Let's Encrypt domain validation

The step where the certificate authority proves you control the name, by contacting the name. With the HTTP-01 challenge, Let's Encrypt fetches http://example.com/.well-known/acme-challenge/<token> from the internet, on port 80, at whatever address the A record hands out. So the order is fixed and does not reverse: point DNS at the server, confirm it with dig +short example.com A, then ask for the certificate. Ticking ISPConfig's Let's Encrypt SSL box before the record resolves fails, and the panel does not always surface the error: the reason sits in the ACME client's log on the server, not in the interface. Every name on the request is validated separately, so one stale www entry fails the whole certificate. Ticking the box again in a loop also spends the five failed validations allowed per hostname per hour — after which nothing works at all for an hour.