# Certbot can't give certificate **URL:** \ **Category:** Help\ **Created:** [April 20, 2025, 11:13pm UTC](https://community.letsencrypt.org/t/certbot-cant-give-certificate/236537 "2025-04-20T23:13:39Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![domsdroid](https://avatars.discourse-cdn.com/v4/letter/d/7c8e57/32.png) [@domsdroid](https://community.letsencrypt.org/u/domsdroid)\ **Post date:** [April 20, 2025, 11:13pm UTC](https://community.letsencrypt.org/t/certbot-cant-give-certificate/236537/1 "2025-04-20T23:13:39Z")
[\e]0;\u@\h: \w\a][\033[;32m]┌──([\033[1;34m]\u㉿\h[\033[;32m])-[[\033[0;1m]\w[\033[;32m]]\n[\033[;32m]└─[\033[1;34m]$[\033[0m] sudo certbot certonly --standalone Saving debug log to /var/log/letsencrypt/letsencrypt.log Please enter the domain name(s) you would like on your certificate (comma and/or space separated) (Enter 'c' to cancel): , [delta9inc.org](http://delta9inc.org) Requesting a certificate for [delta9inc.org](http://delta9inc.org) Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems: Domain: [delta9inc.org](http://delta9inc.org) Type: connection Detail: 143.198.63.60: Fetching [http://delta9inc.org/.well-known/acme-challenge/SHFizhFBPUpNTUtOnZDexbWuvk1Nf2sIsmmYcxSiXwQ:](http://delta9inc.org/.well-known/acme-challenge/SHFizhFBPUpNTUtOnZDexbWuvk1Nf2sIsmmYcxSiXwQ:) Connection refused Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet. Some challenges have failed. Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. [\e]0;\u@\h: \w\a][\033[;32m]┌──([\033[1;34m]\u㉿\h[\033[;32m])-[[\033[0;1m]\w[\033[;32m]]\n[\033[;32m]└─[\033[1;34m]$[\033[0m] ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [April 20, 2025, 11:21pm UTC](https://community.letsencrypt.org/t/certbot-cant-give-certificate/236537/2 "2025-04-20T23:21:09Z")
Hello @domsdroid, The [HTTP-01 challenge](https://letsencrypt.org/docs/challenge-types/#http-01-challenge) states "The HTTP-01 challenge can only be done on port 80." [Best Practice - Keep Port 80 Open](https://letsencrypt.org/docs/allow-port-80/) A few online utilities demonstrate that the server is not accessible via Port 80 from the Public Facing Internet. [https://letsdebug.net/delta9inc.org/2425000](https://letsdebug.net/delta9inc.org/2425000) ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/0/0/00740b34bf045873a03cc1ac4b27bb234c844411.png) [https://check-host.net/check-http?host=http://delta9inc.org](https://check-host.net/check-http?host=http://delta9inc.org) gets "Connection refused" ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/6/c/6ccb7160f43ec2e56d36f7d5cb2e338db717336b.png) Please check your firewall(s) and/or router. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 20, 2025, 11:22pm UTC](https://community.letsencrypt.org/t/certbot-cant-give-certificate/236537/3 "2025-04-20T23:22:43Z")
The --standalone method is difficult to debug because you need to keep Certbot running to test connection from the public internet. Probably the easiest way to test is with these command options: ```nohighlight sudo certbot certonly --standalone --dry-run --debug-challenges -v -d (domain) ``` This command will show you the challenge URL to try from the public internet and the proper response. After showing you this it will say "Press Enter to Continue". DO NOT PRESS ENTER. Leave it paused and use a different device to test connection. You can use a mobile phone with wifi disabled to use your carrier's network. You do not have to use the full URL. Just try `http://(domain)` If the connection works this shorter URL should see a response like below. I am pretty sure you will get a timeout error instead just like Let's Encrypt did. Repeat this as needed as you modify your firewall and comms setup until it works. ```nohighlight ACME client standalone challenge solver ``` ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [April 20, 2025, 11:29pm UTC](https://community.letsencrypt.org/t/certbot-cant-give-certificate/236537/4 "2025-04-20T23:29:55Z")
> **Supplemental note: there are some DNS issues as well** > > - [https://zonemaster.net/en/result/5ace22af50c98827](https://zonemaster.net/en/result/5ace22af50c98827) > - [https://ednscomp.isc.org/ednscomp/e5461450bd](https://ednscomp.isc.org/ednscomp/e5461450bd) > - [https://www.hardenize.com/report/delta9inc.org/1745191434#domain\_dns\_zone](https://www.hardenize.com/report/delta9inc.org/1745191434#domain_dns_zone) > - Here [DNS Spy report for delta9inc.org](https://dnsspy.io/scan/delta9inc.org) there are no Name Server Records > ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/f/5/f50ad22e52782b028a2788c770e063e0001dbb73.png) ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [May 20, 2025, 11:30pm UTC](https://community.letsencrypt.org/t/certbot-cant-give-certificate/236537/5 "2025-05-20T23:30:29Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.