ssl renewal failed http-01 challenge timeout

ssl renewal failed http-01 challenge timeout

TL;DR

The certificate authority could not fetch the challenge file, so the problem is reachability, not certificates. Confirm DNS points at the renewing server, place a test file at the challenge path and fetch it publicly, open port 80 or fix the webroot, then re-run the renewal and confirm the new certificate is served.

ssl renewal failed http-01 challenge timeout

Use this when

• Certificate renewal fails with an http-01 challenge timeout
• The error mentions fetching the challenge URL or connection timeout
• Renewal worked before and broke without config changes

Not for this skill when

• DNS-01 challenge failures (different challenge type)
• Certificate authority rate limiting (too many requests, not timeouts)
• New certificate issuance failing for a brand-new domain (check DNS first)

Steps

Step 1: Confirm DNS points at the server

Check the domain's A and AAAA records resolve to the renewing server's IPs. Expected: DNS aims at the machine running the renewal.

Step 2: Test the challenge path manually

Place a test file under the challenge directory and fetch it over public HTTP. Expected: the file is retrievable from the internet, proving the path works.

Step 3: Open port 80 and fix the webroot

Ensure the firewall allows port 80 and the web server serves the challenge directory. Expected: the test file fetch succeeds publicly.

Step 4: Re-run the renewal

Run the certificate client again. Expected: the challenge completes and the certificate is issued.

Step 5: Confirm the new certificate

Check the served certificate's expiry date. Expected: the site serves the renewed certificate.

Tool compatibility

ACME clients (certbot and similar); Let's Encrypt http-01 challenges; web servers and firewalls.

Variant phrasings

Variant 1

letsencrypt http-01 challenge timeout fix

Variant 2

ssl renewal failed challenge timed out port 80

Variant 3

certbot http-01 unauthorized timeout

Why it happens

The http-01 challenge is the certificate authority proving you control the domain by fetching a file only the domain's server could serve. A timeout means the fetch never completed: the firewall drops port 80, DNS points elsewhere, a CDN answers instead of the origin, or an IPv6 AAAA record sends the authority to a different machine than the IPv4 one. Because renewals run unattended, the breakage is discovered at expiry, when the site is already serving a dead certificate. Testing the challenge path with a manual file turns every one of these causes into a visible, fixable reachability problem.

Edge cases / pitfalls

• A CDN or proxy in front of the origin must forward the challenge path, not serve its own 404.
• AAAA records pointing at a different host than A records split the authority's checks; keep them consistent.
• Redirects are followed but redirect loops and HTTPS-only listeners on port 80 break the fetch.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_FZ95WFp2rJvvzehwRgaw8g