Most Let’s Encrypt failures on Apache are caused by a mismatch between DNS, the public challenge endpoint, Apache’s virtual-host routing, or the certificate files Apache loads. Treat the failure as one of three separate problems—ACME validation, Apache installation/reload, or later renewal—then test the relevant layer. HTTP-01 needs a publicly reachable port 80; DNS-01 needs an authoritative TXT record and is the documented method for wildcard certificates.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
First identify which stage failed
Certbot uses an authenticator to prove control of a hostname and, optionally, an installer to modify Apache. A successful authenticator does not guarantee that Apache can load the resulting certificate, and a certificate that works today does not prove that its next renewal will work.
As an Amazon Associate I earn from qualifying purchases.
ACME validation errors
These occur before a certificate is issued. Typical messages mention an HTTP-01 challenge, connection refused, timeout, 404, unauthorized response, or a missing DNS TXT record. Let’s Encrypt must retrieve a token or TXT value from the public Internet; a working HTTPS page is not enough if the challenge path is routed elsewhere.
Apache installation or reload errors
Here, validation succeeded but Certbot could not edit the configuration, Apache rejected a directive, or the daemon could not read a certificate or private key. Sudo-level privileges are required for configuration edits and reload operations.
#1 Best Overall
Renewal failures
Renewal is a separate operational test. A certificate can be valid and correctly installed while its scheduled renewal fails because DNS automation, firewall rules, permissions, authentication hooks, or reload hooks changed.
Use this order of operations
- Read the exact Certbot error. Classify it as validation, installation/reload, or renewal before changing files.
- Check every hostname in the request. Each name must resolve to the public endpoint that serves Apache. Check both A and AAAA records.
- Identify the challenge method. HTTP-01 requires public HTTP access on port 80. DNS-01 requires an authoritative TXT record beneath
_acme-challenge. - Test the challenge from outside the server. Use the exact hostname and path, not merely the site’s home page.
- Confirm Apache’s listener and virtual host. Verify
Listen 80, the intended*:80virtual host, and itsServerNameandServerAliasvalues. - Check file selection and permissions. On current Apache releases, the normal pair is
fullchain.pemandprivkey.pemfrom Certbot’s live directory. - Validate, reload, and then perform a dry-run renewal. Do not keep requesting certificates while the same DNS, routing, or permission error remains.
Check DNS before changing Apache
Let’s Encrypt connects to the address returned for each requested name. If a hostname points to an old server, a load balancer that does not forward the challenge path, or an IPv6 host with different configuration, Apache on the machine you are inspecting may never receive the request.
Verify A and AAAA records
Inspect the public DNS answer for every name, including aliases. For example:
dig +short A example.com
dig +short AAAA example.com
dig +short A www.example.com
dig +short AAAA www.example.comCompare the returned addresses with the public address, NAT rule, reverse proxy, or load balancer that is supposed to serve Apache. If an AAAA record leads to a different host, either configure that IPv6 endpoint identically or correct the record. Do not assume that success over IPv4 means validation will also succeed over IPv6.
Account for multiple validation vantage points
Let’s Encrypt can retrieve an HTTP-01 token from more than one network vantage point. A URL that works only from the Apache machine, your office network, or one preferred DNS resolver is not proof of public reachability. Test from an external network and check both address families.
Fix HTTP-01 challenge failures
For HTTP-01, Let’s Encrypt requests:
http://YOUR_DOMAIN/.well-known/acme-challenge/TOKENThe token is temporary. During validation, the response must contain the exact token content that Certbot created. Redirects and normal application routing are acceptable only when they preserve access to that path and ultimately return the expected content.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Interpret the status you receive
| Observed result | What it usually means | Where to investigate |
|---|---|---|
| 404 Not Found | The request reached a web server, but not the expected token. | Wrong virtual host, incorrect webroot, rewrite or application interception, missing token file, or unreadable permissions. |
| Connection refused | The destination was reachable but no service accepted the connection on port 80. | Apache listener, firewall, NAT, security group, provider policy, or an intervening proxy. |
| Timeout | The connection or response did not complete from the validator’s network. | Firewall filtering, missing port forwarding, routing, provider controls, or an unavailable IPv6 endpoint. |
| Unexpected content | A server answered, but another site or application handled the request. | DNS target, default virtual host, reverse proxy, rewrite rules, or load-balancer routing. |
Test the exact path
After starting the Certbot operation, request the exact challenge URL from an external host. If you have the token filename and value, verify that the response body is precisely that value rather than an HTML error page or application redirect. A generic request to https://example.com does not test HTTP-01.
curl -i http://example.com/.well-known/acme-challenge/TOKENCheck the HTTP status, the Location header, and the response body. Watch Apache’s access and error logs at the same time. The log entry identifies which virtual host handled the request and whether a rewrite, permission error, or upstream proxy intervened.
