Certbot /.well-known/acme-challenge

Question

Should I leave the /.well-known/acme-challenge always exposed on the server? Here is my config for the HTTP:

server {  listen 80;   location '/.well-known/acme-challenge' {     root        /var/www/demo;   }   location / {           if ($scheme = http) {             return 301 https://$server_name$request_uri;           }  } 

Which basically redirects all the requests to https, except for the acme-challenge (for auto renewal). My question: Is it alright to keep location '/.well-known/acme-challenge' always exposed on port 80? Or better to comment/uncomment it manually, when need to reissue the certificate? Are there any security issues with that?

Any advise or links to read for about the this location appreciated. Thanks!

Answer 1

Acme challenge link only needed for verifying domain to this ip address

Answer 2

You do not need to keep the token available once your certificate has been signed. However, there is not much harm in leaving it available either, as explained by a Certbot engineer:

The token is part of a particular challenge which is no longer active, from the ACME server's point of view, after the server has tried to validate it. It would reveal a little bit of information about how you get certificates, but should not allow someone else to issue certificates for your site or impersonate you.