Test server reachability for certificate renewal is ok but LetsEncrypt times out

[leolivier]

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes
• Are you sure you're not using someone else's docker image?
  • Yes
• Have you searched for similar issues (both open and closed)?
  • Yes (but it's hard and I might have missed it)

Describe the bug
I have a certificate for several subdomains of my domain and it's due for renewal in less than one month but it's not renewed. When I look in the docker logs, I see the renewal fails. When I look in the letsencrypt logs, I see there is a timeout

  "challenges": [
    {
      "type": "http-01",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall/2145812125/490610212766/LMXH2A",
      "status": "invalid",
      "validated": "2025-03-16T10:21:55Z",
      "error": {
        "type": "urn:ietf:params:acme:error:connection",
        "detail": "2001:861:281f:1db0:319a:c9fb:a28d:700f: Fetching https://mydomain.tld/.well-known/acme-challenge/pNedRN7tllaGBrfOAC9pJ31UsELMTmXxLkVXtQTX--E: Timeout during connect (likely firewall problem)",
        "status": 400
      },

But when I run the Test Server Reachability, everything works fine:

Other checks I did:

• To check there were no issue on the permission, on the network, on the firewall..., I created a brand new certificate for another subdomain and it worked!
• My existing subdomains are still reachable with the current version of the certificate, so NPM is running properly and forwards to the proxied containers
• I spied on the challenges directory and saw the challenge file appear during the process and disappear when it failed.
• The certificate is linked to 7 subdomains but I see only 3 of them failing with the timeout error (and again these 3 are working properly when you access them). The 4 other ones are validated by LetsEncrypt.

Nginx Proxy Manager Version
v2.12.3

Operating System
Docker on RPI5 (RPI OS up to date)

Additional context
I compared the xx.conf between some working and non working subdomains and found no difference except server name, port and log files

[leolivier]

The issue remains but I discovered that NPM could manage wildcards though APIs with my DNS provider so I created a wildcard cert and removed this one