Fix ACME Challenge Failed (Certificate Won't Generate) on Coolify

Error: unable to obtain ACME certificate for domains "your-domain.com": unable to generate a certificate for the domains [your-domain.com]: error: one or more domains had a problem: [your-domain.com] acme: error presenting token / authorization failed

Traefik asked Let's Encrypt for a certificate but the HTTP-01 / TLS-ALPN-01 challenge could not be validated, so no cert is issued and the site falls back to Traefik's self-signed default cert.

Let's Encrypt must reach your server to validate the domain (port 80 for the HTTP-01 challenge, port 443 for TLS-ALPN-01). On Coolify the challenge most often fails because (a) port 80/443 is firewalled or not reachable from the internet, (b) the domain has an AAAA (IPv6) record but the server has no working IPv6 or port 80/443 isn't open on IPv6, so Let's Encrypt's IPv6 attempt fails even though IPv4 works, or (c) the domain is proxied through Cloudflare (orange cloud), which intercepts the HTTP/TLS-ALPN challenge. The official Coolify docs name all three of these, plus rate limiting (429) and WAF blocking (403) as secondary causes.

The fix

1. Confirm what the domain resolves to over both IPv4 and IPv6. If an AAAA record exists, Let's Encrypt will also try IPv6, and both A and AAAA targets must be able to serve the challenge.

   dig +short A your-domain.com; dig +short AAAA your-domain.com

2. If an AAAA record exists and the server has no working IPv6 (or port 80/443 isn't open on IPv6), the cleanest fix is to delete the AAAA record at your DNS provider so Let's Encrypt validates over IPv4, then wait for the TTL to expire. (Coolify docs: 'both IPv4 (A record) and IPv6 (AAAA record) must be able to serve the challenge file correctly' — or remove the AAAA record.)

3. Verify port 80 is open to the internet and reaches Traefik. From an outside machine, hitting a real ACME path returns 404 from Traefik (expected) rather than timing out — a timeout or connection refused means port 80 is blocked.

   curl -sS -o /dev/null -w '%{http_code}\n' http://your-domain.com/.well-known/acme-challenge/test

4. Open the firewall if needed (ports 80 and 443). Adjust for your firewall — this example is ufw.

   sudo ufw allow 80/tcp && sudo ufw allow 443/tcp && sudo ufw reload

5. If the domain is proxied through Cloudflare (orange cloud), the proxy breaks the HTTP/TLS-ALPN challenge. Set the DNS record to DNS-only (grey cloud) so Let's Encrypt can validate directly, OR switch Coolify to a DNS-01 challenge instead. (Coolify docs: 'you must either use a DNS challenge or stop proxying your domain through the third-party service'.)

6. If the cert still won't issue, clear the stored ACME state so any cached failure is dropped. Delete acme.json on the Coolify server.

   rm /data/coolify/proxy/acme.json

7. Restart the proxy from the Coolify UI (Server > Proxy > Restart), then redeploy the application so a fresh cert is requested. Watch the proxy logs for a successful certificate-obtained line.

   docker logs coolify-proxy --tail 100 -f

Verify it worked

Reload the site over HTTPS and confirm the issuer is Let's Encrypt (e.g. 'R10'/'R11'/'E5'), not the self-signed 'TRAEFIK DEFAULT CERT'.

echo | openssl s_client -connect your-domain.com:443 -servername your-domain.com 2>/dev/null | openssl x509 -noout -issuer

Related Coolify errors

• NET::ERR_CERT_AUTHORITY_INVALID
• TRAEFIK DEFAULT CERT / self-signed certificate
• acme: error: 429 :: POST :: too many certificates already issued for exact set of domains, retry after ...
• ERR_TOO_MANY_REDIRECTS — This page isn't working. your-domain.com redirected you too many times.

Have Emsden Studio fix it for you — from A$149

All Coolify deploy errors