title: acme/autocert listener reporting TLS handshake errors from unrecognized hosts
body: <p>I use <a href="https://godoc.org/golang.org/x/crypto/acme/autocert" rel="nofollow noreferrer">acme/autocert</a> to automatically handle TLS certifications for my server. It seems to have worked (in that my domain now has a valid TLS certificate), but I'm a bit confused on what else I'm seeing. My server log looks like this (note this is not the full log, just a selection):</p>
  
  <pre><code>rpc_1    | 2019/11/11 14:44:49 http: TLS handshake error from 2.51.84.126:53282: acme/autocert: host "physicaldatebaby.org" not configured in HostWhitelist
  rpc_1    | 2019/11/11 14:44:50 http: TLS handshake error from 92.5.192.229:47416: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:44:55 http: TLS handshake error from 92.5.192.229:47418: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:01 http: TLS handshake error from 92.5.192.229:47420: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:06 http: TLS handshake error from 92.5.192.229:47422: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:07 http: TLS handshake error from 197.252.5.80:48622: read tcp 192.168.208.2:443-&gt;197.252.5.80:48622: read: connection reset by peer
  rpc_1    | 2019/11/11 14:45:11 http: TLS handshake error from 92.5.192.229:47424: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:16 http: TLS handshake error from 197.29.217.90:51215: acme/autocert: host "cloudfront.net" not configured in HostWhitelist
  rpc_1    | 2019/11/11 14:45:16 http: TLS handshake error from 92.5.192.229:47426: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:20 http: TLS handshake error from 156.172.18.24:21209: acme/autocert: host "paypal.com" not configured in HostWhitelist
  rpc_1    | 2019/11/11 14:45:21 http: TLS handshake error from 92.5.192.229:47428: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:27 http: TLS handshake error from 92.5.192.229:47430: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:32 http: TLS handshake error from 92.5.192.229:47432: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:37 http: TLS handshake error from 92.5.192.229:47434: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:42 http: TLS handshake error from 92.5.192.229:47436: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:47 http: TLS handshake error from 92.5.192.229:47438: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:52 http: TLS handshake error from 92.5.192.229:47440: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:45:58 http: TLS handshake error from 92.5.192.229:47442: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:46:03 http: TLS handshake error from 92.5.192.229:47444: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:46:08 http: TLS handshake error from 92.5.192.229:47446: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:46:13 http: TLS handshake error from 92.5.192.229:47448: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:46:14 http: TLS handshake error from 197.29.217.90:51572: acme/autocert: host "cloudfront.net" not configured in HostWhitelist
  rpc_1    | 2019/11/11 14:46:18 http: TLS handshake error from 92.5.192.229:47450: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:46:24 http: TLS handshake error from 92.5.192.229:47452: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:46:29 http: TLS handshake error from 92.5.192.229:47454: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:46:34 http: TLS handshake error from 92.5.192.229:47456: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:46:39 http: TLS handshake error from 92.5.192.229:47458: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:46:44 http: TLS handshake error from 92.5.192.229:47460: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:46:49 http: TLS handshake error from 92.5.192.229:47462: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:46:55 http: TLS handshake error from 92.5.192.229:47464: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:00 http: TLS handshake error from 92.5.192.229:47466: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:05 http: TLS handshake error from 92.5.192.229:47468: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:10 http: TLS handshake error from 92.5.192.229:47470: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:15 http: TLS handshake error from 92.5.192.229:47472: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:21 http: TLS handshake error from 92.5.192.229:47474: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:26 http: TLS handshake error from 92.5.192.229:47476: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:31 http: TLS handshake error from 92.5.192.229:47478: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:36 http: TLS handshake error from 92.5.192.229:47480: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:37 http: TLS handshake error from 197.149.220.123:31754: acme/autocert: host "cloudfront.net" not configured in HostWhitelist
  rpc_1    | 2019/11/11 14:47:41 http: TLS handshake error from 92.5.192.229:47482: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:47 http: TLS handshake error from 92.5.192.229:47484: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:52 http: TLS handshake error from 92.5.192.229:47486: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:47:57 http: TLS handshake error from 92.5.192.229:47488: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:48:02 http: TLS handshake error from 92.5.192.229:47490: acme/autocert: missing server name
  rpc_1    | 2019/11/11 14:48:07 http: TLS handshake error from 92.5.192.229:47492: acme/autocert: missing server name
  </code></pre>
  
  <p>What is happening here? I want to leave this listener running so that my certificate renews but I'm worried about that log. I don't understand why those requests are coming through or how I can stop them. I've searched around but haven't been able to find any similar questions. These requests are not spawned from any clients I recognize, and one seems to be simply trying every single port it can from the same IP. I really don't know if this is appropriate for a production server, everything is up to date (it's running in the latest amazon EC2 ami) so I'm not sure if I'm at risk or need to take other measures. I'm a bit confused in general so I hope I can get some feedback to help cleanup this question.</p>
  
  <p>My relevant Go code looks like this:</p>
  
  <pre class="lang-golang prettyprint-override"><code>
  var endpoint = flag.String(
      "endpoint",
      os.Getenv("SERVER_ENDPOINT"),
      "Overwrite default endpoint defined in environment variables",
  )
  
  certManager := autocert.Manager{
      Prompt:     autocert.AcceptTOS,
      HostPolicy: autocert.HostWhitelist(*endpoint),
      Cache:      autocert.DirCache("certs"),
  }
  
  // certManager.Listener() listens on 443
  go http.Serve(certManager.Listener(), certManager.HTTPHandler(nil))
  </code></pre>
  
  <p>I have both port 80 and port 443 open to all inbound traffic, though I don't think I need 80 to be open to anything other than Lets Encrypt traffic (I think, my understanding of how Lets Encrypt works might be wrong?)</p>