Does StackRegent use HTTP or DNS validation for Let's Encrypt?

HTTP validation (HTTP-01) on port 80. Every website maps /.well-known/acme-challenge/ to a folder the panel controls, so validation works whatever the site runs.

Why was www left out of my certificate?

The panel only includes names that already resolve to the server. If www has no A record, or it points elsewhere, the task log lists it under left out. Fix the record and issue the certificate again.

Do I need port 80 open if all my sites use HTTPS?

Yes. Let's Encrypt validation and renewals use plain HTTP on port 80. The panel's HTTP-to-HTTPS redirect skips the validation path, so the redirect can stay on.

Let's Encrypt certificate fails to issue or renew

How validation works on StackRegent#

StackRegent uses the HTTP-01 challenge. When you click Get a free certificate, the panel places a token in a folder that every website maps at /.well-known/acme-challenge/, and Let's Encrypt fetches it from each name over plain HTTP on port 80. The HTTP-to-HTTPS redirect leaves that path alone. For mail.<domain>, which belongs to no website, a small panel-owned IIS site answers the challenge. Every failure comes down to Let's Encrypt not getting that token from this server.

The task log in Task Manager names the failing name and the reason. Read it first.

"None of the names points at this server yet"#

Before asking Let's Encrypt, the panel checks that each name resolves to this server and leaves out names that do not ("Left out (DNS does not point at this server)"). If none is left, the task stops with this message.

Fix: create or correct the A records, and wait for the old TTL to pass. If DNS was just moved to your name servers, the registrar's change may still be spreading. Check from the server with Resolve-DnsName www.example.com.

"could not be validated"#

Let's Encrypt reached a server but did not get the token. Check these in order:

IPv6. If the name has an AAAA record, Let's Encrypt tries IPv6 first. An AAAA record that points at another server, or at this server's IPv6 address with no website binding or firewall rule for it, fails validation even when IPv4 is fine. Fix or remove the AAAA record.
Port 80. Port 80 must be open from the internet, in any provider firewall too. Under Tools & Settings › Firewall, the Websites service must be Everyone, not Only these addresses, and Panic mode must be off. Test from outside with curl -I http://www.example.com/.well-known/acme-challenge/test: a 404 from IIS is fine, a timeout is not.
A proxy or CDN in front. If the name goes through a CDN or proxy, it must pass /.well-known/acme-challenge/ through to this server over HTTP, or you must pause the proxy while issuing.
The website itself. A stopped website, hosting switched off in the plan or a suspended subscription cannot answer. Check the subscription's status and that the site opens over HTTP.
CAA records. If the domain has CAA records, one of them must allow letsencrypt.org, for example 0 issue "letsencrypt.org".

Rate limits#

Let's Encrypt limits how many certificates you may request for the same names in a period, and how many failed validations are allowed. After repeated failures, wait before trying again. For tests, tick the staging CA option in the Let's Encrypt section of Tools & Settings › SSL/TLS Certificates; staging certificates are not trusted by browsers, so switch back before the real request.

Other causes#

No outbound HTTPS. The panel must reach the Let's Encrypt API over HTTPS. Check that outbound traffic is not blocked.
The clock. A server clock that is far off breaks TLS and signed requests. Check Tools & Settings › System Time and keep NTP on.
SSL/TLS support off. If SSL/TLS support is off in the website's Hosting Settings, switch it on first.
Wildcards. Wildcard Let's Encrypt certificates are not available yet, because they need DNS validation.
The panel certificate. For the panel, the message "set the server host name first" means Full host name in Server Settings is empty, and "does not point at this server" means its A record is wrong.

Renewal failed#

Certificates renew 30 days before they expire, so a failed renewal leaves time to fix it. The SSL/TLS certificate renewal failed notification and the SSL/TLS certificates widget on Home tell you which. The causes are the same as above, most often a domain whose DNS has moved elsewhere. If the customer moved the site away, remove the certificate or the domain.

The step-by-step for issuing is in issue a Let's Encrypt certificate; the security chapter covers the server's certificate pool.