LetsEncrypt - Whitelist

[astromeier]

The actual version you will find here:
https://raw.githubusercontent.com/astromeier/LetsEncrypt_Serverlist/main/LetsEncrypt_Server_list.txt
You can add an alias "URL table (IPs)" with this link.

The FQDN-List you'll find here:
https://raw.githubusercontent.com/astromeier/LetsEncrypt_Serverlist/main/LetsEncrypt_FQDN_list.txt


After having Problems with renewals of certificates I introduced this IP-Whitelist for LetsEncrypt Servers:
172.65.32.248 (Cloudflare)
18.194.58.132 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
18.224.20.83 (Amazon Cloud)
3.14.255.131 (Amazon Cloud)
34.209.232.166 (Amazon Cloud)
34.211.60.134 (Amazon Cloud)
52.15.254.228 (Amazon Cloud)
52.28.236.88 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
52.58.118.98 (Amazon Cloud)
64.78.149.164 (outbound2.letsencrypt.org )
66.133.109.36 (outbound1.letsencrypt.org )

The IPs from cloud services can change over time...

If you have IPs to add feel free....

[astromeier]

add:
18.196.96.172 (amazon Cloud & A100 ROW GmbH)

updated List:
172.65.32.248 (Cloudflare)
18.194.58.132 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
18.196.96.172 (Amazon Cloud & A100 ROW GmbH)
18.224.20.83 (Amazon Cloud)
3.14.255.131 (Amazon Cloud)
34.209.232.166 (Amazon Cloud)
34.211.60.134 (Amazon Cloud)
52.15.254.228 (Amazon Cloud)
52.28.236.88 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
52.58.118.98 (Amazon Cloud)
64.78.149.164 (outbound2.letsencrypt.org )
66.133.109.36 (outbound1.letsencrypt.org )

[astromeier]

52.28.236.88 (Amazon Cloud & A100 ROW GmbH) is proven NOT FALSE

I've seen some abuse entries in list like AbuseIPDB - but I'm sure that the whitelist is ok.
The logged acme challenges come from different servers and when the same challenge come from a letsencrypt server , too the whitelisting is ok.
So far only one entry could be false...

updated list:
172.65.32.248 (Cloudflare)
18.194.58.132 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
18.196.96.172 (Amazon Cloud & A100 ROW GmbH)
18.224.20.83 (Amazon Cloud)
3.14.255.131 (Amazon Cloud)
34.209.232.166 (Amazon Cloud)
34.211.60.134 (Amazon Cloud)
52.15.254.228 (Amazon Cloud)
52.28.236.88 (Amazon Cloud & A100 ROW GmbH)
52.58.118.98 (Amazon Cloud)
64.78.149.164 (outbound2.letsencrypt.org )
66.133.109.36 (outbound1.letsencrypt.org )

[Julien]

have to use those ips if blocking GEOIP ?

[astromeier]

Use this ip list as an alias for a rule to allow these (pass) in an upper position
I've two aliases Letsencrypt_FDQN and Letsencrypt_Server for upmost pass-rules:
See attached screenshot..
Set a hook at the item "quick" in the rules you create.
This ensures that they will not be blocked by following rules.

I've blocked non-EU traffic and in this blocklist some of the LetsEncrypt servers are listed.
This was the cause that my acme scripts failed to renew ....

[Julien]

Thank you Thomas,
you have the rule on the top of the firewall WAN,
can show the rule? are allowing it to the WAN addres or to this firewall  ?
why are you using two rules one with FQDN and IP ?

[astromeier]

Hi Julien,
the LE-FDQN and LE-Servers are separated due to history:
First I introduced the FDQN and later saw, that more servers are involved...
This is the reason of my white list.
The images show the FDQN rule - the Servers rule is the same with the Server-Alias...

[Julien]

Thank you So Much Thomas,
i am using it too now, i'll monitor it, hopefully we will keep their IP updated.
much appreciate it and stay safe

[Julien]

i have been doing packet spoofing and found those FQDN who are used for validations and renew

acme-v01.api.letsencrypt.org
acme-staging.api.letsencrypt.org
acme-v02.api.letsencrypt.org
acme-staging-v02.api.letsencrypt.org

IP will be changed each 3 month according to their policies.

[astromeier]

Great - Thanks for sharing!
You can add to your list:

outbound1.letsencrypt.org
outbound2.letsencrypt.org

... these 6 entries are the content of my letsencrypt-FDQN - alias

[Julien]

You are welcome,
if i've found a new FQDN i'll add them
for now the latest updated list is.

Code Select Expand

outbound1.letsencrypt.org
outbound2.letsencrypt.org
acme-v01.api.letsencrypt.org
acme-staging.api.letsencrypt.org
acme-v02.api.letsencrypt.org
acme-staging-v02.api.letsencrypt.org

[astromeier]

Hi All - next update:

3.128.26.105
34.222.229.130
34.211.6.84

Yes, I know that Let's Encrypt does not recommend a whitelisting since their server IPs changes over time.
But some will need that because these LE servers often are blocked by GeoIP when used as a plein Europe
filter as in my case.

So I will try to update the below list when I notice firewall problems while updating my certificates...

