Can't issue Let's Encrypt certificate while any application exists

[THE-KONDRAT]

Content

I can issue certificate when i have no apps.
First i created app with single domain and attached existing certificate.
Then i tried issuing a new certificate for subdomain and got following error in browser console:

Error: ["500","error: one or more domains had a problem:\n[subdomain.example.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: PUBLIC_IP: Invalid response from http://subdomain.example.com/.well-known/acme-challenge/...

Here is the part of safeline-tengine logs:

tcd unix sock service started 🚀
2026/05/05 21:00:28 [INFO] acme: Registering account for email@example.com
2026/05/05 21:00:29 [INFO] [subdomain.example.com] acme: Obtaining bundled SAN certificate
2026/05/05 21:00:29 [INFO] [subdomain.example.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/.../...
2026/05/05 21:00:29 [INFO] [subdomain.example.com] acme: Could not find solver for: tls-alpn-01
2026/05/05 21:00:29 [INFO] [subdomain.example.com] acme: use http-01 solver
2026/05/05 21:00:29 [INFO] [subdomain.example.com] acme: Trying to solve HTTP-01
2026/05/05 21:02:16 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/.../...
time=2026-05-05T21:02:16.382+..:00 level=ERROR msg="obtain certificate failed" error="error: one or more domains had a problem:\n[subdomain.example.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: PUBLIC_IP: Invalid response from http://subdomain.example.com/.well-known/acme-challenge/...: 504\n" source=/work/client/acme.go:260
time=2026-05-05T21:02:16.382+..:00 level=ERROR msg="exec cmd failed" error="error: one or more domains had a problem:\n[subdomain.example.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: PUBLIC_IP: Invalid response from http://subdomain.example.com/.well-known/acme-challenge/...: 504\n" cmd=acmeRequest module=client source=/work/client/actions.go:126

How can i fix this unexpected behavior?

[StayerYao]

Thanks for the report. Could you please provide your SafeLine version and the port/HTTPS redirect configuration of the existing application so we can investigate further?