Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →When Let’s Encrypt fails on a VPS, the usual cause is not HTTPS itself. The certificate authority must prove control of every domain in your order, and it does that by reaching a specific HTTP token or finding a specific DNS record. A site that loads normally in a browser can still fail validation if port 80, an AAAA record, a firewall rule, a virtual-host route, or DNS propagation sends the validation request somewhere else.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Start by checking every requested hostname, then test the challenge path from outside the VPS. Use HTTP-01 when the public service can answer on port 80; use DNS-01 when port 80 is blocked, the service is private, or you need a wildcard certificate. Test changes against Let’s Encrypt’s staging environment until the path works, then issue the production certificate and verify unattended renewal.
As an Amazon Associate I earn from qualifying purchases.
What Let’s Encrypt is actually checking
Let’s Encrypt does not issue a certificate merely because https://your-domain.example opens in your browser. It validates control of each identifier in the certificate request. An order containing both example.com and www.example.com has two names to validate; one working name does not compensate for a failing one.
With HTTP-01, an ACME client creates a token file at /.well-known/acme-challenge/<TOKEN>. Let’s Encrypt fetches that file over ordinary HTTP. The challenge can only be performed on TCP port 80. Redirects are allowed, but Let’s Encrypt follows no more than ten and they must lead to HTTP or HTTPS on port 80 or 443. A redirect to a custom port, an authentication page, a loop, or the wrong virtual host causes the authorization to fail.
With DNS-01, the client proves control by publishing a TXT value at _acme-challenge.<domain>. This method does not require an HTTP listener and is the only method that can validate wildcard names such as *.example.com.
“The HTTP-01 challenge can only be done on port 80.” — Let’s Encrypt documentation, Challenge Types, updated February 12, 2026.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
“This challenge asks you to prove that you control the DNS for your domain name by putting a specific value in a TXT record under that domain name.” — Let’s Encrypt documentation, Challenge Types, updated February 12, 2026.
1. Confirm the names and where DNS sends them
Write down every identifier in the failed order before changing Certbot. Include the apex name, each www or application subdomain, and any wildcard or alternate name. Validation is per identifier, so troubleshoot them separately.
Check A and AAAA records
For each name, inspect both its IPv4 (A) and IPv6 (AAAA) records. An unexpected AAAA record is a frequent VPS failure: Let’s Encrypt may reach an IPv6 address belonging to an old server while your browser uses IPv4 and reaches the correct one. Remove the stale record, correct it, or make the IPv6 host serve the same challenge before retrying.
Use an external DNS checker or commands such as:
dig +short A example.com
dig +short AAAA example.com
dig +short A www.example.com
dig +short AAAA www.example.comRun the checks from a network that is not the VPS itself when possible. Local resolver caches can hide an incorrect public record.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Verify the authoritative DNS zone
Make sure the records are being edited at the authoritative provider for the domain. A delegated subdomain, a recently changed nameserver set, or a DNS service in front of the VPS can mean that you are editing one zone while Let’s Encrypt queries another. If a proxy or CDN is enabled, confirm that it forwards /.well-known/acme-challenge/ to the intended origin and does not replace the response with a login page, bot check, or cached error.
2. Prove HTTP-01 reachability from outside
HTTP-01 is the normal choice for a public website when port 80 can reach the server. Test the exact path rather than only loading the home page.
Create a harmless test token
Place a plain text file in the directory your web server exposes at /.well-known/acme-challenge/, for example:
mkdir -p /var/www/html/.well-known/acme-challenge
printf 'acme-path-test' | sudo tee /var/www/html/.well-known/acme-challenge/test-fileFrom an external network, request http://example.com/.well-known/acme-challenge/test-file. The response should be a successful plain-text response containing exactly acme-path-test. A 404, 403, redirect loop, HTML page, login form, or content from a different server identifies the layer that still needs correction. Delete the test file after troubleshooting.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsOpen every required network layer
Permit inbound TCP 80 in all of the places traffic can be blocked:
- The VPS provider’s cloud firewall or security group.
- The operating system firewall, such as a host-level packet filter.
- A router or NAT device, if the VPS is behind one.
- A reverse proxy, load balancer, or CDN in front of the VPS.
Also keep inbound TCP 443 available for users after issuance. The ACME client needs outbound access to contact the ACME service and, for ordinary HTTPS operation, clients need to reach 443.
Check listeners and virtual hosts
Confirm that something is listening on port 80 and that the request is handled by the virtual host for the requested name, not a default site. A useful socket check is:
sudo ss -ltnp | grep ':80'If the response shows another site, update the server’s host-name matching and challenge location. In a multi-node deployment, every node that DNS or a load balancer can select must have the challenge file. A file written to one machine is not enough if the next validation request lands on another.
