My domain is: adamlein.com
I ran this command:
sudo certbot --installer nginx --dns-cloudflare --dns-cloudflare-credentials /etc/cloudflare/credential.ini --dns-cloudflare-propagation-seconds 30
It produced this output: For every domain in NGINX, the following error appears about one server block:
Could not parse file: /etc/nginx/sites-enabled/adamlein.com due to Expected stringEnd, found 's' (at char 0), (line:1, col:1)
My web server is (include version): nginx version: nginx/1.18.0 (Ubuntu)
The operating system my web server runs on is (include version):
Virtualization: kvm
Operating System: Ubuntu 22.04.5 LTS
Kernel: Linux 6.8.0-1019-oracle
Architecture: arm64
Hardware Vendor: QEMU
Hardware Model: KVM Virtual Machine
My hosting provider, if applicable, is: Oracle Cloud
I can login to a root shell on my machine (yes or no, or I don't know): Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.21.0
I can't figure out why this error keeps appearing. It appears for every domain in NGNIX when runnning certbot, but generating the certificates appears to be successful anyway. It just doesn't edit the server block file to include those certificates and configuration changes properly. Although I think automatic certbot renewals seem to fail (it did this week). I can edit the adamlein.com server block file manually in SSH and everything is fine. The error happens if I turn off Cloudflare DNS proxy and don't use the dns-cloudflare plug-ins as well.
The server block that causes the error is below:
server {
root /var/www/adamlein.com/html;
index index.html index.htm index.php;
server_name adamlein.com www.adamlein.com beta.adamlein.com;
# Content security policy
#add_header Content-Security-Policy: default-src *; script-src * https://www.googletagmanager.com; frame-src *;
#HSTS enabled
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
# XSS protection header
add_header X-XSS-Protection "1; mode=block";
# X-Frame deny header
add_header X-Frame-Options "DENY";
# X-Content-Type-Options header
add_header X-Content-Type-Options "nosniff";
# custom log location
access_log /var/log/nginx/adamlein.com.access.log;
# location / {
# try_files \$uri \$uri/ /index.php;
# }
location ~ \.php$ {
# include snippets/fastcgi-php.conf;
# fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
# try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
include snippets/fastcgi-php.conf;
# With php-fpm (or other unix sockets):
fastcgi_pass unix:/run/php/php8.4-fpm.sock;
# With php-cgi (or other tcp sockets):
# fastcgi_index index.php;
# fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
#sitemap redirect to dynamic PHP file
location = /sitemap.xml
{
rewrite .* /sitemap.php redirect;
}
#letter case issues
location = /Design.php
{ rewrite .* /design.php redirect;
}
location = /Infostrt.php
{ rewrite .* /infostrt.php redirect;
}
#asp redirect to php
location ~ \.asp$ {
if (!-f $request_filename) {
rewrite ^(.*)\.asp$ $1.php permanent;
}
}
# cache policy
location ~* \.(ico|pdf|flv|jpg|jpeg|png|gif|js|css|swf|mp4|svg|json)$ {
expires 3600h;
add_header Cache-Control "public, no-transform";
}
# redirect without extensions
location = /contact
{ rewrite .* /contact.php redirect; }
location = /resume
#{ rewrite .* /resume.php redirect; }
{ rewrite .* /Files/Adam_Lein_resume.pdf redirect; }
location = /photography
{ rewrite .* /photography.php redirect; }
#hacked pages 410
location = /zeb.php {
return 410;
}
location = /Files/zfa.php {
return 410;
}
location = /Files/zeb.php {
return 410;
}
location = /mds.php {
return 410;
}
#block hacker attempts
location / {
deny 141.98.81.44;
deny 147.78.47.87;
deny 83.147.52.49;
deny 109.176.202.52;
allow all;
}
#SSL stuff
location ~ /\.ht {
deny all;
}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/adamlein.com-0001/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/adamlein.com-0001/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = www.adamlein.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
if ($host = adamlein.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
listen [::]:80;
server_name adamlein.com www.adamlein.com beta.adamlein.com;
return 404; # managed by Certbot
}
The error is referring to the first character on the first line which is the "s" in "server", but that needs to be there for NGINX so maybe there's a different error somewhere and certbot isn't telling me the correct line/character?
My bad.