcard (0.0.0.0) is definitely an option provided that  security measures are taken care.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2018-03-08. Score: 3
  
  You just can **not** because from Let's Encrypt FAQ:
  
  > * **What IP addresses does Let’s Encrypt use to validate my web server?**
  >
  >   We don’t publish a list of IP addresses we use to validate, because
  >   they may change at any time. In the future we may validate from
  >   multiple IP addresses at once.
  
  You will need a reverse proxy (usually a WAF), routing /.well-know/acme to a machine and answering the challenges (from anywhere) and doing the IP filtering before forwarding to your application all other requests.
  
  
  ---
  
  