Certbot Docker was successful, but the file was not generated

[Osiris]

@huytrv

but it look like certificate still invalid

Why would it be invalid?

@huytrv

whether it needs to match options-ssl-nginx.conf and ssl-dhparams.pem ?

What would it need to match from those file?

[huytrv]

The server is up and running, you can check it, but still no certificate

[Osiris]

I see the certificate when using openssl s_client -connect bbqfield.com:443 but you're not sending the intermediate certificate(s). This makes sense, as the intermediate cert(s) (chain.pem) and also the full chain (fullchain.pem, which is just cert.pem and chain.pem concatenated into a single file) were also deleted by the script.

You can download the intermediate certificate(s) from Chain of Trust - Let's Encrypt

Please see Production Chain Changes for more info about the currently active certificate chain. This currently is "R3" and "ISRG Root X1" where the latter has been signed by "DST Root CA X3". So your chain.pem would consist of the R3 intermediate signed by ISRG Root X1 and the ISRG Root X1 certificate signed by "DST Root CA X3". All these files are availalbe from the Chain of Trust page I linked above, also as PEM files you can use directly on your server.

[huytrv]

I added "R3 intermediate signed by ISRG Root X1 and the ISRG Root X1 certificate signed by "DST Root CA X3" > chain.pem and cert.pem + chain.pem > fullchain.pem, still not resolved. Can you check me again?

[Nummer378]

@huytrv

I added "R3 intermediate signed by ISRG Root X1 and the ISRG Root X1 certificate signed by "DST Root CA X3" > chain.pem and cert.pem + chain.pem > fullchain.pem , still not resolved. Can you check me again?

You're using the wrong leaf certificate.

@Osiris

But as long as you have the actual certificate and not the pre-certificate, it should be fine.

You used the pre-certificate instead of the actual certificate. You need to download the leaf certificate from crt.sh, not the precert.

(Your intermediate chain looks correct though, so you got that)

[Osiris]

You've added the SCT pre-certificate for your own certificate from crt.sh. (This wasn't clear earlier, as OpenSSL complained about the missing chain earlier, not about the pre-cert..)

As I've told earlier, you should use the actual certificate, not the pre-certificate. You can recognise pre-certs by their specific content:

CT Precertificate Poison: critical
                NULL

In the actual certificate, you'll see:

            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
(...)

See the link to the actual certificate above.

[huytrv]

Thank you for taking the time to solve my problem, I have succeeded in getting my certification, It returned to the 502 error but maybe it's not the letsencrypt problem

• Update for those of the same problem as me, removing proxy_pass and adding $Mage Root, include <root>/nginx.conf.sample solved the problem.