urn:ietf:params:acme:error:connection
The CA couldn't connect to validate the domain
Seen in certbot, acme.sh, Caddy, Traefik, cert-manager (Let's Encrypt and other ACME CAs)
The CA could not open a connection to your server to fetch the challenge, so validation failed.
Common causes
- Nothing is listening on port 80 (or 443 for TLS-ALPN-01), for example the web server is stopped while certbot uses --webroot.
- A firewall rejects or resets the connection, sometimes only for overseas IPs or by geo-blocking.
- DNS points at an IP that is not this server, often via a stale AAAA record.
How to fix it
- Make sure a web server answers on port 80 for the domain, or use certbot --standalone with port 80 free.
- Allow inbound port 80 from all IPs; validation comes from several regions.
- Check A and AAAA records point at this server.
Got a different message? Paste it into the error explainer.
Related errors
- Timeout during connect (likely firewall problem) · Let's Encrypt couldn't reach your server
- upstream timed out (110: Connection timed out) while reading response header from upstream · The backend took too long to respond
- connect() failed (111: Connection refused) while connecting to upstream · The backend is not listening
- connect() to 127.0.0.1:8080 failed (13: Permission denied) while connecting to upstream · nginx is not allowed to connect to the backend
- no live upstreams while connecting to upstream · Every backend server is marked as down
- upstream prematurely closed connection while reading response header from upstream · The backend closed the connection without answering
- SSL_do_handshake() failed while SSL handshaking to upstream · nginx couldn't complete TLS with the backend
- client intended to send too large body · An upload exceeded client_max_body_size
- bind() to 0.0.0.0:80 failed (98: Address already in use) · Another process already uses the port
- could not build server_names_hash, you should increase server_names_hash_bucket_size · A server_name is too long for the hash table
- AH00558: Could not reliably determine the server's fully qualified domain name · Apache has no global ServerName
- AH01630: client denied by server configuration · Apache access rules blocked the request