ACME Challenge Failed? Fixing HTTP-01 and DNS-01 Validation
The usual reasons an ACME HTTP-01 or DNS-01 challenge fails, and how to fix each one.
Before an ACME CA like Let's Encrypt issues a certificate, it checks that you control the domain. Your ACME client (certbot, acme.sh, cert-manager, Caddy and others) answers a challenge, and the CA checks the answer. When renewal fails, it is almost always this check. Here are the usual causes, by challenge type.
Read the error first
The error names the problem. connection means the CA couldn't reach your server, unauthorized or incorrectResponse means it reached something that didn't give the right answer, dns means a DNS lookup failed, caa means a CAA record forbids the CA, and rateLimited means you hit a limit. Start from that word, not from the top of this page.
HTTP-01: the CA fetches a file from your site
The CA requests http://your-domain/.well-known/acme-challenge/<token> on port 80 and expects the exact token back. It fails when:
- Port 80 is closed. The challenge always starts on plain HTTP. A redirect to HTTPS is fine; a closed port or a firewall rule isn't.
- A WAF, CDN or bot protection answers instead. A challenge page or a block page isn't the token. Allow
/.well-known/acme-challenge/through without checks. - Geo-blocking. Let's Encrypt checks from several places around the world, and all of them need to get through. Blocking whole countries can break validation.
- DNS points somewhere else. A stale AAAA (IPv6) record pointing at an old server is a classic: Let's Encrypt prefers IPv6 when a domain has an AAAA record.
- The app swallows the path. A framework route or a rewrite rule serves its own 404 for
/.well-known/.
HTTP-01 can't issue wildcard certificates. Those need DNS-01.
DNS-01: the CA looks up a TXT record
The client publishes a TXT record at _acme-challenge.your-domain and the CA looks it up. It fails when:
- The DNS moved and the client didn't. After a move to a new DNS provider, the client keeps writing records through the old provider's API, into a zone nobody queries anymore. Update the client's DNS credentials and plugin.
- The record isn't visible yet. The CA asks your authoritative name servers. If the client doesn't wait until all of them have the record, validation fails. Increase the client's propagation wait.
- A delegation broke. If
_acme-challengeis a CNAME to a validation zone, check it still points to the right place after any DNS change.
Check what the CA will see with dig TXT _acme-challenge.example.com @your-authoritative-server.
Rate limits
Let's Encrypt allows 50 new certificates per registered domain every 7 days, and 5 certificates for the exact same set of names every 7 days (current limits). Renewals don't count against the 50. Repeated failed validations are limited too, so a script that retries in a loop makes things worse. Debug against the Let's Encrypt staging environment, which has much higher limits, and switch back once it works.
Don't find out from customers
A failed renewal is silent until the old certificate expires. Check the certificate your site actually serves, not the client's logs. Scan your domain free to see its expiry date. If renewal has been failing, the date won't have moved.
Frequently asked questions
- Does HTTP-01 work if my site redirects HTTP to HTTPS?
- Yes. The CA starts on port 80 and follows the redirect. What breaks it is port 80 being closed, or a WAF or CDN answering the challenge request with its own page.
- My DNS-01 renewals started failing after we changed DNS providers. Why?
- The ACME client is most likely still writing the TXT record through the old provider's API, into a zone nobody queries anymore. Update the client's DNS plugin and credentials for the new provider.
- How do I debug without hitting Let's Encrypt's rate limits?
- Point the client at the Let's Encrypt staging environment, which has much higher limits, until validation works, then switch back to production.
Check any site in seconds
Scan a domain with our free SSL tool and see the certificate, grade, and any issues - no signup needed.
Related guides
-
CAA Records Explained: Which CAs May Issue for Your Domain
How CAA records decide which certificate authorities may issue for your domain, and how to fix a refused request.
-
HTTPS Not Working? A Plain-English Troubleshooting Guide
Why HTTPS suddenly stops working and how to diagnose it in under 10 minutes.
From the blog
-
ACME at Enterprise Scale: Pitfalls and Patterns
A revolving door is a small, elegant piece of engineering. It controls the flow of people. It keeps heat in. It looks nice. At a small office building, it works perfectly - twenty or thirty people pas
-
The Let's Encrypt Mass Revocation Simulation Was a Warning to Every TLS Customer
On March 19, 2026, Let's Encrypt simulated a 3 million cert mass revocation. Two weeks later, another CA revoked 1.7 million real certificates in 24 hours. Both events told the same story: your CA can revoke your cert for reasons you don't control, and most renewal automation won't respond in time.