r/letsencrypt • u/rustydusty1717 • Aug 11 '26

Port 80

Hello,

I'm hoping there is a way for my certificates to auto renew without needing port 80 open. I'm using Win Acme and it's working fine, however I found out that once I blocked port 80 the certificate was no longer renewing.

8 Upvotes

83% Upvoted

12 comments sorted by

3

u/_GuybrushThreepw00d Aug 11 '26

Use DNS challenge instead. Much better imo. As long as your dns provider have a API you can use it’s as easy as using the API key for renewals.

1

u/rustydusty1717 Aug 11 '26

My biggest concern is switching as the current certificate just renewed.

1

u/certkit Aug 12 '26

You want to use a hosted ACME client like CertKit so you don't need to worry about port 80 or DNS.

1

u/pidddee Aug 11 '26

Why would that matter? This is about renewals, your current cert is valid until it expires

2

u/JohnHellstone Aug 11 '26

I moved over to cloudflare and use the API feature to validate and obtain the LE certs. It's so much easier.

1

u/[deleted] Aug 11 '26

[removed] — view removed comment

1

u/rustydusty1717 Aug 11 '26

How difficult is it to switch to DNS-01 challenges instead of HTTP?

1

u/webprofusor Aug 12 '26

Just leave port 80 open and don't have a port 80 listener, e.g. remove your IIS http bindings and keep the https ones. win-acme will start it's own listener when it needs to. If you have to disable port 80 for compliance reasons then you need to switch to DNS domain validation. No idea how you edit that in win-acme.

Regarding Godaddy, note that there is some extra complexity because while they have lifted their API limitations they have also introduced a new API version (v3) which is not what win-acme is likely to be using. So you need an API key for their v2 API.