AutoSSL with Let's Encrypt fails: The server could not connect to a validation target

Symptoms

AutoSSL fails to get a new certificate for a domain, and you receive an error similar to the following.

CONFIG_TEXT: “Let’s Encrypt™” HTTP DCV error (domain.tld): 400 urn:ietf:params:acme:error:connection (The server could not connect to a validation target) (203.0.113.2  Fetching http://domain.tld/.well-known/acme-challenge/t7KGY62Dh5gaqB6Cz8XXVNJ2D2T4ucq_uGj_tR7CXj8: Connection reset by peer)
[2024-03-11T21:09:36Z]          Net::ACME2::X::HTTP::Network: The system failed to send an HTTP “POST” request to “https://acme-v02.api.letsencrypt.org/acme/chall-v3/325168804607/tYVNfw” because of an error: Timed out while waiting for socket to become ready for reading

Cause

The error occurs when the server is unable to reach TCP port 80 on the domain's public IP address, or it cannot contact Let's Encrypt's server on TCP port 443. For Let's Encrypt to issue a certificate, inbound and outbound TCP ports 80 and 443 must be open through all firewalls and applicable security devices.

Resolution

Open inbound and outbound TCP ports 80 and 443 through all firewalls and applicable security devices. 

Additional resources

What ports should I open in my network firewall?