What the message looks like
Type: unauthorized Detail: 2001:db8::10: Invalid response from http://beispiel.de/.well-known/acme-challenge/kX3v9...: 404Common causes
- An AAAA record points to an IPv6 address where no vhost or the wrong one answers – Let's Encrypt prefers IPv6.
- DNS still points to the old server (migration, high TTL).
- Rewrite or redirect rules (Nextcloud, WordPress, forced HTTPS to another host) catch the path.
- Wrong
--webrootpath, so the file is not where nginx serves it. - A CDN, proxy or firewall blocks port 80.
Check
- Check A and AAAA records
dig +short A example.com; dig +short AAAA example.com - Test the challenge path over IPv6
curl -6 -sI http://example.com/.well-known/acme-challenge/test - Is nginx listening on IPv6 port 80?
nginx -T 2>/dev/null | grep -E 'listen .*\[::\]:80' - Test issuance without hitting rate limits
certbot certonly --dry-run --webroot -w /var/www/letsencrypt -d example.com
Fix
- Add
listen [::]:80;to the HTTP vhost, or delete a wrong AAAA record. - Serve the challenge path before any redirect:
location ^~ /.well-known/acme-challenge/ { root /var/www/letsencrypt; }. - Lower the TTL before a migration and request the certificate only after the switch.
- If port 80 is not reachable, switch to the DNS-01 challenge (e.g. a certbot DNS plugin).
FAQ
Why does it work in my browser but not for Let's Encrypt?
Your browser may use IPv4 or a cache. Let's Encrypt queries over IPv6 as soon as an AAAA record exists, and validates from several locations.
How many failed attempts are allowed?
Let's Encrypt allows 5 failed validations per account, hostname and hour. Test with --dry-run against staging first.