# Cannot Request a new Certificate **URL:** \ **Category:** Help\ **Created:** [August 8, 2025, 8:10pm UTC](https://community.letsencrypt.org/t/cannot-request-a-new-certificate/240204 "2025-08-08T20:10:23Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![r0bc94](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/r0bc94/32/88522_2.png) [@r0bc94](https://community.letsencrypt.org/u/r0bc94)\ **Post date:** [August 8, 2025, 8:10pm UTC](https://community.letsencrypt.org/t/cannot-request-a-new-certificate/240204/1 "2025-08-08T20:10:23Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [robertcloud.feste-ip.net](http://robertcloud.feste-ip.net) I ran this command: certbot certonly --webroot -w /var/www/certbot/ -v It produced this output: Performing the following challenges: http-01 challenge for [robertcloud.feste-ip.net](http://robertcloud.feste-ip.net) Using the webroot path /var/www/certbot for all unmatched domains. Waiting for verification... Challenge failed for domain [robertcloud.feste-ip.net](http://robertcloud.feste-ip.net) http-01 challenge for [robertcloud.feste-ip.net](http://robertcloud.feste-ip.net) Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems: Domain: [robertcloud.feste-ip.net](http://robertcloud.feste-ip.net) Type: unauthorized Detail: The key authorization file from the server did not match this challenge. Expected "7shbryYZ0Cic\_RamcwQFlPXsmp78cY11yKR3935N6\_o.GY0cug5atrBBWQn2zhifaJnhgrxXIWLFFWLuBtVevvY" (got "7shbryYZ0Cic\_RamcwQFlPXsmp78cY11yKR3935N6\_o.oBNd5smO5vYJ4JXg-7VH8ZPOOgURgOqPb-Ffq1bGeKA") Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet. Cleaning up challenges Some challenges have failed. Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. My web server is (include version): nginx/1.27.2 The operating system my web server runs on is (include version): Nginx is running in a docker Container on debian 12 My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 4.2.0 ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [August 8, 2025, 8:21pm UTC](https://community.letsencrypt.org/t/cannot-request-a-new-certificate/240204/2 "2025-08-08T20:21:25Z")
Welcome @r0bc94 I don't think HTTP requests are reaching your nginx server. Instead, a server identifying as "[Feste-IP.net](http://Feste-IP.net)" replies. Here is an example HTTP Challenge request which replies with a 200 OK but should get a 404 Not Found as you wouldn't know about this record. Note how similar the response is to the one that Let's Encrypt reports in the failure message ```nohighlight curl -i http://robertcloud.feste-ip.net/.well-known/acme-challenge/Test404 HTTP/1.1 200 OK Server: Feste-IP.Net Test404.oBNd5smO5vYJ4JXg-7VH8ZPOOgURgOqPb-Ffq1bGeKA ``` Check the routing config to ensure HTTP challenge requests reach your nginx container. Check the nginx access logs to confirm it sees them (or does not). ---
**Author:** ![r0bc94](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/r0bc94/32/88522_2.png) [@r0bc94](https://community.letsencrypt.org/u/r0bc94)\ **Post date:** [August 9, 2025, 12:30pm UTC](https://community.letsencrypt.org/t/cannot-request-a-new-certificate/240204/3 "2025-08-09T12:30:48Z")
Hi @MikeMcQ , thank you for your reply. [feste-ip.net](http://feste-ip.net) is a mapping service since I only have a public ipv6 address and a natted ipv4. So requests coming from ipv4 only hosts are mapped to ipv6 by this servcie. I supposed that they changed something because in the past, they where transparent to the acme challenge. I guess I need to ask the named service if they changed something in regards to acme challenges. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [September 8, 2025, 12:31pm UTC](https://community.letsencrypt.org/t/cannot-request-a-new-certificate/240204/4 "2025-09-08T12:31:33Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.