# 404 on .well-known/acme-challenge/

**URL:** <https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565>\
**Category:** Server\
**Created:** [May 10, 2016, 3:38pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565 "2016-05-10T15:38:36Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![jongrover](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jongrover/32/7247_2.png) [@jongrover](https://community.letsencrypt.org/u/jongrover)\
**Post date:** [May 10, 2016, 3:38pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/1 "2016-05-10T15:38:36Z")

</div>

After running the command: `./letsencrypt-auto certonly -a webroot --webroot-path=/usr/share/nginx/html -d codepajamas.com -d www.codepajamas.com` I get the following errors reported. _Note: I’m running all these commands from a sudo user._

```auto
Domain: codepajamas.com
Type: unauthorized
Detail: Invalid response from http://codepajamas.com/.well-known/acme-challenge/xd7VVkpRwg6587WsOp1MOAn6CDCvRFst_SzkTqbGo9s
[104.131.79.107]: 404

Domain: www.codepajamas.com
Type: unauthorized
Detail: Invalid response from http://www.codepajamas.com/.well-known/acme-challenge/g2HetonoGE3ioZYg2Inmm0Dcf1zpx5kro0CVHbE7-Aw
[104.131.79.107]: 404

```

I’m running **Nginx** and **Unicorn** to a **Ruby on Rails** app and when I visit the page in the browser I get the Rails default 404 error message instead of my test page I created. All folders are set to permissions 755. Since I’m using Nginx my well-known folder location is actually at: `/usr/share/nginx/html/.well-known`

In my Nginx configuration file at `/etc/nginx/sites-available/default` I set the following

```auto
server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on;

        root /usr/share/nginx/html;
        index index.html index.htm;
        
         location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to displaying a 404.
                try_files $uri $uri/ =404;
                # Uncomment to enable naxsi on this location
                # include /etc/nginx/naxsi.rules
        }
        
        location ~ /.well-known {
            allow all;
        }
}

```

I followed all the instructions from here: [https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-14-04](https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-14-04)

Anyone have any suggestions? Much appreciated.

---

<div class="post-metadata">

**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\
**Post date:** [May 10, 2016, 3:44pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/2 "2016-05-10T15:44:12Z")

</div>

If you create the file /usr/share/nginx/html/.well-known/acme-challenge/test with contents “success”

can you reach it externally OK using [http://codepajamas.com/.well-known/acme-challenge/test](http://codepajamas.com/.well-known/acme-challenge/test) ?

---

<div class="post-metadata">

**Author:** ![pfg](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pfg/32/1924_2.png) [@pfg](https://community.letsencrypt.org/u/pfg)\
**Post date:** [May 10, 2016, 3:44pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/3 "2016-05-10T15:44:20Z")

</div>

You mentioned that you’re using unicorn as a backend server. You should have a `proxy_pass` directive pointing to the unicorn port or socket somewhere in your `server` block, or otherwise nginx wouldn’t be sending traffic to unicorn. Are you sure this is the correct `server` block/config file?

---

<div class="post-metadata">

**Author:** ![jongrover](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jongrover/32/7247_2.png) [@jongrover](https://community.letsencrypt.org/u/jongrover)\
**Post date:** [May 10, 2016, 3:45pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/4 "2016-05-10T15:45:41Z")

</div>

`http://codepajamas.com/.well-known/acme-challenge/test` I get a standard 404 screen from Rails (which means my rails app is spun up by nginx and unicorn and there is no route for /.well-known/…) the test file does not appear.

I set all permissions on `/usr/share/nginx/html/.well-known` to 755 also. There was nothing in the folder and there are no pem files appearing in `/etc/letsencrypt/` either…

---

<div class="post-metadata">

**Author:** ![jongrover](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jongrover/32/7247_2.png) [@jongrover](https://community.letsencrypt.org/u/jongrover)\
**Post date:** [May 10, 2016, 3:49pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/5 "2016-05-10T15:49:26Z")

</div>

Good question I also have another Nginx config file at: `/etc/nginx/nginx.conf`

```auto
user www-data;
worker_processes 4;
pid /run/nginx.pid;

events {
	worker_connections 768;
}

http {

	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	keepalive_timeout 65;
	types_hash_max_size 2048;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	gzip on;
	gzip_disable "msie6";

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}

```

and …

---

<div class="post-metadata">

**Author:** ![jongrover](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jongrover/32/7247_2.png) [@jongrover](https://community.letsencrypt.org/u/jongrover)\
**Post date:** [May 10, 2016, 3:52pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/6 "2016-05-10T15:52:08Z")

</div>

I found a few other files for nginx at /etc/default/nginx  
But I’m on a Digital Ocean server and following their explicit directions of where to update the Nginx file so hopefully it is the correct location. [https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-14-04](https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-14-04)

Thanks,

---

<div class="post-metadata">

**Author:** ![pfg](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pfg/32/1924_2.png) [@pfg](https://community.letsencrypt.org/u/pfg)\
**Post date:** [May 10, 2016, 3:57pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/7 "2016-05-10T15:57:06Z")

</div>

Those instructions are not specific to your hosting provider. These things work exactly the same on every VPS/dedicated server out there.

More specifically, those instructions work on a standard nginx instance. In your case, however, you’re using nginx as a reverse proxy, forwarding all traffic to unicorn. Unicorn doesn’t know (or care) about nginx’s webroot, nor does rails.

