RFC 8555 §8.3: the CA connects over plain HTTP to port 80, may follow redirects (to HTTP or HTTPS on ports 80 or 443) and expects the exact key authorization string in the body. It works only for host names that resolve publicly to a server you control, and it cannot validate wildcard names.
Common failures: port 80 blocked by a firewall or cloud security group, IPv6 records pointing to a host that does not answer (CAs prefer IPv6 when an AAAA record exists), load balancers that route the request to a different node than the one holding the token, CDNs caching a stale challenge response and redirects to unusual ports.
Since 2025 public CAs must corroborate validation from several network perspectives in different regions (Baseline Requirements §3.2.2.9), so geo-blocking or per-region routing can also make http-01 fail.