# Can't generate a certificate for Haproxy with Let's Encrypt with acme.sh

**URL:** <https://discourse.haproxy.org/t/cant-generate-a-certificate-for-haproxy-with-lets-encrypt-with-acme-sh/12780>\
**Category:** Help!\
**Created:** [October 30, 2026, 10:31am UTC](https://discourse.haproxy.org/t/cant-generate-a-certificate-for-haproxy-with-lets-encrypt-with-acme-sh/12780 "2026-10-30T10:31:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![yannick.savoye](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/yannick.savoye/32/2633_2.png) [@yannick.savoye](https://discourse.haproxy.org/u/yannick.savoye)\
**Post date:** [October 30, 2026, 10:31am UTC](https://discourse.haproxy.org/t/cant-generate-a-certificate-for-haproxy-with-lets-encrypt-with-acme-sh/12780/1 "2026-10-30T10:31:38Z")

</div>

Hello,  
I am implementing an audio server at home (Navidrome).  
In order to use it remotely, I created my domain name at DuckDNS ([savoye.duckdns.org](http://savoye.duckdns.org)), then I installed Haproxy as a reverse proxy.  
I also installed an acme client (acme.sh from Github) to get a certificate from Let’s Encrypt to communicate in https.  
To complete these tasks, I have followed line by line the tutorial [Automate HAProxy Let’s Encrypt certificates with acme.sh](https://www.haproxy.com/blog/haproxy-and-let-s-encrypt)

Everything was fine until i attempted to generate the certificate with acme.sh from Let’s Encrypt  
After several tries where i discovered I need to open the port 80 in my internet router (Let’s Encrypt recommendation), I am reaching a blocking point with an error message inside the (see below)

[savoye.duckdns.org](http://savoye.duckdns.org): Invalid status. Verification error details: 176.147.60.50: Error reading HTTP response body: reader size limit exceeded

I ask a question at Let’s Encrypt forum.  
After several exchanges, my contact at this forum thought it was rather a haproxy configuration problem and recommends me to post a message at Haproxy forum.  
Thank in advance for your help  
Regards

---

<div class="post-metadata">

**Author:** ![dextercd](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/dextercd/32/2618_2.png) [@dextercd](https://discourse.haproxy.org/u/dextercd)\
**Post date:** [October 30, 2026, 6:43pm UTC](https://discourse.haproxy.org/t/cant-generate-a-certificate-for-haproxy-with-lets-encrypt-with-acme-sh/12780/2 "2026-10-30T18:43:05Z")

</div>

The HAProxy guide contains the following statement inside the frontend section:

`http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].${ACCOUNT_THUMBPRINT}\n" if { path_beg '/.well-known/acme-challenge/' }`

That should make it so that a request like `curl -iL http://savoye.duckdns.org/.well-known/acme-challenge/test` returns `200 OK` with a response body like: `test.YOUR_ACCOUNT_THUMBPRINT`.

That’s not what’s happening. Instead it redirects to https, which redirects to /app/, which then returns HTML.

You included the HAProxy config in the LE forum comment here: [Can't generate a certificate when using acme.sh - OpenSSL error - #3 by yannick.savoye - Aide (en français) - Let's Encrypt Community Support](https://community.letsencrypt.org/t/cant-generate-a-certificate-when-using-acme-sh-openssl-error/252542/3?u=dextercd)

I would recommend changing the `navidrom_http` section as follows:

```auto
frontend navidrome_http
    bind *:80
    mode http
    http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].${ACCOUNT_THUMBPRINT}\n" if { path_beg '/.well-known/acme-challenge/' }
    redirect scheme https code 301

```

The `navidrome_https` section doesn’t need any `acme-challenge` configuration, since LE connects over HTTP/80 when doing the domain verification.