# Let's Encrypt fails HTTP-01 validation for app.example.com. Which URL must be reachable from the internet?

cert-manager, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/lets-encrypt-fails-http-01-validation-for-appexamplecom-which-url-must-be-reachable-from-the-internet

- A. http://app.example.com/.well-known/acme-challenge/<token> on port 80
- B. https://app.example.com/.well-known/acme-challenge/<token> on port 443
- C. http://app.example.com:8089/acme/<token>
- D. https://acme.cert-manager.io/app.example.com/<token>

**Answer:** http://app.example.com/.well-known/acme-challenge/<token> on port 80

**Explanation:** The ACME server fetches the token over plain HTTP on port 80. It follows redirects, but the first request must reach port 80. cert-manager runs a solver pod, which listens on 8089 inside the cluster, and routes that path to it through a temporary Ingress or HTTPRoute. If a firewall blocks port 80, or the Ingress controller sends that path somewhere else, validation fails. DNS-01 avoids this.