How to Troubleshoot ACME HTTP-01 Challenge Failures in Nginx and Apache

How HTTP-01 validation works

With HTTP-01 validation, your ACME client places a temporary token under the .well-known/acme-challenge path. The certificate authority requests that URL over HTTP to confirm that you control the domain.

If DNS points somewhere else, port 80 is blocked, redirects are broken, or the webroot path is wrong, validation fails.

Check DNS first

Before editing Nginx or Apache, confirm the domain resolves to the server running the ACME client. DNS mistakes are one of the most common reasons validation fails.

Check both the root domain and www version. If IPv6 is enabled, confirm AAAA records also point to the correct server.

• Verify active nameservers.
• Check A records for root and www.
• Check AAAA records if IPv6 is published.
• Confirm CDN proxy behavior if Cloudflare or another CDN is enabled.

Confirm port 80 is reachable

HTTP-01 validation depends on HTTP reachability. Even if your website forces HTTPS, the CA must be able to reach the challenge path on port 80 unless your setup handles redirects correctly.

Check the server firewall, cloud firewall, hosting provider security groups, and any reverse proxy in front of the application.

Check redirects and rewrite rules

A redirect from HTTP to HTTPS is usually fine, but a redirect loop, redirect to another hostname, forced login page, or application-level rewrite can break ACME validation.

Make sure requests to /.well-known/acme-challenge/ are served as static files and are not intercepted by WordPress, Laravel, Next.js, or another application router.

Validate the webroot path

For webroot-based renewals, the ACME client must write the challenge file to the same document root that the public website serves.

A common mistake is running Certbot or another client with an old webroot after a site migration. The file is created, but the public URL points to a different folder.

• Create a test file under .well-known/acme-challenge.
• Open it from an external network.
• Confirm the file content matches.
• Remove the test file after validation.

Nginx-specific checks

In Nginx, verify the correct server block handles the domain. If multiple blocks match the same hostname, the challenge may be served from the wrong root.

Run a syntax test before reload. A failed reload can leave the old configuration active, which makes troubleshooting confusing.

Apache-specific checks

In Apache, check the VirtualHost for port 80, document root, aliases, and .htaccess rules. A restrictive .htaccess file can block challenge access.

If the site uses a CMS, make sure rewrite rules do not capture the ACME challenge path.

Conclusion

ACME HTTP-01 failures are usually not mysterious once you test the path like a public visitor. DNS, port 80, redirects, webroot paths, and virtual host matching should be checked before changing certificate providers.