Diagnosing Netlify SSL failures when the ACME challenge key thumbprint mismatches

TL;DR

Confirm the apex and www records resolve to Netlify. Removing and re-adding the custom domain on the live site forces a fresh certificate order. When Netlify provisions a Let's Encrypt certificate it uses an HTTP-01 challenge.

When Netlify provisions a Let's Encrypt certificate it uses an HTTP-01 challenge. Let's Encrypt hands out a token, and the server must serve a file at /.well-known/acme-challenge/[token] whose content is the token, a dot, then the thumbprint of the ACME account key that ordered the certificate.

The error "the key authorization file from the server did not match this challenge" with an identical token part but a different account-key suffix means the challenge file is being served by a different ACME account than the one that placed the order. In other words, something other than the Netlify site that requested the certificate is answering for that domain.

On Netlify the usual causes:

1. The custom domain is attached to more than one Netlify site or team. Check Domain management and keep it on exactly one site.
2. DNS does not actually point at Netlify for the failing hostname. Confirm the apex and www records resolve to Netlify. A proxy or CDN in front of the origin serves its own challenge response.
3. A stale site still has the domain bound. Removing and re-adding the custom domain on the live site forces a fresh certificate order.
4. Let's Encrypt rate limits: 5 failed validations per account per hostname per hour. After several failures, wait out the window before retrying, or each new attempt burns another slot and the error never clears.

If the domain must be secured now, Netlify support can provision the certificate manually once the domain answers consistently from the right site. The .fr TLD needs nothing special here; the flow is identical for every TLD.

Context: Thread: SSL certificate won't provision for .fr domain - key thumbprint mismatch on Netlify side. Site flawless-wellness, custom domain ora-wellness-studio.fr set as primary. The Let's Encrypt certificate cannot be provisioned; Domain Management shows SniCertificate::CertificateValidationError: Unable to verify challenge for ora-wellness-studio.fr: The key authorization file from the server did not match this challenge. Expected token.Hq7PVkpoUztZtbjTHneeg-1mVJhNloQx6jD-mxLNMsQ but got token.4E3VCTFsySjUrqnCg0ooULx-3kbdPBygi0aWkvg5Gd8. The token part is identical; only the account-key suffix differs. The .com certificate provisioned fine, DNS points to Netlify, and the reporter hit the Let's Encrypt rate limit of 5 failed authorizations per hour while troubleshooting. The UI says the certificate cannot be renewed automatically until the issue is resolved.

When to use

• You hit this exact issue.
• The symptom matches: Diagnosing Netlify SSL failures when the ACME challenge key thumbprint mismatches.

When NOT to use

• A different error or symptom; the cause here is specific to this one.

Compatibility

Per the linked source.

Edge cases

• If your error message differs even slightly, this is probably a different issue; search the exact text.
• If the fix does not help, capture the full error output and check the source link for updates.

Thread: SSL certificate won't provision for .fr domain - key thumbprint mismatch on Netlify side. Site flawless-wellness, custom domain ora-wellness-studio.fr set as primary. The Let's Encrypt certificate cannot be provisioned; Domain Management shows SniCertificate::CertificateValidationError: Unable to verify challenge for ora-wellness-studio.fr: The key authorization file from the server did not match this challenge. Expected token.Hq7PVkpoUztZtbjTHneeg-1mVJhNloQx6jD-mxLNMsQ but got token.4E3VCTFsySjUrqnCg0ooULx-3kbdPBygi0aWkvg5Gd8. The token part is identical; only the account-key suffix differs. The .com certificate provisioned fine, DNS points to Netlify, and the reporter hit the Let's Encrypt rate limit of 5 failed authorizations per hour while troubleshooting. The UI says the certificate cannot be renewed automatically until the issue is resolved. Resolved: When Netlify provisions a Let's Encrypt certificate it uses an HTTP-01 challenge. Let's Encrypt hands out a token, and the server must serve a file at /.well-known/acme-challenge/[token] whose content is the token, a dot, then the thumbprint of the ACME account key that ordered the certificate.

The error "the key authorization file from the server did not match this challenge" with an identical token part but a different account-key suffix means the challenge file is being served by a different ACME account than the one that placed the order. In other words, something other than the Netlify site that requested the certificate is answering for that domain.

On Netlify the usual causes:

1. The custom domain is attached to more than one Netlify site or team. Check Domain management and keep it on exactly one site.
2. DNS does not actually point at Netlify for the failing hostname. Confirm the apex and www records resolve to Netlify. A proxy or CDN in front of the origin serves its own challenge response.
3. A stale site still has the domain bound. Removing and re-adding the custom domain on the live site forces a fresh certificate order.
4. Let's Encrypt rate limits: 5 failed validations per account per hostname per hour. After several failures, wait out the window before retrying, or each new attempt burns another slot and the error never clears.

If the domain must be secured now, Netlify support can provision the certificate manually once the domain answers consistently from the right site. The .fr TLD needs nothing special here; the flow is identical for every TLD.