Fix Let's Encrypt renewal fails: unauthorized error

Start here: 30-second fix

This works 80% of the time. Your web server isn't serving the ACME challenge file on port 80. Let's Encrypt needs to access /.well-known/acme-challenge/ over HTTP.

Check port 80 is open
Run this from a remote machine (not the server itself):
```
nc -zv yourdomain.com 80
```
If you see "Connection refused" or timeouts, your firewall or cloud security group is blocking it.
Quick certbot retry
Stop interfering services, then run:
```
sudo certbot renew --dry-run
```
If that fails, move to the moderate fix.

Don't bother with complex ACME configuration yet. 9 times out of 10, the issue is just port 80 being blocked.

Moderate fix: 5 minutes

Still failing? The problem is usually one of three things. Check them in this order.

1. DNS propagation delay

If you recently changed your DNS or moved hosts, wait 5-10 minutes. Then verify:

dig +short yourdomain.com @8.8.8.8

Make sure it resolves to your server's IP. If it's pointing elsewhere, fix your DNS records first.

2. Firewall or security group

On AWS EC2, check the security group inbound rules. Must allow HTTP (80) from 0.0.0.0/0. On Azure, check NSG rules. On-premises? Check iptables:

sudo iptables -L -n | grep :80

If you see DROP or REJECT, add:

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

3. Web server config blocking the challenge path

Your Apache or Nginx might be blocking /.well-known/ with a rewrite rule. For Apache:

RewriteEngine On
RewriteRule ^/.well-known - [L]

Put that before any other rules. For Nginx:

location ^~ /.well-known/acme-challenge/ {
    default_type text/plain;
}

Then restart: sudo systemctl reload nginx or sudo systemctl reload apache2.

If none of that worked, move to the advanced fix.

Advanced fix: 15+ minutes

Okay, you've checked port 80, DNS, and firewall. Still getting unauthorized errors? Time to dig deeper.

1. Stale ACME account or rate limit

Let's Encrypt has a 5 failed attempts per account per hour rate limit. If you kept retrying, you might be blocked. Check your account status:

sudo certbot certificates

If you see old certificates that expired, remove them:

sudo certbot delete --cert-name oldcert.example.com

Then wait 10 minutes before retrying.

2. Manual renewal with --manual flag

Sometimes certbot's auto-detection fails. Force manual mode:

sudo certbot certonly --manual --preferred-challenges http -d yourdomain.com

It will ask you to create a file at /.well-known/acme-challenge/<token>. Do it manually. Then hit Enter. This proves the issue is not your server, but certbot's automation.

3. Check for reverse proxy interference

If you're behind a reverse proxy (like HAProxy, Nginx, or Cloudflare), the ACME challenge might not reach the actual server. For Cloudflare, turn off proxy (orange cloud) temporarily. For HAProxy, make sure port 80 forwards to the correct backend. Test with:

curl -I http://yourdomain.com/.well-known/acme-challenge/test

Expect a 404 or 200, not 301 or 403.

4. Logs tell the truth

Check certbot's logs:

sudo cat /var/log/letsencrypt/letsencrypt.log | tail -50

Look for lines like Challenge failed for domain yourdomain.com. It often says exactly what file it couldn't fetch. Then check your web server logs for the same request:

sudo tail -f /var/log/nginx/access.log | grep acme

If you see the request hitting the server but returning a 403, your permissions are wrong. The web server user must be able to read /var/www/html/.well-known/.

5. Last resort: use DNS-01 challenge

If your firewall absolutely cannot open port 80 (maybe corporate policy), use DNS validation. It requires a DNS API key from your provider. For Cloudflare:

sudo certbot certonly --manual --preferred-challenges dns -d yourdomain.com

It will give you a TXT record to add. Wait 2-3 minutes for propagation, then press Enter. This bypasses port 80 entirely.

Quick summary

Symptom	Fix
Connection refused on port 80	Open firewall or security group
DNS points to wrong IP	Update DNS records
301 redirect on challenge file	Fix rewrite rules
Rate limited	Delete old certs, wait 10 min
Behind Cloudflare proxy	Turn off proxy temporarily

Most people fix this in under 5 minutes by just opening port 80. Don't overthink it. Start there.