# \[Feature Request\] Let's encrypt DNS challange **URL:** \ **Category:** Pritunl Zero\ **Tags:** pritunl-zero\ **Created:** [January 10, 2024, 9:54am UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670 "2024-01-10T09:54:26Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Maurice](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/d6d6ee/32.png) [@Maurice](https://forum.pritunl.com/u/Maurice)\ **Post date:** [January 10, 2024, 9:54am UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670/1 "2024-01-10T09:54:26Z")
Hi, I could not find anything related to this so I hope this could be a possible new feature. We would like to see the DNS ACME challange in Pritunl Zero. At this moment we need to open up port 80 for the whole world and we cannot apply GeoIP blocking on that port and when we want to implement HSTS it could impact the ACME challenge. Is Let’s encrypt DNS challenge on the roadmap? Regards, Maurice ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [January 12, 2024, 8:36pm UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670/2 "2024-01-12T20:36:37Z")
Support for authorizing the Lets Encrypt certificates with DNS challenges on AWS and Oracle Cloud will be added to both Pritunl Zero and Pritunl Cloud soon. This will be added with the secrets storage component that will be used store the AWS and Oracle Cloud API keys. ---
**Author:** ![Maurice](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/d6d6ee/32.png) [@Maurice](https://forum.pritunl.com/u/Maurice)\ **Post date:** [January 12, 2024, 10:15pm UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670/3 "2024-01-12T22:15:52Z")
Hi , thank you for the information, do you know if Cloudflare is(or will be) also on the list to add? ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [January 16, 2024, 8:06am UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670/4 "2024-01-16T08:06:03Z")
Both AWS and Cloudflare DNS challenge certificates have been added and will be included in the next release. ---
**Author:** ![Maurice](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/d6d6ee/32.png) [@Maurice](https://forum.pritunl.com/u/Maurice)\ **Post date:** [January 18, 2024, 3:05pm UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670/5 "2024-01-18T15:05:00Z")
Do you know when the new release is planned? (this month, next month, or something like that) ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [January 19, 2024, 12:06am UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670/6 "2024-01-19T00:06:45Z")
Support for OracleCloud still needs to be completed. It may be in a build this weekend. It isn’t possible currently to pull the code from the repository, there is still a lot of uncommitted code. ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [January 22, 2024, 2:44pm UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670/7 "2024-01-22T14:44:36Z")
This is now available on the [**unstable repositories**](https://docs.pritunl.com/docs/repo#unstable-repositories), it will move to the stable repositories after a few days of testing. The DNS provider API key is stored in the secrets tab which can then be selected from the certificates page. Support for AWS, Cloudflare and Oracle Cloud is available. ---
**Author:** ![Maurice](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/d6d6ee/32.png) [@Maurice](https://forum.pritunl.com/u/Maurice)\ **Post date:** [June 28, 2024, 2:09pm UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670/8 "2024-06-28T14:09:02Z")
Anyone knows if this feature is also being implemented on the Pritunl VPN solution? ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [July 3, 2024, 1:34pm UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670/9 "2024-07-03T13:34:16Z")
There’s no plans on adding this to the VPN server. ---
**Author:** ![harsha](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/h/e274bd/32.png) [@harsha](https://forum.pritunl.com/u/harsha)\ **Post date:** [May 19, 2025, 4:28pm UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670/10 "2025-05-19T16:28:50Z")
Requesting to add this to VPN server to comply with various standards and remove open port 80 ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [May 20, 2025, 1:07am UTC](https://forum.pritunl.com/t/feature-request-lets-encrypt-dns-challange/1670/11 "2025-05-20T01:07:17Z")
The web server in Pritunl has a very secure [**dual layer design**](https://docs.pritunl.com/docs/security#dual-web-server), there shouldn’t be any concern with keeping it open to the internet. A lot of configurations will require it to be open. Any vulnerability especially on port 80 which has almost no handlers would very likely need to exist both on the Golang and Python web servers. It doesn’t pass the full request to the inner web server, it is fully parsed with JSON type checking in Golang then recreated using only the defined set of headers and sent to the internal server. It can be made more secure by running `sudo pritunl set app.web_systemd true` then `sudo systemctl restart pritunl` this will isolate it in a systemd service that has a lot of the isolation options configured. This may become the default but to prevent compatibility issues currently it must be manually enabled. There are also SELinux profiles included with the RHEL packages that further protect the web server process.