# Let’s Encrypt / Certbot: Challenge failed for domain example.com — Invalid response from http://example.com/.well-known/acme-challenge/x: 404

**Code:** `Challenge failed for domain` · **Category:** SSL / TLS · **Seen on:** OpenSSL

Let’s Encrypt couldn’t verify you control the domain — the HTTP-01 challenge file wasn’t served, or DNS points elsewhere.

## Meaning

Let’s Encrypt fetches /.well-known/acme-challenge/<token> over port 80. Wrong DNS (old server, IPv6 AAAA to another host), port 80 blocked, redirects to a wrong host, or a CDN/proxy intercepting the path cause failures. DNS-01 challenges fail when TXT records aren’t visible yet.

## Common causes

- DNS A/AAAA records not pointing to this server (stale AAAA common)
- Port 80 blocked by firewall/security group
- Web server config not serving the challenge path (redirect/app routing)
- CDN/proxy (Cloudflare) interfering

## Quick fix

1. Make DNS point to this server (remove wrong AAAA)
2. Open port 80 temporarily
3. Use certbot --nginx/--apache or webroot matching the served root; or DNS-01 with a DNS plugin

## Detailed fix by platform

### Shell

1. 

```bash
dig +short A example.com; dig +short AAAA example.com
sudo certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com --dry-run
```


## How to diagnose

1. **DNS** — A/AAAA records
2. **Reach** — curl http://example.com/.well-known/acme-challenge/test
3. **Proxy** — CDN in front?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ssl/certbot-challenge-failed)