# Can't renew certificate nginx reverse-proxy
**URL:** https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002
**Category:** Help
**Created:** [May 8, 2024, 3:47pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002 "2024-05-08T15:47:11Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@nitro](https://community.letsencrypt.org/u/nitro)
#### Post date: [May 8, 2024, 3:47pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/1 "2024-05-08T15:47:11Z")
My domain is: [cbe30c15fb7f.sn.mynetname.net](http://cbe30c15fb7f.sn.mynetname.net)
I ran this command: certbot renew
It produced this output:
> Saving debug log to /var/log/letsencrypt/letsencrypt.log
>
> * * *
>
> Processing /etc/letsencrypt/renewal/cbe30c15fb7f.sn.mynetname.net.conf
>
> * * *
>
> Renewing an existing certificate for [cbe30c15fb7f.sn.mynetname.net](http://cbe30c15fb7f.sn.mynetname.net)
>
> Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
> Domain: [cbe30c15fb7f.sn.mynetname.net](http://cbe30c15fb7f.sn.mynetname.net)
> Type: unauthorized
> Detail: 188.243.62.66: Invalid response from [http://cbe30c15fb7f.sn.mynetname.net/.well-known/acme-challenge/2NAwvuIJlZLTnNNXG-YkwSyI1NEt0zx7UnvObysLwyg:](http://cbe30c15fb7f.sn.mynetname.net/.well-known/acme-challenge/2NAwvuIJlZLTnNNXG-YkwSyI1NEt0zx7UnvObysLwyg:) 404
>
> Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
>
> Failed to renew certificate [cbe30c15fb7f.sn.mynetname.net](http://cbe30c15fb7f.sn.mynetname.net) with error: Some challenges have failed.
>
> * * *
>
> All renewals failed. The following certificates could not be renewed:
> /etc/letsencrypt/live/cbe30c15fb7f.sn.mynetname.net/fullchain.pem (failure)
>
> * * *
>
> 1 renew failure(s), 0 parse failure(s)
> Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version): nginx/1.20.1
The operating system my web server runs on is (include version): Linux centos7.loc 3.10.0-1160.88.1.el7.x86\_64
My hosting provider, if applicable, is: no
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 2.10.0
Hi community! I want to adjust the automatic renewal certificate for my home server.
I have server centos and I run there docker container for my webapp.
This web application (container) uses HTTP on the TCP port 2342. On the host system, I configured NGINX as a reverse proxy.
I use the free DDNS service provided to Mikrotik users.
You can see attachments for detail
[letsencrypt.log.5.txt](https://community.letsencrypt.org/uploads/short-url/6cFzCzhkZr0jc2idhfeKmPfgDMq.txt) (25.4 KB)
[nginx.conf.txt](https://community.letsencrypt.org/uploads/short-url/o8qzwVVg2C5onovZqhDVd7m1IOv.txt) (2.3 KB)
[cbe30c15fb7f.sn.mynetname.txt](https://community.letsencrypt.org/uploads/short-url/xMbE4xWdJmY7H99osib69NlPtgC.txt) (3.6 KB)
...
Please help.
---
### Author:  [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)
#### Post date: [May 8, 2024, 4:05pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/2 "2024-05-08T16:05:08Z")
Hello @nitro, welcome to the Let's Encrypt community. 🙂
> [@nitro](#):
>
> I ran this command: **certbot renew**
Try running `sudo certbot renew` instead.
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [May 8, 2024, 4:27pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/3 "2024-05-08T16:27:29Z")
```nohighlight
server {
listen 80;
listen [::]:80;
server_name _;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf; <<<<<<<<<<<<<<<<<<<< ?????
error_page 404 /404.html;
location = /404.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
```
Can we see what might be loaded from there?;
`ls -l /etc/nginx/default.d/*.conf`
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [May 8, 2024, 4:30pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/4 "2024-05-08T16:30:11Z")
> [@Bruce5051](#):
>
> Try running `sudo certbot renew` instead.
Certbot wouldn't have gotten so far without being run with the proper rights, so OP either already used `sudo` or ran Certbot as `root`.
