# Again trouble with renewing certificate (http-01 challenge) **URL:** \ **Category:** Help\ **Created:** [March 8, 2026, 9:08pm UTC](https://community.letsencrypt.org/t/again-trouble-with-renewing-certificate-http-01-challenge/245780 "2026-03-08T21:08:38Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![schymans](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schymans/32/54691_2.png) [@schymans](https://community.letsencrypt.org/u/schymans)\ **Post date:** [March 8, 2026, 9:08pm UTC](https://community.letsencrypt.org/t/again-trouble-with-renewing-certificate-http-01-challenge/245780/1 "2026-03-08T21:08:38Z")
My certificate renewal started failing again at http-01 challenge, no clue how to fix it. I installed nextcloud and set up certbot years ago using instructions here: [How to Install NextCloud on Debian 10](https://www.howtoforge.com/tutorial/how-to-install-nextcloud-on-debian-10) Unfortunately, I don't know how to change the challenge type, so I tried to open port 80 on my fritzbox and in the firewall (ufw), but the error is still the same. I would prefer not to open port 80. Can anyone point me to instructions how to trouble shoot? Thanks! My domain is: www.schymanski.eu I ran this command: sudo certbot renew -v It produced this output: ... http-01 challenge for www.schymanski.eu Waiting for verification... Challenge failed for domain www.schymanski.eu http-01 challenge for www.schymanski.eu Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems: Domain: www.schymanski.eu Type: connection Detail: 94.252.21.148: Fetching [http://www.schymanski.eu/.well-known/acme-challenge/fDPRnhsWmZc9-1S76ZwQmLjVIyvCyjzmUWsqXkU8YO4:](http://www.schymanski.eu/.well-known/acme-challenge/fDPRnhsWmZc9-1S76ZwQmLjVIyvCyjzmUWsqXkU8YO4:) Error getting validation data ... My web server is (include version): Server version: Apache/2.4.66 (Debian) Server built: 2025-12-05T18:54:44 The operating system my web server runs on is (include version): Debian GNU/Linux 12 (bookworm) My hosting provider, if applicable, is: self-hosting I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 2.1.0 ---
**Author:** ![MaxHearnden](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maxhearnden/32/87555_2.png) [@MaxHearnden](https://community.letsencrypt.org/u/MaxHearnden)\ **Post date:** [March 8, 2026, 9:12pm UTC](https://community.letsencrypt.org/t/again-trouble-with-renewing-certificate-http-01-challenge/245780/2 "2026-03-08T21:12:16Z")
I'm getting ICMP type 3 (destination unreachable) code 13 (communication administratively filtered) responses when fetching the challenge over HTTP (TCP port 80), do you have a firewall that could block this connection? ---
**Author:** ![schymans](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schymans/32/54691_2.png) [@schymans](https://community.letsencrypt.org/u/schymans)\ **Post date:** [March 9, 2026, 7:06am UTC](https://community.letsencrypt.org/t/again-trouble-with-renewing-certificate-http-01-challenge/245780/3 "2026-03-09T07:06:18Z")
Thanks for checking! I don't understand what is going on, as I opened port 80 in the firewall, and now, just to double-check, I disabled the firewall for a little while, but the error remained the same. My Fritzbox does not show a green light beside the http-server port forwarding, only the https (port 443), so there could be a problem with port 80, but I don't know how to fix it either securely, or even insecurely. Is there a way to force certbot to only use port 443 or to open a special port for certbot to update certificates? ---
**Author:** ![MaxHearnden](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maxhearnden/32/87555_2.png) [@MaxHearnden](https://community.letsencrypt.org/u/MaxHearnden)\ **Post date:** [March 9, 2026, 11:08am UTC](https://community.letsencrypt.org/t/again-trouble-with-renewing-certificate-http-01-challenge/245780/4 "2026-03-09T11:08:15Z")
HTTP-01 must use port 80 (or port 443 when redirected to HTTPS from HTTP), there's no way to change this, however other challenges might be more suitable. There's the TLS-ALPN-01 challenge however this requires support from your web server ([mod\_md - Apache HTTP Server Version 2.5](https://httpd.apache.org/docs/trunk/mod/mod_md.html)). There's also DNS-01 which requires being able to modify TXT records at `_acme-challenge.`. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [April 8, 2026, 11:08am UTC](https://community.letsencrypt.org/t/again-trouble-with-renewing-certificate-http-01-challenge/245780/5 "2026-04-08T11:08:51Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.