Certbot: Timeout during connect (likely firewall problem)

What the message looks like

Certbot failed to authenticate some domains (authenticator: nginx).
Domain: example.com
Type:   connection
Detail: 203.0.113.10: Fetching http://example.com/.well-known/acme-challenge/hkQ3...: Timeout during connect (likely firewall problem)

Common causes

• A firewall or cloud security group blocks incoming port 80.
• The DNS record points to a wrong or old IP address.
• The domain has an AAAA record, but the server is not reachable over IPv6. Let's Encrypt prefers IPv6.
• The server sits behind NAT and port 80 is not forwarded.
• A CDN or proxy in front does not pass the challenge path.

Check

1. Which addresses does the domain have?
   dig +short A example.com; dig +short AAAA example.comCopy
2. Is port 80 reachable from outside? (run from another machine)
   curl -I http://example.com/.well-known/acme-challenge/testCopy
3. Is anything listening on port 80 here?
   ss -ltnp | grep ':80 'Copy
4. What does the firewall allow?
   ufw status verboseCopy

Fix

• Open port 80, also in the cloud provider's security group: ufw allow 80/tcp.
• Fix the A record, or remove an AAAA record that does not work, or make the server answer on IPv6.
• Forward port 80 on the router if the server is behind NAT.
• If port 80 cannot be opened, use the DNS challenge instead: certbot certonly --manual --preferred-challenges dns -d example.com.
• Then renew: certbot renew --dry-run to check without using up the rate limit.

FAQ

Does port 443 matter for this error?

No. The HTTP challenge always uses port 80, even if the site runs on 443 only. Keep port 80 open and redirect it to https.

Why does it only fail for some domains?

Often one of them has a broken AAAA record. Check each domain with dig AAAA.