# Jitsi Let's Encrypt certificate failed: how to fix it

> Let's Encrypt needs your domain to resolve to the server and port 80 to be reachable from the internet at issuance and renewal time. Most Jitsi certificate failures are DNS that has not propagated, port 80 blocked in the cloud firewall, another web server holding port 80, or the weekly rate limit reached after repeated retries. Test with LETSENCRYPT_USE_STAGING=1 until it works.

Source: https://jitsi.help/troubleshooting/jitsi-lets-encrypt-failed/
Updated: September 26, 2026
Publisher: Jitsi Help (https://jitsi.help/)

Read the web container's log first:

```bash
docker compose logs --tail 200 web | grep -iE "letsencrypt|acme|certificate|error"
```

## 1. DNS does not point at the server yet

```bash
dig +short meet.example.com
curl -s https://checkip.amazonaws.com   # run on the server
```

Both must show the same public IP. If you just created the record, wait for it to propagate before retrying. Every failed attempt counts toward Let's Encrypt's limits.

If the domain is proxied through Cloudflare (orange cloud), set it to DNS only, or the challenge reaches Cloudflare instead of your server.

## 2. Port 80 is blocked

The HTTP challenge needs inbound 80/tcp from the internet. Check both layers:

- Server firewall: `sudo ufw allow 80/tcp`
- Cloud firewall or security group: an inbound rule for TCP 80 from anywhere.

Keep port 80 open permanently. Renewals use it too, and closing it after the first issuance is how certificates silently expire three months later.

## 3. Something else holds port 80 or 443

```bash
sudo ss -tlnp | grep -E ':80 |:443 '
```

If a host Nginx or Apache is listening, either stop it or run Jitsi behind it as a [reverse proxy](/guides/jitsi-lets-encrypt-ssl/).

## 4. The rate limit

Let's Encrypt limits duplicate certificates for the same names per week. Repeatedly recreating the stack while DNS or firewall is broken burns through it quickly. Switch to staging while you debug:

```ini
LETSENCRYPT_USE_STAGING=1
```

Remove the line once staging succeeds.

## 5. The settings are incomplete

All of these must be set and consistent:

```ini
ENABLE_LETSENCRYPT=1
LETSENCRYPT_DOMAIN=meet.example.com
LETSENCRYPT_EMAIL=you@example.com
PUBLIC_URL=https://meet.example.com
HTTP_PORT=80
HTTPS_PORT=443
```

`HTTP_PORT` and `HTTPS_PORT` must be 80 and 443 on the host for the built-in issuer to work.

## 6. Renewal stopped

If the certificate expired months after a successful setup, port 80 was closed, DNS changed, or the web container was not running when renewal was due. Fix the cause and restart the web container to trigger a new attempt.

## Avoid it entirely

On our [one-click platform](/jitsi-hosting/), DNS is verified before a certificate is requested and trusted SSL on your own domain is included free on every server.

## Frequently asked questions

### How do I know if I hit the Let's Encrypt rate limit?

The web container's log shows an error mentioning too many certificates or a rate limit. Stop retrying, switch to LETSENCRYPT_USE_STAGING=1 to fix the underlying problem, and request the real certificate again after the limit window passes.

### Why does my Jitsi site still show a self-signed certificate?

Issuance failed and the container fell back to its generated certificate. Check the web container logs for the Let's Encrypt error, fix DNS or port 80, and restart the web container.


---

Jitsi Help is an independent service. It is not affiliated with, endorsed by or sponsored by 8x8, Inc. or the Jitsi project. Jitsi and Jitsi Meet are trademarks of 8x8, Inc., used here only to describe the software we host and support.