Test validates but Request Fails

Question
1

Hi, I’m trying to request a new cert, I am doing the http-01 validation and when I run the test, it works I get: (domain.com and www.domain.com are not the actual entries, masked)

Application Pool: Configuration Override Enabled
Http Challenge Server process available.

Verified URL is accessible: http://domain.com/.well-known/acme-challenge/configcheck

Verified URL is accessible: http://www.domain.com/.well-known/acme-challenge/configcheck

But when I go to request, I get this message: (x.x.x.x below represents my IP)

Response from Certificate Authority: x.x.x.x: Fetching http://www.domain.com/.well-known/acme-challenge/XlFE8t1_WxxE35fANJKIZjhSildtOMjAW9q-BH3_9kY: Connection refused [BadRequest :: urn:ietf:params:acme:error:connection]

2

The app is managing to talk to the server it’s hosted on, but when the CA requests the same thing externally they are blocking by your firewall.

Currently the app “Test” mode accepts locally resolved http requests as valid but really it shouldn’t, because they are only half the story. We only keep it that way for legacy reasons.

HTTP domain validation means the CA (Let’s Encrypt) will check for a particular result from your server at http://<yourdomain>/.well-known/acme-challenge/<token>. If you block incoming HTTP, TCP port 80, either for all users or for specific countries etc, then you block the CA from validating your domain. HTTP Validation (http-01) | Certify The Web Docs

The alternative to http domain validation is dns validation:DNS Validation (dns-01) | Certify The Web Docs