Jitsi Let's Encrypt certificate failed: how to fix it

Read the web container’s log first:

docker compose logs --tail 200 web | grep -iE "letsencrypt|acme|certificate|error"

1. DNS does not point at the server yet

dig +short meet.example.com
curl -s https://checkip.amazonaws.com   # run on the server

Both must show the same public IP. If you just created the record, wait for it to propagate before retrying. Every failed attempt counts toward Let’s Encrypt’s limits.

If the domain is proxied through Cloudflare (orange cloud), set it to DNS only, or the challenge reaches Cloudflare instead of your server.

2. Port 80 is blocked

The HTTP challenge needs inbound 80/tcp from the internet. Check both layers:

• Server firewall: sudo ufw allow 80/tcp
• Cloud firewall or security group: an inbound rule for TCP 80 from anywhere.

Keep port 80 open permanently. Renewals use it too, and closing it after the first issuance is how certificates silently expire three months later.

3. Something else holds port 80 or 443

sudo ss -tlnp | grep -E ':80 |:443 '

If a host Nginx or Apache is listening, either stop it or run Jitsi behind it as a reverse proxy.

4. The rate limit

Let’s Encrypt limits duplicate certificates for the same names per week. Repeatedly recreating the stack while DNS or firewall is broken burns through it quickly. Switch to staging while you debug:

LETSENCRYPT_USE_STAGING=1

Remove the line once staging succeeds.

5. The settings are incomplete

All of these must be set and consistent:

ENABLE_LETSENCRYPT=1
LETSENCRYPT_DOMAIN=meet.example.com
LETSENCRYPT_EMAIL=you@example.com
PUBLIC_URL=https://meet.example.com
HTTP_PORT=80
HTTPS_PORT=443

HTTP_PORT and HTTPS_PORT must be 80 and 443 on the host for the built-in issuer to work.

6. Renewal stopped

If the certificate expired months after a successful setup, port 80 was closed, DNS changed, or the web container was not running when renewal was due. Fix the cause and restart the web container to trigger a new attempt.

Avoid it entirely

On our one-click platform, DNS is verified before a certificate is requested and trusted SSL on your own domain is included free on every server.