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [May 8, 2024, 4:33pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/6 "2024-05-08T16:33:11Z")
It seems like you converted the HTTP server block to HTTPS:
```nohighlight
server {
#listen 80; # If you really need HTTP (unsecure) remove the "#" on the beginning. Not recommended!
# listen [::]:80; # HTTP IPv6
listen 443 ssl http2; # Listen on port 443 and enable ssl and HTTP/2
listen [::]:443 ssl http2; # Same for IPv6
# Put your domain name in here.
server_name cbe30c15fb7f.sn.mynetname.net;
```
But the renewal still needs an HTTP server block to handle the ACME challenge requests.
Let's confirm by reviewing the contents of the renewal config file:
`cat /etc/letsencrypt/renewal/cbe30c15fb7f.sn.mynetname.net.conf`
---
### Author:  [@nitro](https://community.letsencrypt.org/u/nitro)
#### Post date: [May 8, 2024, 6:14pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/7 "2024-05-08T18:14:49Z")
The directory is empty
> [root@centos7 ~]# ls -l /etc/nginx/default.d/
> total 0
> [root@centos7 ~]#
---
### Author:  [@nitro](https://community.letsencrypt.org/u/nitro)
#### Post date: [May 8, 2024, 6:16pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/8 "2024-05-08T18:16:19Z")
Here you are
```nohighlight
[root@centos7 ~]# cat /etc/letsencrypt/renewal/cbe30c15fb7f.sn.mynetname.net.conf
# renew_before_expiry = 30 days
version = 2.8.0
archive_dir = /etc/letsencrypt/archive/cbe30c15fb7f.sn.mynetname.net
cert = /etc/letsencrypt/live/cbe30c15fb7f.sn.mynetname.net/cert.pem
privkey = /etc/letsencrypt/live/cbe30c15fb7f.sn.mynetname.net/privkey.pem
chain = /etc/letsencrypt/live/cbe30c15fb7f.sn.mynetname.net/chain.pem
fullchain = /etc/letsencrypt/live/cbe30c15fb7f.sn.mynetname.net/fullchain.pem
# Options used in the renewal process
[renewalparams]
authenticator = nginx
installer = nginx
account = 17386d133bb09d6efba259fbfaf13b4e
server = https://acme-v02.api.letsencrypt.org/directory
key_type = rsa
```
---
### Author:  [@nitro](https://community.letsencrypt.org/u/nitro)
#### Post date: [May 8, 2024, 6:21pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/9 "2024-05-08T18:21:38Z")
For HTTP server block you can find out config in main nginx conf file nginx.conf[.txt]
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [May 8, 2024, 7:30pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/11 "2024-05-08T19:30:11Z")
> [@nitro](#):
>
> ```nohighlight
> authenticator = nginx
> installer = nginx
>
> ```
It is difficult to break the `nginx` plugin [not impossible].
And you may have succeeded at that by converting the vhost that covers that name from HTTP to HTTPS (only).
> [@nitro](#):
>
> For HTTP server block you can find out config in main nginx conf file nginx.conf[.txt]
That vhost does not use the name requested by the cert renewal:
`server_name _;`
I think you can fix this problem in one of three ways:
- adjust that "default" vhost `server_name` to match/include the cert name
[not a great idea]
- replace the converted HTTP vhost server block back with (enough of) what was there before it was modified to HTTPS
[having both (HTTP and HTTPS) vhosts for that name should resolve the issue]
- replace the authentication method from `nignx` to `webroot`
[without a dedicated HTTP vhost, this solution is at the mercy of the settings in the "default" vhost]
So... my recommendation is the middle choice: To use a dedicated HTTP vhost for the name(s) in the cert.
---
### Author:  [@nitro](https://community.letsencrypt.org/u/nitro)
#### Post date: [May 10, 2024, 6:54am UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/12 "2024-05-10T06:54:50Z")
Am I reading this right for the middle suggestion?
I should comment out the HTTP section in the main nginx conf file, then I should add the HTTP section to the /etc/nginx/sites-enabled/cbe30c15fb7f.sn.mynetname.net configuration. Right?
