Acme.sh with inwx dns validation

[Vienna]

Dynamic firewall blocks Let's Encrypt renewals

And why not just use DNS validation? opkg update opkg install acme acme-dnsapi luci-app-acme /etc/config/acme config acme option state_dir '/etc/acme' option account_email 'name.surname@example.com' option debug '0' config cert 'main' option keylength 'ec-256' list domains 'router.example.com' # subjectName list domains 'srv1.example.com' # subjectAltName list domains 'srv2.example.com' # subjectAltName option enabled '…

since he is using it as certificate authority…

Let's Encrypt servers are blocked since Turris OS 7.1

A certbot instance inside a LXC container cannot renew certificates (with the webroot method) since the update to TOS 7.1. Let’s Encrypt try to contact my http server (running in the same container) for the webroot challenge, from the server outbound2p.letsencrypt.org (23.178.112.215) or outbound2l.letsencrypt.org (23.178.112.211), but the router firewall contains this in the set dynfw_4 (“IPv4 addresses blocked by Turris Sentinel”): 23.178.112.101, 23.178.112.103, 23.178.112.211, 23.178.112…

since I do understand the acme instance needs counterproof, but maybe I am wrong.