Free tool
Why won't Let's Encrypt give me a certificate?
Certbot timing out, renewals suddenly failing, a CAA error you've never seen before? Enter the domain and how you validate, and we run the checks Let's Encrypt's own validation implies - then explain what's in the way.
How this works
- We look up the domain's public DNS records (A, AAAA, CAA, TXT), including the _acme-challenge name your ACME client uses.
- For HTTP-01 and TLS-ALPN-01 we briefly connect to the domain's server on port 80 or 443 - the same way Let's Encrypt would - and request a harmless test path.
- We count recent certificates in crt.sh, the public Certificate Transparency database, to estimate rate-limit usage.
- We don't store the domain or the result, and nothing is shared unless you copy the link.
Frequently asked questions
Why is my Let's Encrypt certificate not renewing?
The usual suspects: port 80 got blocked by a firewall since the last renewal, an AAAA (IPv6) record points at a server that doesn't answer, a CAA record at a parent domain forbids issuance, DNSSEC broke, or a stuck client hit the duplicate-certificate rate limit. Enter the domain above and we check each of these.
Does port 80 have to be open for Let's Encrypt?
For the HTTP-01 method, yes - the ACME standard only allows it on port 80, and there's no way to move it. Redirecting port 80 to HTTPS is fine, but the port must accept connections. If you can't open it, use DNS-01 (a TXT record) or TLS-ALPN-01 (port 443) instead.
Why does my site work in a browser but fail Let's Encrypt validation?
Two classics. First, Let's Encrypt prefers IPv6: if an AAAA record exists but points at the wrong place, they fail where your IPv4 browser succeeds. Second, they validate from at least four locations worldwide - a firewall that geo-blocks or rate-limits foreign traffic can serve you perfectly and still block them.
What are Let's Encrypt's rate limits?
The two that matter when troubleshooting: 50 certificates per registered domain per 7 days, and 5 certificates with the exact same set of names per 7 days. Since 2025 they refill continuously (about one slot every 3.5 hours, or 34 hours for duplicates) - there's no weekly reset. Renewals via ARI are exempt, and the staging environment has far higher limits for testing.