AutoSSL error: 403 urn:ietf:params:acme:error:unauthorized (The client lacks sufficient authorization) when using Cloudflare

Symptoms

The following error is returned when running AutoSSL:

“Let’s Encrypt™” HTTP DCV error (domain.tld): 403 urn:ietf:params:acme:error:unauthorized (The client lacks sufficient authorization) (203.0.113.2: Invalid response from http://domain.tld/.well-known/acme-challenge/DCV.txt: 403)

Please note "domain.tld" is used as an example for a domain name and "203.0.113.2" is used an example for a Cloudflare IP address.

Description

This occurs due to Cloudflare security settings blocking the HTTP DCV (Domain Control Validation) request that runs during AutoSSL.

Workaround

Configure Cloudflare security settings to allow access to files in /.well-known/acme-challenge/ or temporarily disable Cloudflare.

Additional Resources:

Cloudflare Web Application Firewall

How to disable the Cloudflare proxy for your domain

What is Domain Control Validation (DCV)?