ACME in depth · 18.9
TLS-ALPN-01
With TLS-ALPN-01, you prove control of a name with a special TLS handshake on port 443 (RFC 8737). It needs neither a DNS change nor a file on a web server.
- The CA gives TLSPilot a token for every name of the order.
- TLSPilot creates a temporary, self-signed validation certificate for the name. It contains the name and, in the critical extension acmeIdentifier, a hash of the key authorization.
- The CA connects to port 443 of the name with the ALPN protocol
acme-tls/1and the name as SNI, from several network perspectives. TLSPilot answers on the management host with the validation certificate. - After the validation, TLSPilot removes the validation certificate again.
Settings: chapter Additional challenge types. Errors and solutions: chapter HTTP-01 and TLS-ALPN-01.
| Aspect | Details |
|---|---|
| Advantages | Only port 443 is used. No DNS access and no file on a web server are needed. |
| Limits | All names must point to the management host; the challenge cannot run on another system. A reverse proxy, load balancer or WAF that terminates TLS blocks acme-tls/1, so forward port 443 at TCP level. The CA always uses port 443; a different local port needs a forwarding. TLSPilot does not accept IP addresses in ACME certificates. Of the built-in providers, only Let’s Encrypt allows TLS-ALPN-01; for other providers, the switch is disabled with the tooltip This challenge is not allowed for the selected ACME provider. |
| Wildcards | No. Use DNS-01. |
For TLS-ALPN-01, TLSPilot answers the validation on the management host. You set the Listen address (default 0.0.0.0) and the Port (default 443). If the WebUI already listens on that address and port, the WebUI answers the challenge. If another program uses the port, choose a different local IP address for the challenge, see Figure TLS-ALPN-01 challenge on the management host.
