Can’t get my domain key v2.0

There’s a similar (closed) topic but it doesn’t help my problem.

Fresh new site. Only Litespeed cache plugin installed and enabled.

Error:

Communication failure with the QUIC.cloud server: The validation request on your domain failed. Please make sure there are no firewalls blocking our servers. Response code: 403

There was a problem retrieving your domain key. Click the Waiting for approval button to try again.

There are two reasons why we can’t communicate with your domain:

1) The POST call to https://studyandlearning.com/wp-json/litespeed/v1/token failed.

2) Our online server IPs were not whitelisted.

Please check that your other plugins are not blocking REST API calls, whitelist our server IPs or contact your server administrator for help.

Now, here’s the thing:

• Cloudflare is in Development Mode and Cache has been Purged.
• There isn’t a Cloudflare WAF configured.
• Goggle Cloud Firewall has port 80/tcp, 443/tcp and 443/udp open to 0.0.0.0./0
• Server UFW has ports 80/tcp, 443/tcp and 443/udp open to ANY
• No other plugin installed. Only Litespeed Cache.
• Site has an Origin CA Certificate from Cloudlfare and the SSL mode is Full (Strict)

If a curl from the server:

curl -d "test" https://mydomain.com/wp-json/litespeed/v1/token -v --max-time 20
*   Trying 172.67.134.203:443...
* Connected to mydomain.com (172.67.134.203) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: C=US; ST=California; L=San Francisco; O=Cloudflare, Inc.; CN=sni.cloudflaressl.com
*  start date: Mar  6 00:00:00 2023 GMT
*  expire date: Mar  4 23:59:59 2024 GMT
*  subjectAltName: host "mydomain.com" matched cert's "mydomain.com"
*  issuer: C=US; O=Cloudflare, Inc.; CN=Cloudflare Inc ECC CA-3
*  SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* Using Stream ID: 1 (easy handle 0x5581aa7c5560)
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> POST /wp-json/litespeed/v1/token HTTP/2
> Host: mydomain.com
> user-agent: curl/7.81.0
> accept: */*
> content-length: 4
> content-type: application/x-www-form-urlencoded
>
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* We are completely uploaded and fine
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Connection state changed (MAX_CONCURRENT_STREAMS == 256)!
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
< HTTP/2 200
< date: Sat, 22 Apr 2023 22:18:54 GMT
< content-type: application/json; charset=UTF-8
< x-robots-tag: noindex
< link: <https://mydomain.com/wp-json/>; rel="https://api.w.org/"
< x-content-type-options: nosniff
< access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
< access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
< allow: POST, GET
< x-litespeed-tag: fc6_HTTP.200
< x-litespeed-cache-control: no-cache
< vary: Accept-Encoding
< alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
< cf-cache-status: DYNAMIC
< report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FO1uJ3r6ucgsD1RCmYmb54wysfP0J2Uqw9mqkU21goJ8HJSRDGjnStYjJMSe7NRV6oMSPdILzpRO3wZLboXveq2h6Lbzm%2BqCkaMgeXuBziTLCw1Xmo8rFtNyMhUN98geIvKdnRbO75VpiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
< nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
< strict-transport-security: max-age=15552000; includeSubDomains; preload
< server: cloudflare
< cf-ray: 7bc13ecaa9dfe1bf-ORD
<
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Connection #0 to host mydomain.com left intact

I don’t understand 99% of the above, but it seems to me that the curl command is being able to communicate with quic and get a domain key, isn’t it?

NOTE: I have now enabled back Cloudflare and installed some basic security plugins, just to not be out there in the open. But all the tests were conducted as indicated.