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [May 10, 2024, 6:57am UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/13 "2024-05-10T06:57:11Z")
You don't need to do anything to the default HTTP server block in the main config file.
You can add a vhost server block within just about any existing file OR create a new file for it.
[where you put the new server block is not relevant - what is relevant is the content of that server block]
---
### Author:  [@nitro](https://community.letsencrypt.org/u/nitro)
#### Post date: [May 10, 2024, 7:06am UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/14 "2024-05-10T07:06:16Z")
Like this?
/etc/nginx/sites-enabled/cbe30c15fb7f.sn.mynetname.net
```nohighlight
server {
listen 80;
#listen [::]:80;
server_name cbe30c15fb7f.sn.mynetname.net;
}
server {
#listen 80; # If you really need HTTP (unsecure) remove the "#" on the beginning. Not recommended!
# listen [::]:80; # HTTP IPv6
listen 443 ssl http2; # Listen on port 443 and enable ssl and HTTP/2
listen [::]:443 ssl http2; # Same for IPv6
# Put your domain name in here.
server_name cbe30c15fb7f.sn.mynetname.net;
# - - - - - - - - - -
# SSL security
# - - - - - - - - - -
ssl_certificate /etc/letsencrypt/live/cbe30c15fb7f.sn.mynetname.net/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/cbe30c15fb7f.sn.mynetname.net/privkey.pem; # managed by Certbot
# Since the PP API is also used on Android, we have to keep TLS1.2 in here for a while.
# A lot of the older Android devices do not support TLS1.3 yet :/
ssl_protocols TLSv1.3;
...
```
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [May 10, 2024, 7:12am UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/17 "2024-05-10T07:12:13Z")
> [@nitro](#):
>
> Like this?
Well... almost.
I'd add two things:
- Ideally it would include a `root` location
[preferably a new and unique location to be used only for ACME renewals]
Like: `root /acme-challenges;`
OR: `root /var/tmp/acme-challenges;`
[remember to create the folder too (with the proper permissions)]
- and you might also want to redirect all the non ACME challenge requests to HTTPS.
---
### Author:  [@nitro](https://community.letsencrypt.org/u/nitro)
#### Post date: [May 10, 2024, 7:22am UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/18 "2024-05-10T07:22:54Z")
Thanks!
Which directory should I specify in the HTTP server section If my web service (who answers for the requests from the Internet) containerized? Does it matter?
About "redirect all the non ACME challenge", could you please give me an example?
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [May 10, 2024, 7:33am UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/20 "2024-05-10T07:33:54Z")
The proxy answers HTTP and HTTPS.
The HTTPS requests are proxied to the container [via HTTP port 2342].
The HTTP requests are answered locally by the proxy; Currently by the default server block in the main config file.
Once you restart/reload `nginx`, it will have an HTTP server block for that name and it will do what that block requires.
So...
> [@nitro](#):
>
> Which directory should I specify in the HTTP server section
[if you mean `root` statement]
I gave two possible examples of locations:
> [@rg305](#):
>
> Like: `root /acme-challenges;`
> OR: `root /var/tmp/acme-challenges;`
As for
> [@nitro](#):
>
> About "redirect all the non ACME challenge", could you please give me an example?
You can add two locations blocks [to cover each possibility]:
```nohighlight
location / {
return 301 https://$host$request_uri;
}
location /.well-known/acme-challenge {
root /var/tmp/acme-challenges;
try_files $uri =404;
}
```
Remember to create whatever folder location you choose.
---
### Author:  [@nitro](https://community.letsencrypt.org/u/nitro)
#### Post date: [May 10, 2024, 7:53am UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/21 "2024-05-10T07:53:24Z")
Unfortunately,
[cbe30c15fb7f.sn.mynetname.net.txt](https://community.letsencrypt.org/uploads/short-url/xd5plfdYDPSXZjJuo4C7uRq2QXh.txt) (3.9 KB)
[letsencrypt.log.txt](https://community.letsencrypt.org/uploads/short-url/pyFTn4WtRF86QKHdAZUKxs5g8GS.txt) (27.5 KB)
same result...