Confirm the webroot and token permissions
With a webroot authenticator, Certbot writes the token below the selected document root. The directory supplied to Certbot must be the document root for the hostname’s port-80 virtual host, not merely the directory used by its HTTPS virtual host. Confirm that:
- The
.well-known/acme-challengedirectory exists under the active document root. - The temporary token file is present while validation runs.
- Every parent directory permits traversal by the Apache process.
- The file is readable by Apache and is not blocked by access-control rules.
- No application framework, front-controller rule, or blanket deny rule captures the challenge path.
If your site redirects all HTTP traffic to HTTPS, keep the redirect for ordinary pages only if it leaves /.well-known/acme-challenge/ reachable and unchanged. A rewrite that sends the token to a login page, removes the path, or routes it to an application endpoint will produce a 404 or incorrect content.
Inspect the port-80 virtual host
Apache must listen publicly on port 80 and select the virtual host matching the requested name. A minimal HTTP virtual host needs the correct ServerName, any required ServerAlias, and the document root used by Certbot:
Listen 80
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/example
</VirtualHost>The exact layout differs by distribution, but the important facts are the listener, the address-and-port binding, and name matching. If the request lands in the first or default virtual host, the token may be looked up in the wrong directory and return 404.
Check firewalls, NAT, and proxies
Allow inbound TCP port 80 at every layer: host firewall, cloud security group, router or NAT, provider edge, reverse proxy, and load balancer. If a proxy terminates or forwards HTTP, it must pass the /.well-known/acme-challenge/ path to the Apache instance that owns the token. A port-80 rule that forwards to a different machine explains why local tests succeed while public validation fails.
Apache’s mod_md documentation also ties challenge selection to the ports Apache listens on and to explicit challenge settings. Review those settings if mod_md is handling acquisition or renewal alongside Certbot; a configuration that offers only an inaccessible listener cannot complete validation.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Use DNS-01 when HTTP cannot be exposed
DNS-01 proves control by publishing a TXT value at _acme-challenge. It does not require inbound HTTP to reach Apache, so it fits firewalled servers, private origins, and architectures where port 80 cannot be forwarded. It is also the challenge route documented here for wildcard certificates.
Publish the TXT record correctly
Use a Certbot DNS plugin or an authentication hook that can update the authoritative DNS service. The record name is normally _acme-challenge.example.com (or the corresponding name for a delegated zone). The value must match the active authorization exactly.
- Start the DNS-01 authorization and note the TXT value Certbot requests.
- Create the TXT record at the authoritative provider, preserving punctuation and capitalization as supplied.
- Wait for the authoritative nameservers to publish the value.
- Query the record from outside your local resolver and verify that the active value is present.
- Only after identifying the current authorization should you remove stale or conflicting TXT values.
Multiple TXT values can exist during parallel authorizations. Deleting records blindly can remove the value for an authorization that is still in progress. A missing, mistyped, stale, or not-yet-propagated TXT record produces the same practical result: Let’s Encrypt cannot verify control.
Understand wildcard scope
HTTP-01 is not the documented route for wildcard issuance. Use DNS-01 for names such as *.example.com, and remember that the base name example.com is a separate identifier unless it is also included in the certificate request.
Choose the right challenge method
| Factor | HTTP-01 | DNS-01 |
|---|---|---|
| Required control | Public HTTP reachability on port 80, with correct redirects and virtual-host routing. | Control of authoritative DNS and ability to publish a TXT record under _acme-challenge. |
| Wildcard certificates | Not the documented issuance route. | Supports wildcard certificates. |
| Best fit | Ordinary hostnames on a server that can expose port 80. | Wildcards, firewalled or private origins, and systems where HTTP cannot reach Apache. |
| Common failures | Wrong DNS, IPv6 mismatch, firewall or NAT, wrong virtual host, rewrite, incorrect webroot, timeout, refusal, or 404. | Missing, mistyped, stale, conflicting, or unpropagated TXT data. |
Configure Apache to use the correct Certbot files
Certbot maintains current certificate material as symlinks under:
/etc/letsencrypt/live/<domain>/Point Apache at that live directory rather than copying a dated file from an archive directory. The symlinks are updated when a certificate is renewed.
| Apache directive | Normal current file | Purpose |
|---|---|---|
SSLCertificateFile |
fullchain.pem |
Leaf certificate followed by the intermediate chain, as expected by Apache 2.4.8 and later. |
SSLCertificateKeyFile |
privkey.pem |
Private key corresponding to the certificate; keep it secret and readable only through controlled permissions. |
| Older Apache certificate configuration | cert.pem plus chain.pem |
Some older versions require the leaf and chain to be configured separately. |
A typical current configuration is:
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pemDo not expose privkey.pem. The Apache worker or parent process must be able to read it, but unrelated users should not. Check ownership, group membership, and mode settings after package upgrades, permission changes, or moving the configuration. A certificate error that appears only after renewal often means the new symlink target or key permissions differ from the old files.
