My domain is: theorganicstore.com.ar
I ran this command: We are using an acme client in a PHP script that requests certificates for several domains. I'm using theorganicstore.com.ar as an example, but the issue happens with others domains too.
It produced this output: The response we're getting when trying to solve the challenges is:
{
"identifier":{
"type":"dns",
"value":"theorganicstore.com.ar"
},
"status":"invalid",
"expires":"2019-01-22T20:16:49Z",
"challenges":[
{
"type":"tls-sni-01",
[...]
},
{
"type":"dns-01",
[...]
},
{
"type":"http-01", // This is the challenge we're aiming to solve
"status":"invalid",
"error":{
"type":"urn:acme:error:connection",
"detail":"Fetching http://theorganicstore.com.ar/.well-known/acme-challenge/4YL3podIpvjMBxCt4b3rNunDpVyOopwWaCAZ_QBZN88: Timeout during connect (likely firewall problem)",
"status":400
},
"uri":"https://acme-v01.api.letsencrypt.org/acme/challenge/myCaqTZqqxR4GPQjkg3d4vN0GMx1lWPc5rpnx8c7Odk/11502104564",
"token":"4YL3podIpvjMBxCt4b3rNunDpVyOopwWaCAZ_QBZN88",
"validationRecord":[
{
"url":"http://theorganicstore.com.ar/.well-known/acme-challenge/4YL3podIpvjMBxCt4b3rNunDpVyOopwWaCAZ_QBZN88",
"hostname":"theorganicstore.com.ar",
"port":"80",
"addressesResolved":[
"52.200.197.31"
],
"addressUsed":"52.200.197.31"
}
]
},
{
"type":"tls-alpn-01",
[...]
}
],
"combinations":[
[2], [1], [3], [0]
]
}
My web server is: nginx/1.14.0, hosted on AWS.
The operating system my web server runs on is: Ubuntu 14.04.4 LTS
I can login to a root shell on my machine: yes
The important part of the output is this:
Fetching http://theorganicstore.com.ar/.well-known/acme-challenge/4YL3podIpvjMBxCt4b3rNunDpVyOopwWaCAZ_QBZN88: Timeout during connect (likely firewall problem)
We're trying to understand why this happens. This is what we've observed during our research:
- Accessing http://theorganicstore.com.ar/.well-known/acme-challenge/4YL3podIpvjMBxCt4b3rNunDpVyOopwWaCAZ_QBZN88 works fine, and returns the expected answer.
- The DNS is properly configured. An "A" record pointing to 52.200.197.31, and no IPv6 record.
- The request never reaches our nginx logs (this is the weirdest) and we don't have anything between our DNSs and the nginx. Our servers are in AWS.
- The error is not permanent. After retrying once or twice, the certificate is issued without problems.
I would really appreciate some help to know more about the request made by LE, the response received, and why it fails randomly 
Thanks in advance!
If anything like that is happening, might be on the AWS side. Iāll double check that in the AWS console. Thank you for your help!