certbot renew fails / Let's Encrypt HTTP-01 challenge failing ('Timeout during connect', 'Connection refused', 'Invalid response'): how do I fix renewal?

Cause: with the HTTP-01 challenge, Let's Encrypt fetches a token over plain HTTP on port 80 from several network locations. Renewals fail when that request cannot reach the right server: port 80 blocked by a firewall, security group or ISP; DNS pointing at a different host (or an IPv6 AAAA record pointing somewhere that is not serving); a redirect that leaves ports 80/443; a web server rule that blocks the challenge path; or multiple servers where only some hold the token. Failures that repeat can also trigger rate limits. Fix (best first): 1. Run certbot renew --dry-run to reproduce safely. It uses the Let's Encrypt staging server, so it does not use up production limits. Add -v or --debug and read the log in /var/log/letsencrypt (default). 2. Make sure port 80 is reachable from the internet for every name on the certificate. Check firewall, cloud security groups and any load balancer. Check both A and AAAA records. 3. Redirects are fine if they go to http or https on ports 80 or 443 (up to 10 are followed), but do not redirect the challenge to a different port or a login page. 4. If several web servers answer for the name, make the challenge token available on all of them, or use the DNS-01 challenge instead. Wildcard certificates cannot use HTTP-01 at all. 5. If your server holds port 80, use the webroot or the nginx/apache plugin rather than standalone, or stop and start the server with --pre-hook and --post-hook. 6. Confirm renewals are scheduled: look for certbot renew in cron or systemctl list-timers. Use --deploy-hook to reload your server only after a successful renewal. 7. After fixing, stop retrying production issuance in a loop: Let's Encrypt limits repeated failed validations (5 failures per identifier per account per hour). Verify: certbot renew --dry-run reports all simulated renewals succeeded, and certbot certificates shows a later expiry after the real renewal. Sources: https://letsencrypt.org/docs/challenge-types/ https://eff-certbot.readthedocs.io/en/stable/using.html https://letsencrypt.org/docs/rate-limits/