Validate Apache and reload without making the outage worse
After correcting paths or virtual hosts, test configuration syntax before reloading:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo apachectl configtestSome distributions provide an equivalent command such as apache2ctl configtest. Continue only when the test reports a valid configuration. If it fails, read the referenced file and line number; common causes include a typo in a directive, an unavailable module, a broken symlink, or a path that the daemon cannot read.
Inspect the Apache error log for certificate parsing, key mismatch, permission, and virtual-host messages. Then perform a graceful reload using the service name on your operating system:
sudo systemctl reload apache2On systems that name the service httpd, use:
sudo systemctl reload httpdA graceful reload lets existing connections finish while workers adopt the new configuration. If the reload fails, restore the last known-good configuration, correct the reported error, run the syntax test again, and reload only after it passes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Prove that renewal will work
Run a renewal simulation after fixing the initial problem:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutesudo certbot renew --dry-runThis exercises the renewal configuration without replacing the production certificate. Review the renewal definitions in:
/etc/letsencrypt/renewal/and inspect Certbot’s logs in:
/var/log/letsencrypt/Check renewal-specific dependencies
- For HTTP-01, confirm that DNS, port 80, virtual-host routing, rewrites, and webroot permissions are still correct.
- For DNS-01, confirm that the plugin or authentication hook can still create and remove TXT records, and that credentials remain valid.
- Confirm that any deploy or post-renewal hook reloads Apache only after a successful certificate update.
- Verify that the Apache process can read the live symlink targets, including the private key.
- Check the timer or scheduled task that invokes Certbot and ensure it runs with the privileges required by the selected authenticator and installer.
Certificates created with Certbot’s manual plugin do not renew automatically unless authentication hooks are supplied. A manual issuance that succeeded once therefore needs an explicit automation plan before its validity period ends.
Common symptom-to-fix paths
“Connection refused” on port 80
Confirm that Apache has Listen 80, that the service is running, and that the public firewall, NAT, security group, and proxy all permit and forward TCP 80. Test the public address, not only localhost. If DNS has an AAAA record, test the IPv6 endpoint separately or correct the record.
“404 Not Found” for the challenge
Identify the virtual host in the access log, compare its document root with Certbot’s webroot, and inspect rewrites and access rules for /.well-known/acme-challenge/. Verify that the token file exists and is readable. A 404 proves that an HTTP server answered; it does not prove that the request reached the intended site.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHTTPS works, but validation still fails
HTTPS success tests port 443 and the TLS virtual host. HTTP-01 tests a separate port-80 request and path, which may use different DNS answers, a different virtual host, or a different backend. Test the exact HTTP challenge URL and all returned addresses.
Apache reports an invalid certificate or key
Check that SSLCertificateFile uses the certificate chain appropriate to your Apache version, that SSLCertificateKeyFile points to the matching privkey.pem, and that the daemon can traverse the live directory and read the key. Run the configuration test before reloading.
Renewal fails after a successful first issuance
Run the dry run, read the renewal file to see which authenticator and webroot are recorded, and inspect recent Certbot and Apache logs. Then verify DNS automation, hooks, scheduled-task permissions, and the reload command. Fix the underlying condition before another production attempt.
Retry safely and prevent repeat failures
Repeated certificate requests do not repair a broken challenge and can run into Let’s Encrypt rate limits. Correct DNS, routing, challenge content, or permissions first; use the dry-run renewal test whenever possible. Keep a written record of which names use HTTP-01 or DNS-01, which webroot or DNS zone is authoritative, and which hook reloads Apache.
Recommended Free Tools
Before any Apache or DNS change, capture the current virtual-host configuration, certificate paths, and renewal definition. After the change, test the exact challenge path externally, run apachectl configtest, reload gracefully, and perform certbot renew --dry-run. This sequence distinguishes an ACME reachability problem from a local Apache configuration problem and gives you a recoverable point if the reload fails.
The Bottom Line
Fix Let’s Encrypt errors by following the failed layer: make DNS and the exact HTTP-01 path publicly correct, or publish the required DNS-01 TXT record; then point Apache at the live fullchain.pem and privkey.pem, validate and reload safely, and confirm the complete process with certbot renew --dry-run.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