```nohighlight
[root@centos7 ~]# ls -l /var/tmp/
total 0
drwxr-xr-x. 2 root root 6 May 10 10:34 acme-challenges
```
new config of the nginx conf file (/etc/nginx/sites-enabled/cbe30c15fb7f.sn.mynetname.net) in attach, please see
new logs also in attach
P.S. after edited nginx conf file I reload ngix by command "systemctl reload nginx.service"
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [May 10, 2024, 8:00am UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/22 "2024-05-10T08:00:31Z")
Despite the failure, we are making progress.
The added server block is being used.
Generic HTTP requests are being redirected to HTTPS:
```nohighlight
curl -Ii cbe30c15fb7f.sn.mynetname.net
HTTP/1.1 301 Moved Permanently
Server: nginx/1.20.1
Date: Fri, 10 May 2024 07:56:25 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: https://cbe30c15fb7f.sn.mynetname.net/
```
ACME challenge requests are being looked for locally:
[in this case not found (404) is expected - because that file name doesn't exists]
```nohighlight
curl -Ii cbe30c15fb7f.sn.mynetname.net/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 404 Not Found
Server: nginx/1.20.1
Date: Fri, 10 May 2024 07:56:45 GMT
Content-Type: text/html
Content-Length: 153
Connection: keep-alive
```
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [May 10, 2024, 8:07am UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/25 "2024-05-10T08:07:45Z")
Something is preventing the `nginx` plugin from working correctly.
Let's try switching to `webroot`.
Try:
```nohighlight
certbot certonly \
--webroot -w /var/tmp/acme-challenges \
--cert-name cbe30c15fb7f.sn.mynetname.net
```
---
### Author:  [@nitro](https://community.letsencrypt.org/u/nitro)
#### Post date: [May 11, 2024, 2:04pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/26 "2024-05-11T14:04:12Z")
> [@rg305](#):
>
> ```nohighlight
> certbot certonly \
> --webroot -w /var/tmp/acme-challenges \
> --cert-name cbe30c15fb7f.sn.mynetname.net
>
> ```
[root@centos7 ~]# certbot certonly
--webroot -w /var/tmp/acme-challenges
--cert-name [cbe30c15fb7f.sn.mynetname.net](http://cbe30c15fb7f.sn.mynetname.net)
Saving debug log to /var/log/letsencrypt/letsencrypt.log
* * *
An RSA certificate named [cbe30c15fb7f.sn.mynetname.net](http://cbe30c15fb7f.sn.mynetname.net) already exists. Do you
want to update its key type to ECDSA?
* * *
(U)pdate key type/(K)eep existing key type: K
Renewing an existing certificate for [cbe30c15fb7f.sn.mynetname.net](http://cbe30c15fb7f.sn.mynetname.net)
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: [cbe30c15fb7f.sn.mynetname.net](http://cbe30c15fb7f.sn.mynetname.net)
Type: unauthorized
Detail: 188.243.62.66: Invalid response from [http://cbe30c15fb7f.sn.mynetname.net/.well-known/acme-challenge/Ky012U5rONOtEdAeLhj2B-LMKDzIaCz7hbcYYDUFlMI:](http://cbe30c15fb7f.sn.mynetname.net/.well-known/acme-challenge/Ky012U5rONOtEdAeLhj2B-LMKDzIaCz7hbcYYDUFlMI:) 404
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.
Some challenges have failed.
Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
[letsencrypt.log.1.txt](https://community.letsencrypt.org/uploads/short-url/zm6ZMpSw6GNKp5QpmttanGeGbKI.txt) (18.8 KB)
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [May 11, 2024, 2:27pm UTC](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002/27 "2024-05-11T14:27:32Z")
Very strange!
Let's try placing a file in that location:
`echo "test" > /var/tmp/acme-challenges/Test_File-1234`
Then it should be accessible via:
`http://cbe30c15fb7f.sn.mynetname.net/.well-known/acme-challenge/Test_File-1234`
If not, then we need to see the web server logs [access and error].
If yes, then... we need to... think about what just happened [this should NOT be the case].
[Next page](https://community.letsencrypt.org/t/cant-renew-certificate-nginx-reverse-proxy/218002.md?page=2)