Free tools Windows power users keep installed
One-click scans. No signup required.
Inspect redirects and middleware
Let’s Encrypt may follow up to ten redirects, but the chain must end on port 80 or 443. A redirect from port 80 to HTTPS on 443 is valid. A redirect to an application port such as 8080 is not. Disable or bypass rules that add authentication, rewrite the challenge path, require a session cookie, or redirect repeatedly. Test with:
curl -i http://example.com/.well-known/acme-challenge/test-file
curl -iL --max-redirs 10 http://example.com/.well-known/acme-challenge/test-fileUse the headers and final body to determine whether the request reached the intended server. A successful home-page request does not prove that this special path is routed correctly.
3. Select a Certbot mode that matches the deployment
Certbot’s mode must match who owns port 80 and how your web server serves files.
| Mode | How validation is served | When it fits | Important limitation |
|---|---|---|---|
| Webroot or web-server integration | Certbot writes a token into an existing document root or configures the web server to answer it. | A web server is already running and can serve the challenge path. | The document root and virtual-host mapping must be correct for every name. |
| Standalone | Certbot starts a temporary listener on port 80. | No web server is serving port 80, or you can stop it briefly. | Another process cannot own port 80 during validation. |
| DNS plugin | Certbot creates the required TXT record through a DNS provider API. | Port 80 is unavailable, the service is private, or a wildcard is needed. | API credentials and the authoritative DNS zone must be correct. |
| Manual | You copy the HTTP or DNS challenge material yourself. | One-off validation or an environment without a supported integration. | Manual mode does not renew unattended unless you add suitable hooks. |
When standalone fails to bind
certbot --standalone must bind TCP 80. If a web server, container, monitoring agent, or another Certbot process already owns that socket, Certbot cannot start. Stop the conflicting service temporarily, use a pre-hook and post-hook to stop and restart it, or choose webroot/server integration instead. Do not leave the production web server stopped longer than necessary.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →When webroot returns the wrong file
Webroot validation succeeds only if Certbot writes into the directory that the matching virtual host exposes publicly. A common mistake is selecting an application’s source directory while the web server serves a compiled or different directory. Use the external test-file method above and inspect the server configuration until the written token is returned verbatim.
4. Use DNS-01 when HTTP-01 is the wrong tool
Choose DNS-01 when inbound port 80 cannot be opened, the service is internal, traffic is intentionally not public, or you require a wildcard certificate. The proof is independent of the web server.
Publish the exact TXT value
The ACME client supplies a value that must be placed at _acme-challenge.example.com (or the corresponding name for a subdomain). Copy the value exactly. Do not add quotation marks to the value itself, and do not put it at the ordinary website hostname.
Query the public record before allowing validation:
dig TXT _acme-challenge.example.comWait until authoritative nameservers return the new value. Recursive resolver caches and the zone’s TTL can delay visibility. If multiple TXT values exist because several authorizations are active, keep all currently required values until the client reports success; remove stale entries afterward when they are no longer needed.
Avoid oversized or stale DNS responses
Old TXT records, duplicated values, or an incorrect zone can produce a response that is too large or does not contain the value Let’s Encrypt requested. Check the authoritative nameservers directly and remove obsolete records. If your provider offers an API, use a supported Certbot DNS plugin or another ACME client integration so renewals can update records automatically. Manual TXT entry is not unattended automation unless you build and maintain renewal hooks.
5. Debug safely with staging and respect authorization limits
Repeated production attempts consume a limited failure budget. Let’s Encrypt documents a limit of five authorization failures per identifier per account per hour, refilling at one authorization every 12 minutes. Fix DNS, routing, or listener problems before trying production again.
Configure Certbot or your ACME client to use Let’s Encrypt’s staging environment while testing. Staging certificates are not trusted for normal visitors, but they let you verify that names resolve correctly, challenge files are reachable, and DNS automation works without spending the production allowance. Once a complete staging run succeeds, switch to the production endpoint, request the certificate once, and record the resulting configuration.
6. Renewal and post-issuance checks
Issuance is only half the job. A certificate can be valid today and still fail renewal because a firewall rule, DNS token method, or server route changes later.
Run a renewal test in the same environment
Use the ACME client’s renewal test command against the same webroot, standalone hooks, or DNS plugin configuration that production renewal will use. A successful dry run should demonstrate both validation and deployment, not just creation of a temporary certificate.
