ACME failures at the head have four classic shapes.
Clients report wrong URLs or a JWS url mismatch — GOCA_ACME_BASE_URL must be the exact external origin clients reach, scheme and all. The protocol signs the URL into every request, so a proxy rewrite the head does not know about breaks every client at once.
A burst of badNonce right after a deploy — the head restart reset the nonce counter. One retry per in-flight client, by design; conformant clients absorb it silently. If your monitoring pages on it, teach the monitoring, not the CA.
http-01 fails against an internal name — the validator refuses loopback and RFC 1918 targets by default, as anti-SSRF. Issuing for internal names means enabling the private-network override deliberately, as a decision — not discovering the refusal in production.
Finalize stays processing — follow the order's request id: approval, quota, signer or publication status names the blocking stage. Do not submit a second order; finalize is idempotent, and the duplicate only muddies the trail you are trying to read.
An unhealthy head while everything else is green usually means its path to the core: wrong upstream URL, or a dev token meeting a real master secret.
Now I can debug ACME from the head's own refusals.