# LetsEncrypt Acme Challenge error

**URL:** https://discourse.roots.io/t/letsencrypt-acme-challenge-error/6295
**Category:** trellis
**Created:** 2016-03-26T01:34:59Z
**Posts:** 40
**Showing post:** 27 of 40

## Post 27 by @fullyint — 2017-09-12T16:34:41Z

@Twansparant I don’t think you need to delete CSRs or certs. The other thread’s suggestion to do so was to deal with a problem fixed in Jan 2017. It appears your version of Trellis has the related fix, given your filename `example.dev-86aea94-bundled.cert` (cf. [this addition](https://github.com/roots/trellis/pull/630/files#diff-45d7ae8120ec1059a4c451f241544ba6R16)). In any case, you should be able to work with those files as the `admin` user by invoking `sudo`, e.g., `sudo ls -alh /etc/nginx/ssl/letsencrypt` using the [`admin_user`'s password](https://github.com/roots/trellis/blob/e7447ac0649786c6e37df8fc816a3cd19598a7db/group_vars/production/vault.yml#L7).

* * *

I don’t remember any reports of the `Test Acme Challenges` task ever taking longer than 5-15 seconds. That task corresponds to a step Trellis takes before asking the LE server to verify your domain (see SSL docs on [Challenges](https://roots.io/trellis/docs/ssl/#challenges)) :

```
5. LE client creates a "challenge" file in the web root of your site
here --> (Test Acme Challenges)
       6. LE server verifies it can access the challenge file
```

If that task is failing, it suggests that the Acme challenge file is not publicly accessible at one or more of your [`site_hosts`](https://github.com/roots/trellis/blob/e7447ac0649786c6e37df8fc816a3cd19598a7db/group_vars/production/wordpress_sites.yml#L7-L10). You can test the accessibility manually:

```
# should give a `200` response code
$ curl http://example.com/.well-known/acme-challenge/ping.txt -w "%{http_code}"
200%
```

:star: Try the command above for each canonical domain and each of your redirects, for sites with `ssl.enabled: true`. If any fails to give `200`, the challenge file is inaccessible. In that case, let’s check whether the domain is accessible

```
# if ssl enabled, http may give a `302` response (redirecting to https)
curl -kI http://example.com
```

:star: If the above doesn’t show a successful connection (`200` or `302` are examples of successful), ensure that you have [DNS setup](https://roots.io/trellis/docs/ssl/#dns-records) for the failing domains. I’d be surprised if for any domain the challenge `ping.txt` was inaccessible but the bare domain is accessible.

In some rare cases ([example](https://discourse.roots.io/t/what-is-the-letsencrypt-challenge-method/10293/8)), firewall/networking setup can interfere with Let’s Encrypt challenges.

If problems persist, you may want to post your `wordpress_sites` for review.

---

_[View the full topic](https://discourse.roots.io/t/letsencrypt-acme-challenge-error/6295)._