404 error - nginx revproxy to apache on 2 servers

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: sailawaysystems.com

I ran this command: certbot -v --nginx -d sailawaysystems.com -d www.sailawaysystems.com

I run 2 DNS servers behind a fortigate router. I also have DNS glue records for all my domains at NetworkSolutions. Nginx runs on server1 rev-proxied to apache on server2. I have letsencrypt certificates on nginx for other domains that renew ok. I have ssl configuration on apache: double encryption. I am tring to get a few domains which had expired to renew or create new. Let's Debug is good for HTTP-01, DNS-01, and TSL-ALPN-01. Whatsmydns search looks good to my external IP. I have tried to add .well-known options in nginx config.

It produced this output: 47.207.47.203: Invalid response from http://sailawaysystems.com/.well-known/acme-challenge/lTzkSnfrFl7s2_KhNOFzzOtHdIp-STuE_B9t6-Ct_lU: 404

My web server is (include version): nginx/1.20.1

The operating system my web server runs on is (include version): CentOS Stream release 9

My hosting provider, if applicable, is: I run 2 DNS servers behind a fortigate router. Nginx on server1 is rev-proxy to apache on server2. All domains have glue records on Network Solutions.

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 3.1.0

2

Can you check your nginx access log to see if it replied with the 404?

Because Let's Debug, or other testing tools, show your Apache replying to HTTP Challenge requests.

The --nginx option prepares a server block in nginx to handle the challenge. It is not easy to test that response except when Certbot uses --nginx. But, we should be able to see the 404 "Not Found" in the nginx access log.

Let us know whether it does or not which will guide further debug. Thanks

2 Likes