Let's Encrypt renewal fails with HTTP-01 connection timeouts

Virtualmin
1
SYSTEM INFORMATION
OS type and version Ubuntu Linux 24.04.4
Webmin version 2.651
Virtualmin version 8.1.0
Webserver version Apache version 2.4.58

I have had this setup and running almost 2 years now. The auto update from march worked fine, but starting yesterday I am getting timeout error emails.

An error occurred requesting a new certificate for eddiesworldthegame.com, www.eddiesworldthegame.com, mail.eddiesworldthegame.com, webmail.eddiesworldthegame.com, gitea.eddiesworldthegame.com, autoconfig.eddiesworldthegame.com, autodiscover.eddiesworldthegame.com from Let's Encrypt : Web-based validation failed : <pre>Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for eddiesworldthegame.com and 6 more domains

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
  Domain: autoconfig.eddiesworldthegame.com
  Type:   connection
  Detail: 216.218.92.108: Fetching http://autoconfig.eddiesworldthegame.com/.well-known/acme-challenge/tUmc7Tm7NTlbVh7eJJEm06jjbfcSW1fJyNjmIVC6GFY: Timeout during connect (likely firewall problem)

  Domain: autodiscover.eddiesworldthegame.com
  Type:   connection
  Detail: 216.218.92.108: Fetching http://autodiscover.eddiesworldthegame.com/.well-known/acme-challenge/MZ8sFbdN7lHjGlv7RUjuHodG069s-7Rq-oHZ3DM-bxM: Timeout during connect (likely firewall problem)

  Domain: eddiesworldthegame.com
  Type:   connection
  Detail: 216.218.92.108: Fetching http://eddiesworldthegame.com/.well-known/acme-challenge/2atl4tPjVsVDZfSHwMF1086_qy1TGQftTFT9p43doQI: Timeout during connect (likely firewall problem)

  Domain: gitea.eddiesworldthegame.com
  Type:   connection
  Detail: 216.218.92.108: Fetching http://gitea.eddiesworldthegame.com/.well-known/acme-challenge/gp5J5wwSyN-7cDGYSRQYEq8-53bYJRzdzXZknRXPFqU: Timeout during connect (likely firewall problem)

  Domain: mail.eddiesworldthegame.com
  Type:   connection
  Detail: 216.218.92.108: Fetching http://mail.eddiesworldthegame.com/.well-known/acme-challenge/btLOpZkOyR50FdyLz9TkbIPHk56hWUIZGbKx82M3emQ: Timeout during connect (likely firewall problem)

  Domain: webmail.eddiesworldthegame.com
  Type:   connection
  Detail: 216.218.92.108: Fetching http://webmail.eddiesworldthegame.com/.well-known/acme-challenge/P69ZgYFa3CprzmtKYz9zX5tZ3xZMhFOdWjwWHDSGhC8: Timeout during connect (likely firewall problem)

  Domain: www.eddiesworldthegame.com
  Type:   connection
  Detail: 216.218.92.108: Fetching http://www.eddiesworldthegame.com/.well-known/acme-challenge/o9K1yJXsylaEvoW-MebgmWfgOvnBZPrxitF0BeHe2bY: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
</pre>
This is what I pulled from the log file 
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

2026-07-02 07:32:52,619:DEBUG:certbot._internal.error_handler:Encountered exception:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 108, in handle_authorizations
    self._poll_authorizations(authzrs, max_retries, max_time_mins, best_effort)
  File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 212, in _poll_authorizations
    raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.


It appears to be creating the folders properly and it cleans them up as well.


after the cleanup entries, this is the end of the log.

Traceback (most recent call last):
  File "/bin/letsencrypt", line 33, in <module>
    sys.exit(load_entry_point('certbot==2.9.0', 'console_scripts', 'certbot')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/main.py", line 19, in main
    return internal_main.main(cli_args)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1894, in main
    return config.func(config, plugins)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 1600, in certonly
    lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 131, in _get_and_save_cert
    renewal.renew_cert(config, domains, le_client, lineage)
  File "/usr/lib/python3/dist-packages/certbot/_internal/renewal.py", line 399, in renew_cert
    new_cert, new_chain, new_key, _ = le_client.obtain_certificate(domains, new_key)
                                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 428, in obtain_certificate
    orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/client.py", line 496, in _get_order_and_authorizations
    authzr = self.auth_handler.handle_authorizations(orderr, self.config, best_effort)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 108, in handle_authorizations
    self._poll_authorizations(authzrs, max_retries, max_time_mins, best_effort)
  File "/usr/lib/python3/dist-packages/certbot/_internal/auth_handler.py", line 212, in _poll_authorizations
    raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.
2026-07-02 07:32:52,627:ERROR:certbot._internal.log:Some challenges have failed.

FYI, I created a folder called .test-folder for EddiesWorldTheGame and the webserver indeed serves up that web page.

Any help someone could offer will be very appreciated!

Thank you.

If anyone has any ideas how to troubleshoot this, I’d appreciate it.

2

The latest version works fine for me

image
image1366Ă—472 34.6 KB

3

I just checked the files that get created in the “.well-known” folder. The .htaccess file has the proper domain ownership but the challenge files are all owned by root. Is this correct?

4

Nevermind!
In my laziness to stop these script kiddies, I was blocking entire subnets in my firewall settings.
Once I cleared those, the certs went right thru.
The answer was right in the error message.

5

Yes, that is correct. Webmin runs Certbot as root, so the temporary challenge files Certbot creates can be owned by root. That should not cause this error as long as the files are readable and the .well-known/acme-challenge path is accessible.

Your log shows Timeout during connect, which happens before Apache can even serve or deny the challenge file. If this were permission-related, Let’s Encrypt would usually report a 403, 404, or invalid response, not a connection timeout.

Check firewall/IDS/Fail2Ban/geoblocking or anything else that could block Let’s Encrypt validation requests to TCP port 80 from some networks.