Challenge failed for domain SSL / TLS Origin: Network Last updated 12 Oct 2026

Let’s Encrypt / Certbot: Challenge failed for domain example.com — Invalid response from http://example.com/.well-known/acme-challenge/x: 404

Let’s Encrypt couldn’t verify you control the domain — the HTTP-01 challenge file wasn’t served, or DNS points elsewhere.

Exact message you may see Challenge failed for domainInvalid response fromSome challenges have failedTimeout during connect (likely firewall problem)
Explore the map of this error Full error map →
Seen on: OpenSSL

Meaning

Let’s Encrypt fetches /.well-known/acme-challenge/<token> over port 80. Wrong DNS (old server, IPv6 AAAA to another host), port 80 blocked, redirects to a wrong host, or a CDN/proxy intercepting the path cause failures. DNS-01 challenges fail when TXT records aren’t visible yet.

Common causes

  • DNS A/AAAA records not pointing to this server (stale AAAA common)
  • Port 80 blocked by firewall/security group
  • Web server config not serving the challenge path (redirect/app routing)
  • CDN/proxy (Cloudflare) interfering

⚡ Quick fix

  1. Make DNS point to this server (remove wrong AAAA)
  2. Open port 80 temporarily
  3. Use certbot --nginx/--apache or webroot matching the served root; or DNS-01 with a DNS plugin

Detailed fix by platform

Shell

  1. bash
    dig +short A example.com; dig +short AAAA example.com
sudo certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com --dry-run

How to diagnose

  1. DNS — A/AAAA records
  2. Reach — curl http://example.com/.well-known/acme-challenge/test
  3. Proxy — CDN in front?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

526 — Cloudflare Error 526: Invalid SSL Certificate (Cloudflare)526CAA record forbids issuance — Let's Encrypt/CA: CAA record for example.com prevents issuance (SSL / TLS)CAA record forbids is…Could not automatically find a matching server block — Certbot: Could not automatically find a matching server block for example.com. Set the `server_name` directive to use the Nginx installer (SSL / TLS)Could not automatical…DNS problem: NXDOMAIN looking up A — Certbot: Detail: DNS problem: NXDOMAIN looking up A for www.example.com - check that a DNS record exists for this domain (SSL / TLS)DNS problem: NXDOMAIN…doesn't include signing certificate — Provisioning profile "x" doesn't include signing certificate "Apple Development: Name (ID)" (iOS)doesn't include signi…ERR_SSL_VERSION_OR_CIPHER_MISMATCH — Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Browser)ERR_SSL_VERSION_OR_CI…Invalid response from .well-known/acme-challenge: 404 — Certbot: Detail: Invalid response from http://example.com/.well-known/acme-challenge/abc: 404 (SSL / TLS)Invalid response from…NET::ERR_CERT_COMMON_NAME_INVALID — NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain) (SSL / TLS)NET::ERR_CERT_COMMON_…Challenge…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.