Certbot failed to authenticate some domains (authenticator: webroot)

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: bap.a3a-architecture.fr

I ran this command: sudo certbot renew

It produced this output: Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: bap.a3a-architecture.fr
Type: connection
Detail: Fetching http://bap.a3a-architecture.fr/.well-known/acme-challenge/WiUT-yKr_mY_dnEARpjnqTsffTdyKeblqZ0lCMBXtEw: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Failed to renew certificate bap.a3a-architecture.fr with error: Some challenges have failed.

All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/bap.a3a-architecture.fr/fullchain.pem (failure)

My web server is (include version): Apache

The operating system my web server runs on is (include version): Monterey 12.6.8

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 2.2.0

Can you open your website?


Thanks for you reply, no i can't

1 Like

That you should correct. If you can't see your website, neither can the validation server.

This can depend on a lot of different things, most commonly: a wrong IP address in your DNS, or just a software crash on your machine, which stopped your webserver. A missing port forwarding if you host at home, etc etc.


So far there was no problem with Monterey 12.6.4 i have upgrade to 12.6.8 this morning and get this error.
a wrong IP address in your DNS,
i don't think so as nothing as change here
or just a software crash on your machine, which stopped your webserver,
nothing like that as far as i can see.
maybe the problem is around here
"All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/bap.a3a-architecture.fr/fullchain.pem (failure)"

how can i fix that, i'm a bit new on that letsencrypt subject and this error is beyond my skills but i'm ready to learn

Let's Encrypt verifies that your domain belongs to you by putting a specific file at this address: (inside that directory, anyway)


If Let's Encrypt cannot download that file, it cannot know that it's you yourself asking for a certificate.

Because it's extremely important that certificates not be issued to impostors, if Let's Encrypt cannot validate your request, it cannot issue a certificate.

To do so, your webserver needs to respond. It's not responding right now.


OK i understand how i can justify that we are asking a valid certificat for our domain. Is there a command line on terminal or something to do somewhere else ? Thanks a lot

No. There is an alternative if you cannot expose your server to the public internet. If it's supposed to be public, make it so. Http validation is easier.

You can use the dns-01 challenge instead of the http-01 you're trying to use. It's not as immediate to configure, as it depends on your domain nameservers and whoever hosts them.

There are several Certbot plugins for different DNS hosting companies. Your DNS looks like it's on ovh, so read here: Welcome to certbot-dns-ovh’s documentation! — certbot-dns-ovh 0 documentation


This server is expose to the public internet

Ok. Your firewall does not seem to agree.

You should check your firewall.


on the router the firewall is on recommended mode as usual and on the server it's not activate

You should have a port forwarding on ports 80 and 443. Is it there? Or does your server have a public IP to itself?


The server as an IP on our network not public and there is no port forwarding on 80 and 443. Will try to set them on the router right now

Port 80 and 443 are now redirected to the server

HTTP requests to your domain are now working (see Let's Debug test result).

Does the certbot request work now?


Yes it does u're great however the website is always unreachable

I can see the website. (A login form)


Ok it's on my laptop so, will try to fix that, anyway thank you very much for your help, you have save my day. Cheers


This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.