Dataflows and firewall rules

Potential ACME traffic scenarios

  1. F5, A10, Cisco hardware (insert all load balancer names here) load balancers as TLS termination
  2. CDN / reverse proxy, usually with Cloudflare + Let's Encrypt
  3. Kubernetes and cert-manager,
  4. IIS + URL rewrite,
  5. ACME and IIS (one server, one site, one certificate)
  6. ACME and IIS (one server, multiple sites)
  7. ACME, IIS, and LB (two servers, one site, one certificate)
  8. Behind a firewall, the most common enterprise scenario, where DNS-01 should always be the recommendation
  9. Behind a proxy server, the TLS inspection covers the gotcha that breaks a lot of agent deployments
  10. Load-balanced environment, explains the HTTP-01 routing failure in simple terms, and points to Trust Lifecycle Manager (TLM) multi-host as the solution
  11. Multiple sites, one server, explains that firewall rules are server-level and not per site
  12. Internal / air gapped environments, cover sensor relays, proxy paths, and on-premises TLM

The two directions of ACME traffic

ACME automation generates network traffic in two different directions, and understanding which prevents most network or firewall misconfigurations.

Direction #1: Outbound
The DigiCert automation agent or Trust Assistant on your server communicates outbound to DigiCert's cloud platform and handles everything from account registration, certificate ordering, challenge completion signaling, certificate retrieval, and renewals.

Two Directions of ACME Outbound

All the traffic leaves your server on port 443 as outbound HTTPS, and DigiCert will never initiate a connection back to your agent. It is always your server that initiates and conforms to zero-trust networking principles.

Using HTTP-01 validation, DigiCert's infrastructure sends inbound requests on port 80 to your web server, requiring a firewall rule. DNS-01 validation eliminates the need for inbound rules, simplifying setup and firewall rules requirements.

The three universal connectivity rules every DigiCert + ACME deployment requires

⚠️ Important note: DigiCert's IP list is not entirely static and will change over time. It is recommended to use DNS references or user agents over hardcoded static IP addresses where possible. DigiCert Platform IP Addresses and URLs

Rule #1: Outbound HTTPS from your server to DigiCert

Rule one outbound https from your server to DigiCert

The automation agent or Trust Assistant must be able to reach DigiCert's platform on port 443, and this is a single outbound HTTPS rule. If this is blocked, the agent cannot register, order certificates, or retrieve any issued certificates.

Rule #2: DNS resolution for DigiCert endpoints
Your server must be able to resolve DigiCert's hostnames (such as acme.digicert.com) to their current IP addresses. If DNS resolution fails, the ACME client cannot connect to DigiCert even if the outbound port 443 is open. Ensure your DNS infrastructure can resolve external hostnames, or configure forwarders appropriately.

The allow list can include specific DigiCert IP addresses and hostnames in your local DNS. Hardcoding DigiCert IP addresses in local DNS is not recommended because DigiCert may change its IP addresses without notice, which can break your automation. Use this approach only as a last resort in environments where standard external DNS resolution is unavailable, and monitor the list below for changes.

[URL of List of FQDNs of DigiCert]

Rule #3: The Challenge validation path must be clear
For HTTP-01, DigiCert's validation infrastructure must be able to reach your web server on port 80 from the outside. For any DNS-01 or DNS-PERSIST-01, your ACME client must be able to reach your DNS provider's API on port 443 outbound. No inbound rule is needed.

Rule three the challenge validation path must be clear

⚠️ Important notes:

Frequently asked questions

Which ports does ACME need open on my firewall?
ACME requires outbound HTTPS (TCP/443) from your server to DigiCert's endpoints for certificate registration, ordering, and retrieval. If you use the recommended DNS-01 validation method, that single outbound rule is the only firewall change needed. HTTP-01 validation also requires inbound TCP/80 from DigiCert's validation servers to your web server.
Does ACME require inbound firewall rules?
Not if you use DNS-01 or DNS-PERSIST-01 validation; these methods work entirely over outbound HTTPS connections. Inbound port 80 is only required if you choose HTTP-01 validation, which requires DigiCert's servers to reach your web server to verify a challenge file.
What firewall rules are needed for DNS-01 validation?
DNS-01 requires only two outbound rules that most firewalls already permit: outbound HTTPS (TCP/443) to DigiCert's ACME endpoints, and outbound HTTPS (TCP/443) to your DNS provider's API for publishing validation TXT records. No inbound rules are needed, making DNS-01 the preferred method for firewalled environments.
Can I use ACME certificates behind a load balancer?
Yes, when TLS terminates on the load balancer, the ACME client or DigiCert Trust Lifecycle Manager communicates outbound to DigiCert from the load balancer or a management server. DNS-01 validation is strongly recommended in load-balanced environments because it avoids the complexity of routing HTTP-01 challenge traffic through the load balancer to a specific backend server.