---
title: "Let's Encrypt behind a reverse proxy"
date: "2017-09-12"
category: "ssl"
slug: "lets-encrypt-behind-a-reverse-proxy"
---

By default, ApisCP verifies that a hostname's DNS resolves back to the server's IP address before issuing or renewing a Let's Encrypt certificate. If your domain is behind a reverse proxy (such as Cloudflare or SiteLock), this check will fail. Both the control panel and API provide ways to bypass the IP verification.

**Important:** This only bypasses the IP address check. It does not bypass DNS propagation requirements or work for domains that are unreachable via DNS. The Let's Encrypt ACME challenge must still be accessible from the domain.

## Issuing Certificates via the Panel

To bypass the IP check when issuing a new certificate, disable the IP verification option in the control panel.

![](kb-image:bypass-le-check.png)
*Bypassing the DNS check for Let's Encrypt in the control panel*

## Renewing Certificates via the API

Certificate renewals with IP bypass require the API. [[scripting-with-beacon]] provides a command-line frontend to the API. After configuring Beacon, call [letsencrypt\_renew](http://api.apnscp.com/source-class-Letsencrypt_Module.html) with `0` (false) for the _verifyip_ parameter to disable IP verification:

beacon eval letsencrypt\_renew 0

Since the control panel automatically renews certificates 10 days before expiration, run this command every 60-80 days. No email notification is sent on failure, so check the return value.

### Automating Renewals

To automate this process, add a scheduled task in the control panel under **Dev** > **Task Scheduler** to run monthly or bimonthly.
