Can't issue Let's Encrypt certificate: Timeout during connect (likely firewall problem) / Error getting validation data

Symptoms

• Can't install Let's Encrypt certificate for a domain/Plesk panel

  Detail: Fetching http://example.com/.well-known/acme-challenge/do75fK79n_uF9JimlezVpQQQfmvHaOVd7T8cjZKVvWk: Timeout during connect (likely firewall problem)

  Error: Could not issue a Let's Encrypt SSL/TLS certificate for example.com. Authorization for the domain failed.
  Invalid response from https://acme-v01.api.letsencrypt.org/acme/authz/dlJ9iUsYRM51xlzLkS8KpRJYccRh1yKRUJEPgLMoRFc.
  Type: urn:acme:error:connection
  Status: 400
  Details: Fetching https://example.com:8443/.well-known/acme-challenge/44DVtYx2WBKaujKCYO7tOxZ4nS2-m_-Ci5dLoQw0X34 Error getting validation data

  An SSL / TLS certificate could not be issued for example.com
  The SSL / TLS Let's Encrypt certificate could not be issued for example.com. Authorization error for the domain.
  Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/xxxxxx.
  Type: urn: ietf: params: acme: error: connection
  Status: 400
  Detail: Fetching http://example.com/.well-known/acme-challenge/DOgtM-HLdDLxfaGej39Fip168f6njHhwot47XuyGANo: Error getting validation data

• The domain resolves to the correct Plesk server IP address

• Opening the site in a browser displays the error

  This site can’t be reached
  ERR_CONNECTION_TIMED_OUT

Cause

Ports 80/443 are filtered by a firewall

# nmap -Pn -p80,443 example.com
...
PORT STATE SERVICE
80/tcp filtered http
443/tcp filtered http

Resolution

Open the web ports 80 and 443 on the firewall.

Note: If the issue persists, contact the ISP, hosting provider, or network administrator for assistance locating and opening the block.

• To automatically configure the internal firewall to allow all necessary connections, use Plesk Firewall. Additional software (like Imunify360) must also be configured according to its documentation.
• For external firewalls, follow the appropriate guide (contact the hosting provider if not listed): Amazon EC2, Lightsail, Google Cloud, Azure, Alibaba Cloud.