Reload the service that presents the certificate
After renewal, verify that the web server or reverse proxy reloads the new certificate. Check the certificate presented on port 443 and confirm its names and expiration date. If the files changed on disk but the service was not reloaded, visitors may continue to receive the old certificate.
Protect configuration and avoid concurrent runs
Keep Certbot configuration, work, and log directories readable only by accounts that need them, especially when DNS API credentials are stored. Schedule one renewal job and avoid launching overlapping Certbot processes; simultaneous runs can collide on lock files or modify the same account data.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failure symptoms and the most likely fix
| Symptom | Likely cause | What to check first |
|---|---|---|
| Connection timed out on HTTP-01 | Port 80 blocked, wrong NAT, or unreachable address. | Provider firewall, host firewall, router rule, A and AAAA records, and an external curl request. |
| Challenge returns a 404 | Wrong document root or virtual host. | The exact /.well-known/acme-challenge/ path and the directory Certbot writes. |
| Challenge returns a login page or 403 | Authentication or access middleware intercepts the path. | Bypass authentication and permit the challenge directory. |
| Redirect error | Loop or redirect to a nonstandard port. | Follow the chain with curl -iL; end on port 80 or 443 within ten hops. |
| Works on IPv4 but fails unpredictably | AAAA points to a different or unconfigured host. | Test IPv4 and IPv6 separately and correct the AAAA record or configure IPv6. |
| Standalone cannot start | Another process owns port 80. | ss -ltnp, then stop the service or use webroot integration. |
| DNS-01 says TXT not found | Wrong zone, propagation delay, or a typo in the record name/value. | Query authoritative nameservers for _acme-challenge and compare the value exactly. |
| Wildcard request fails with HTTP-01 | HTTP-01 cannot issue wildcard certificates. | Use DNS-01 with automated DNS updates. |
| Renewal succeeds but users see the old certificate | The service was not reloaded or the wrong certificate path is configured. | Inspect the live certificate on port 443 and the reload hook. |
Should you close port 80?
Let’s Encrypt recommends that general-purpose web servers offer both HTTP on port 80 and HTTPS on port 443. Keep port 80 open when you use HTTP-01 and redirect ordinary HTTP requests to HTTPS. Closing port 80 does not provide meaningful protection against an active man-in-the-middle; an attacker who can intercept traffic can interfere with HTTPS connections as well. If policy or architecture forbids port 80, use DNS-01 rather than repeatedly trying to force HTTP-01 through a blocked path.
“Our recommendation is that all servers meant for general web use should offer both HTTP on port 80 and HTTPS on port 443.” — Let’s Encrypt, Best Practice: Keep Port 80 Open, January 24, 2019.
A repeatable recovery checklist
- List every domain name in the order, including apex,
www, subdomains, and wildcards. - Resolve A and AAAA records from outside the VPS and confirm every address reaches a machine configured for the challenge.
- Choose HTTP-01 or DNS-01 based on the service’s network constraints and whether a wildcard is required.
- For HTTP-01, open TCP 80 through the provider firewall, host firewall, NAT, and proxy; serve a test file from the exact challenge path.
- For DNS-01, publish the exact TXT value at
_acme-challenge, query authoritative DNS, and wait for visibility. - Match Certbot mode to the listener: webroot/server integration for an existing web server, standalone only when Certbot can bind port 80, and a DNS plugin when DNS supplies the proof.
- Use staging while correcting failures and stop before the five-failures-per-identifier-per-account-per-hour limit is reached.
- Issue the production certificate only after a complete staging validation succeeds.
- Run a renewal test, confirm the service reloads the certificate, and keep only one scheduled renewal process.
Frequently Asked Questions
Can Let’s Encrypt issue a certificate if my site is HTTPS-only and port 80 is closed?
Yes, use DNS-01. HTTP-01 requires port 80, while DNS-01 validates a TXT record and works without an HTTP listener.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhy does the homepage load while Certbot still fails?
The homepage tests only the route your browser uses. Let’s Encrypt requests a token under /.well-known/acme-challenge/ for every name, and that path may be blocked, routed to another virtual host, or sent to a different IPv6 server.
Is manual DNS validation suitable for automatic renewal?
Not by itself. Manual TXT updates require human intervention each time unless you add reliable renewal hooks; a DNS provider API plugin is the usual unattended approach.
How long should I wait after adding a DNS-01 TXT record?
Wait until authoritative nameservers return the exact value. The actual delay depends on DNS TTLs and provider propagation, so verify with authoritative queries rather than relying only on a local resolver.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
