<![CDATA[ACME 60 day renewal schedule and scheduled Firewall Rule for HTTP & HTTPS allow]]>Hi Team
A month ago I successfully setup the Lets Encrypt ACME certificates for my pfSense edge appliance and some internal servers within. In creating the ACME certs, I added the 60 day auto-renewal.

My pfSense appliance doesn't normally allow HTTP and HTTPS connections from the world so i (unsuccessfully) created a Firewall alias to allow HTTP and HTTPS connections from ACME's FQDN's Screenshot from 2023-08-31 11-29-29.png I don't think this is thorough enough for Lets Encrypt as manually renewing the certs created LOTS of inbound connections from LOTS of sources in the firewall logs.

Option 2: Create a Firewall schedule that allows HTTP and HTTPS inbound connections from the world for the same 60 day / time period. The Firewall schedule has a 15 minute min time period. (the below s/shots are 3 separate pfSense tabs)
pfsense acme and firewall schedule screenshots.png

Has anyone had any success doing this -or- are there better ways to accomplish what I'm trying to do? Would I be better off to combine the 2 separate cron job commands into 1 cron job?

]]>https://forum.netgate.com/topic/182537/acme-60-day-renewal-schedule-and-scheduled-firewall-rule-for-http-https-allowRSS for NodeWed, 12 Aug 2026 02:01:21 GMTThu, 31 Aug 2023 03:49:01 GMT60<![CDATA[Reply to ACME 60 day renewal schedule and scheduled Firewall Rule for HTTP & HTTPS allow on Fri, 01 Sep 2023 15:15:28 GMT]]>Another benefit of using the ACME DNS method is wildcard names. I'd previously been using the http method with my namecheap hosted domain. I could not use their DNS API with my account. I then realised I could switch nameservers, on my namecheap account, to cloudflare and can now use the DNS method with pfSense ACME package.

]]>https://forum.netgate.com/post/1123598https://forum.netgate.com/post/1123598Fri, 01 Sep 2023 15:15:28 GMT<![CDATA[Reply to ACME 60 day renewal schedule and scheduled Firewall Rule for HTTP & HTTPS allow on Thu, 31 Aug 2023 14:42:55 GMT]]>@Josho_SAI

Even for small entities, or even for individuals : use RFC 2136 or something that's close to that.
Most serious ( ? ) domain name registrars offer such a service.

It works like this :
It cert renewal time.
Ask Letenscrypt for a random hash.
Place this txt record in the domain name's DNS zone (in the registrar). That's what all these acme dns methods are al about.
Wait for a minute or two to give DNS the time to update the zone over all the DNS slaves.
Then tell Letsencrypt : go ahead, check.
Undo the txt recods.
Get the certificate.
Done.

]]>https://forum.netgate.com/post/1123416https://forum.netgate.com/post/1123416Thu, 31 Aug 2023 14:42:55 GMT<![CDATA[Reply to ACME 60 day renewal schedule and scheduled Firewall Rule for HTTP & HTTPS allow on Thu, 31 Aug 2023 12:01:22 GMT]]>@keyser
Big organisations wouldn't be using the Let's Encrypt Webroot certificates

]]>https://forum.netgate.com/post/1123378https://forum.netgate.com/post/1123378Thu, 31 Aug 2023 12:01:22 GMT<![CDATA[Reply to ACME 60 day renewal schedule and scheduled Firewall Rule for HTTP & HTTPS allow on Thu, 31 Aug 2023 05:58:29 GMT]]>@Josho_SAI Does ACME cert renewal require inbound HTTP/HTTPS sessions??? I can’t believe that is needed as it would be impossible to handle/allow in bigger organisations.

]]>https://forum.netgate.com/post/1123337https://forum.netgate.com/post/1123337Thu, 31 Aug 2023 05:58:29 GMT