400 Response during ACME verification?

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: filelake.xyz

I ran this command: Not applicable, Apache MD module

It produced this output:
[Sun Oct 18 11:14:19.709481 2026] [md:error] [pid 283234:tid 283237] ACME server authz: challenge 'invalid' for filelake.xyz at https://acme-v02.api.letsencrypt.org/acme/authz/3172849161/801865826307. Exact response was: {"identifier":{"type":"dns","value":"filelake.xyz"},"status":"invalid","expires":"2026-10-25T09:14:18Z","challenges":[{"type":"http-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/3172849161/801865826307/uu04yw","status":"invalid","validated":"2026-10-18T09:14:18Z","error":{"type":"urn:ietf:params:acme:error:connection","detail":"213.93.220.118: Fetching http://filelake.xyz/.well-known/acme-challenge/M1u_ioZC9kEAwNLGroZuGkweSgKc9Hli0uTXYuW5ZM8: Error getting validation data","status":400},"token":"M1u_ioZC9kEAwNLGroZuGkweSgKc9Hli0uTXYuW5ZM8","validationRecord":[{"url":"http://filelake.xyz/.well-known/acme-challenge/M1u_ioZC9kEAwNLGroZuGkweSgKc9Hli0uTXYuW5ZM8","hostname":"filelake.xyz","port":"80","addressesResolved":["213.93.220.118"],"addressUsed":"213.93.220.118"}]}]}
[Sun Oct 18 11:14:19.709754 2026] [md:error] [pid 283234:tid 283237] (22)Invalid argument: md[filelake.xyz] while[Monitoring challenge status for filelake.xyz] detail[domain authorization for filelake.xyz failed, CA considers answer to challenge invalid.]
[Sun Oct 18 11:14:19.710763 2026] [md:error] [pid 283234:tid 283237] (22)Invalid argument: AH10056: processing filelake.xyz: Error waiting on domain names to be validated

My web server is (include version): Apache 2.4.68:2::gentoo

The operating system my web server runs on is (include version): Gentoo Linux

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Same as Apache

My certificate is failing to renew with this error. It seems like my web server is issuing a status 400 code to Let's Encrypt? I am not sure why this could be, it's not a 404 so I'm guessing the ACME challenge response is being created correctly.

2

I think this is more likely a connection problem to your server. Right now I cannot reach your domain from the public internet. HTTP requests on port 80 fail as to HTTPS requests on port 443. I tried with various tools from various locations and nothing connected.

See:

3

I'm sorry, there is now also an unrelated outage concerning my ISP. These are usually resolved within a few hours at most.

4

Alright. Post back when it is resolved and we can look into it further.

5

It would seem the ISP issue has been resolved, I hope the internet stays working for now.

6

Yes, now it looks very much like you have a Palo Alto brand firewall blocking HTTP Challenge requests. We don't see these much any more but used to see this a lot. Do you have such a firewall? If so make sure to enable the "acme-protocol" in your Palo Alto application settings.

Why do I say this?

Because this works as expected with a 404 reply from an Apache server

curl -i http://filelake.xyz/.well-known/acme-challenge/Test404 

HTTP/1.1 404 Not Found
Date: Sun, 18 Oct 2026 14:41:13 GMT
Server: Apache

But, this fails with an empty reply and no server response header. Note it is the same request but with a user-agent like Let's Encrypt uses. Something is specifically blocking these. An empty reply will cause a 400 error

curl -i http://filelake.xyz/.well-known/acme-challenge/Test404 -A "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"

curl: (52) Empty reply from server
7

Ah, I see the problem! I have mod_security installed to block automated AI scrapers et cetera, it seems the word "compatible" in the user agent set it off. I'll amend the configuration and try again.

8

Yup, tested and it now works like a dream. Thank you very much!

9

You are very welcome. I also see proper responses from Let's Encrypt production and staging.

The Let's Debug test still fails but modifying your rules for that is optional. Let's Debug runs two connection tests. One from its own server using its own user-agent and another using the Let's Encrypt Staging system. The staging test succeeds but its own fails b/c of the user-agent (probably).

It's user agent is:

Mozilla/5.0 (compatible; Let's Debug emulating Let's Encrypt validation server; +https://letsdebug.net)

The request it uses is: GET /.well-known/acme-challenge/letsdebug-test

It's a handy testing tool and is a little confusing to see the failure reported. You have to enable Verbose mode and then notice the difference between the two tests. As I noted, it is optional it just might be handy to have working for future debugs.