# ssl renewal failed http-01 challenge timeout

## TL;DR
The certificate authority could not fetch the challenge file, so the problem is reachability, not certificates. Confirm DNS points at the renewing server, place a test file at the challenge path and fetch it publicly, open port 80 or fix the webroot, then re-run the renewal and confirm the new certificate is served.

```text
ssl renewal failed http-01 challenge timeout
```

## Use this when

- Certificate renewal fails with an http-01 challenge timeout
- The error mentions fetching the challenge URL or connection timeout
- Renewal worked before and broke without config changes

## Not for this skill when

- DNS-01 challenge failures (different challenge type)
- Certificate authority rate limiting (too many requests, not timeouts)
- New certificate issuance failing for a brand-new domain (check DNS first)

## Steps

### Step 1: Confirm DNS points at the server

Check the domain's A and AAAA records resolve to the renewing server's IPs. Expected: DNS aims at the machine running the renewal.

### Step 2: Test the challenge path manually

Place a test file under the challenge directory and fetch it over public HTTP. Expected: the file is retrievable from the internet, proving the path works.

### Step 3: Open port 80 and fix the webroot

Ensure the firewall allows port 80 and the web server serves the challenge directory. Expected: the test file fetch succeeds publicly.

### Step 4: Re-run the renewal

Run the certificate client again. Expected: the challenge completes and the certificate is issued.

### Step 5: Confirm the new certificate

Check the served certificate's expiry date. Expected: the site serves the renewed certificate.

## Tool compatibility

ACME clients (certbot and similar); Let's Encrypt http-01 challenges; web servers and firewalls.

## Variant phrasings

### Variant 1

letsencrypt http-01 challenge timeout fix

### Variant 2

ssl renewal failed challenge timed out port 80

### Variant 3

certbot http-01 unauthorized timeout

## Why it happens

The http-01 challenge is the certificate authority proving you control the domain by fetching a file only the domain's server could serve. A timeout means the fetch never completed: the firewall drops port 80, DNS points elsewhere, a CDN answers instead of the origin, or an IPv6 AAAA record sends the authority to a different machine than the IPv4 one. Because renewals run unattended, the breakage is discovered at expiry, when the site is already serving a dead certificate. Testing the challenge path with a manual file turns every one of these causes into a visible, fixable reachability problem.

## Edge cases / pitfalls

- A CDN or proxy in front of the origin must forward the challenge path, not serve its own 404.
- AAAA records pointing at a different host than A records split the authority's checks; keep them consistent.
- Redirects are followed but redirect loops and HTTPS-only listeners on port 80 break the fetch.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_FZ95WFp2rJvvzehwRgaw8g