You can use `grep -r "proxy_pass" /etc/nginx` to find the configuration file that actually handles the traffic to your rails app, and add the following section in the `server` block:

```auto
location ~ /\.well-known/acme-challenge {
	root /usr/share/nginx/html;
}

```

This will tell nginx that requests to `/.well-known/acme-challenge` should be served from your webroot (`/usr/share/nginx/html`), while everything else will still be served by unicorn/rails.

---

<div class="post-metadata">

**Author:** ![jongrover](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jongrover/32/7247_2.png) [@jongrover](https://community.letsencrypt.org/u/jongrover)\
**Post date:** [May 10, 2016, 4:01pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/8 "2016-05-10T16:01:48Z")

</div>

Thanks @pfg,

> [@pfg](#):
>
> grep -r "proxy\_pass" /etc/nginx

returns search results:

```nohighlight
/etc/nginx/sites-available/default
/etc/nginx/sites-available/rails

```

I added the line as you suggested

```nohighlight
location ~ /\.well-known/acme-challenge {
	root /usr/share/nginx/html;
}

```

to both `default` and `rails`, The latter file rails is most likely the one that connects my Rails app.

Then I ran the command `sudo service nginx reload` but when I try to

`./letsencrypt-auto certonly -a webroot --webroot-path=/usr/share/nginx/html -d codepajamas.com -d www.codepajamas.com`

I still get the same 404 errors.

---

<div class="post-metadata">

**Author:** ![jongrover](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jongrover/32/7247_2.png) [@jongrover](https://community.letsencrypt.org/u/jongrover)\
**Post date:** [May 10, 2016, 4:19pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/9 "2016-05-10T16:19:02Z")

</div>

I definitely think `/etc/nginx/sites-available/rails` is the correct file after looking it over.

```auto
upstream app_server {
    server unix:/var/run/unicorn.sock fail_timeout=0;
}

server {
    listen 80;
    root /home/rails/rails_project/public;
    server_name _;
    index index.htm index.html;

    location / {
            try_files $uri/index.html $uri.html $uri @app;
    }

    location ~* ^.+\.(jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|pdf|ppt|txt|tar|mid|midi|wav|bmp|rtf|mp3|flv|mpeg|avi)$ {
                    try_files $uri @app;
            }

     location @app {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_redirect off;
            proxy_pass http://app_server;
    }

    location ~ /.well-known {
            allow all;
    }

    location ~ /\.well-known/acme-challenge {
	root /usr/share/nginx/html;
    }
}

```

---

<div class="post-metadata">

**Author:** ![jongrover](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jongrover/32/7247_2.png) [@jongrover](https://community.letsencrypt.org/u/jongrover)\
**Post date:** [May 10, 2016, 4:30pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/10 "2016-05-10T16:30:45Z")

</div>

One thing that this changed is that now the 404 page is the Nginx/Unbuntu 404 page and no longer the rails 404 page.

---

<div class="post-metadata">

**Author:** ![jongrover](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jongrover/32/7247_2.png) [@jongrover](https://community.letsencrypt.org/u/jongrover)\
**Post date:** [May 10, 2016, 4:53pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/11 "2016-05-10T16:53:36Z")

</div>

Hi I made progress I had to change one little thing about your code I instead had to remove the `/acme-challenge` and do just:

```auto
location ~ /.well-known {
        allow all;
	root /usr/share/nginx/html;
}

```

After that I can see my test file and no longer get 404.  
Now I’m getting a new 500 error related to something else

`DeserializationError('The following field are required: detail',)`

so I’ll read up a bit on the error log and make a new thread if I get stuck thanks for your help @pfg!

---

<div class="post-metadata">

**Author:** ![pfg](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pfg/32/1924_2.png) [@pfg](https://community.letsencrypt.org/u/pfg)\
**Post date:** [May 10, 2016, 4:56pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/12 "2016-05-10T16:56:20Z")

</div>

> [@jongrover](#):
>
> Now I'm getting a new 500 error related to something else
> 
> DeserializationError('The following field are required: detail',)

This _might_ be related to a partial outage that just started: [Let's Encrypt Status](https://letsencrypt.status.io/pages/incident/55957a99e800baa4470002da/57321180cd71dab819000a0c)

It'll probably work in a bit.

---

<div class="post-metadata">

**Author:** ![jongrover](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jongrover/32/7247_2.png) [@jongrover](https://community.letsencrypt.org/u/jongrover)\
**Post date:** [May 10, 2016, 5:05pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/13 "2016-05-10T17:05:43Z")

</div>

Thanks will try again in 30 minutes… Shortly after I got that initial 500 error I tried again and got a different error

```auto
raise errors.MissingNonce(response)
MissingNonce: Server POST response did not include a replay nonce, headers: {'Content-Length': '1488', 'Expires': 'Tue, 10 May 2016 16:57:05 GMT', 'Server': 'nginx', 'Connection': 'close', 'ETag': '"55f255cc-5d0"', 'Pragma': 'no-cache', 'Cache-Control': 'max-age=0, no-cache, no-store', 'Date': 'Tue, 10 May 2016 16:57:05 GMT', 'Content-Type': 'text/html'}`

```

Perhaps this also do to the partial outage?

---

<div class="post-metadata">

**Author:** ![jongrover](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jongrover/32/7247_2.png) [@jongrover](https://community.letsencrypt.org/u/jongrover)\
**Post date:** [May 10, 2016, 5:18pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/14 "2016-05-10T17:18:46Z")

</div>

This issue resolved itself I think it was just because of the outage. I was able to get the certificate! Hurray Thanks LetsEncrypt! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [June 9, 2016, 5:18pm UTC](https://community.letsencrypt.org/t/404-on-well-known-acme-challenge/15565/15 "2016-06-09T17:18:50Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.