Error while creating Let's encrypt certificates

[spiceuser-hq9]

Hi Everyone,

We keep encountering the following error when attempting to create a Let’s Encrypt certificate on Sophos firewall as well as using win acme, and we’re not entirely sure what the root cause might be.

The error message is:

"type": "urn:ietf:params:acme:error:connection",
"detail": "During secondary validation: 0.0.0.0 Fetching http://web.domain.com/.well-known/acme-challenge/2465GDAAQQJJDHHDGSSW: Timeout during connect (likely firewall problem)",
"status": 400

From what we can see, the path mentioned in the error (.well-known/acme-challenge/...) does exist. We’re unsure whether anything specific needs to be configured on the server side to allow Let’s Encrypt to fetch the URL successfully.

Should this path be created manually, or is there another step we might be missing? Could this be related to firewall or network restrictions?

Any guidance would be greatly appreciated.

[somedude2]

400 is an unusual error, Bad Request means the server did not understand something
“400 response is typically due to malformed request syntax, invalid request message framing, or deceptive request routing”

Is the path available via https://…?

[spiceuser-hq9]

Yes, all our websites are public, so they are using HTTPS but I am not sure which path were you refering to as the websites are accessable just fine but the part .well-known/acme-challenge/… doesn’t exist so I am not sure if a specific permission should be granted for the Let’s encrypt to verify the website and create the certificate

[somedude2]

I am looking at your error message above, it is fetching via http

[techcreeb]

Hi Spiceuser-hp9

It looks like Let’s Encrypt is trying to validate your domain via HTTP (port 80), but the validation request is either being blocked or timing out—as the error indicates a problem fetching http://web.domain.com/.well-known/acme-challenge/.... This is commonly caused by one of the following:

Things to Check:

• Port 80 Accessibility: Even if your site is accessible over HTTPS, Let’s Encrypt still needs HTTP access for the challenge unless you’re using DNS or TLS validation. Make sure:
  • Port 80 is open and accessible externally (no firewall blocks).
  • Any NAT or port forwarding is configured properly to reach the web server.
• Well-Known Directory: Some tools (like Win-ACME) create the .well-known/acme-challenge path dynamically during the challenge. You don’t usually have to create it manually—but your web server must serve it correctly during verification.
• Firewall/Web Filter (Sophos): Sophos may be intercepting or blocking requests. Try temporarily disabling any web filtering features or examining the logs for blocked requests.

Quick Fix Tip:
Run a test by placing a simple .txt file in /.well-known/acme-challenge/ and accessing it via http://yourdomain.com/.well-known/acme-challenge/test.txt from an external network. If it fails, your firewall or reverse proxy settings might be the culprit.