The actual (2020-09-29) LE Server list is:

172.65.32.248 (Cloudflare)
18.194.58.132 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
18.196.96.172 (Amazon Cloud & A100 ROW GmbH)
18.224.20.83 (Amazon Cloud)
3.14.255.131 (Amazon Cloud)
3.128.26.105 (Amazon Cloud)
34.209.232.166 (Amazon Cloud)
34.211.6.84 (Amazon Cloud)
34.211.60.134 (Amazon Cloud)
34.222.229.130 (Amazon Cloud)
52.15.254.228 (Amazon Cloud)
52.28.236.88 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
52.58.118.98 (Amazon Cloud)
64.78.149.164 (outbound2.letsencrypt.org )
66.133.109.36 (outbound1.letsencrypt.org )

[astromeier]

Update:
3.120.130.29 ((Amazon Cloud & A100 ROW GmbH)

The actual (2021-05-21) LE Server list is:

172.65.32.248 (Cloudflare)
18.194.58.132 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
18.196.96.172 (Amazon Cloud & A100 ROW GmbH)
18.224.20.83 (Amazon Cloud)
3.14.255.131 (Amazon Cloud)
3.120.130.29 ((Amazon Cloud & A100 ROW GmbH)
3.128.26.105 (Amazon Cloud)
34.209.232.166 (Amazon Cloud)
34.211.6.84 (Amazon Cloud)
34.211.60.134 (Amazon Cloud)
34.222.229.130 (Amazon Cloud)
52.15.254.228 (Amazon Cloud)
52.28.236.88 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
52.58.118.98 (Amazon Cloud)
64.78.149.164 (outbound2.letsencrypt.org )
66.133.109.36 (outbound1.letsencrypt.org )

[astromeier]

new update:
3.122.178.200
18.184.114.154

The actual (2021-05-31) LE Server list is:

172.65.32.248 (Cloudflare)
18.184.114.154 (Amazon Cloud & A100 ROW GmbH)
18.194.58.132 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
18.196.96.172 (Amazon Cloud & A100 ROW GmbH)
18.224.20.83 (Amazon Cloud)
3.14.255.131 (Amazon Cloud)
3.120.130.29 (Amazon Cloud & A100 ROW GmbH)
3.122.178.200 (Amazon Cloud & A100 ROW GmbH)
3.128.26.105 (Amazon Cloud)
34.209.232.166 (Amazon Cloud)
34.211.6.84 (Amazon Cloud)
34.211.60.134 (Amazon Cloud)
34.222.229.130 (Amazon Cloud)
52.15.254.228 (Amazon Cloud)
52.28.236.88 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
52.58.118.98 (Amazon Cloud)
64.78.149.164 (outbound2.letsencrypt.org )
66.133.109.36 (outbound1.letsencrypt.org )

[astromeier]

Hi all!
A big number of new IPs - maybe some older are inactive now.
Below you'll find the complete list...
Some are listed in abuseipdb.com, but I'm pretty sure they are correct.

New IPs:
18.116.86.117 (Amazon Cloud)
18.184.29.122 (Amazon Cloud & A100 ROW GmbH)
18.196.102.134 (Amazon Cloud & A100 ROW GmbH)
18.197.97.115  (Amazon Cloud & A100 ROW GmbH)
3.19.56.43 (Amazon Cloud)
3.142.122.14 (Amazon Cloud)
3.67.34.92 (Amazon Cloud & A100 ROW GmbH)
52.39.4.59 (Amazon Cloud)
54.189.22.122 (Amazon Cloud)

Complete list:
172.65.32.248 (Cloudflare)
18.116.86.117 (Amazon Cloud)
18.184.114.154 (Amazon Cloud & A100 ROW GmbH)
18.184.29.122 (Amazon Cloud & A100 ROW GmbH)
18.194.58.132 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
18.196.96.172 (Amazon Cloud & A100 ROW GmbH)
18.196.102.134 (Amazon Cloud & A100 ROW GmbH)
18.197.97.115  (Amazon Cloud & A100 ROW GmbH)
18.222.145.89 (Amazon Cloud)
18.224.20.83 (Amazon Cloud)
18.236.228.243 (Amazon Cloud)
3.14.255.131 (Amazon Cloud)
3.19.56.43 (Amazon Cloud)
3.120.130.29 (Amazon Cloud & A100 ROW GmbH)
3.122.178.200 (Amazon Cloud & A100 ROW GmbH)
3.128.26.105 (Amazon Cloud)
3.142.122.14 (Amazon Cloud)
3.143.223.150 (Amazon Cloud)
3.67.34.92 (Amazon Cloud & A100 ROW GmbH)
34.209.232.166 (Amazon Cloud)
34.211.6.84 (Amazon Cloud)
34.211.60.134 (Amazon Cloud)
34.222.229.130 (Amazon Cloud)
52.15.254.228 (Amazon Cloud)
52.28.236.88 (Amazon Cloud & A100 ROW GmbH , maybe FALSE)
52.58.118.98 (Amazon Cloud)
52.39.4.59 (Amazon Cloud)
54.189.22.122 (Amazon Cloud)

See the additional FQDN-List