# Certbot failed to authenticate some domains (authenticator: nginx)

**URL:** <https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-nginx/192642>\
**Category:** Help\
**Created:** [February 11, 2023, 2:39pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-nginx/192642 "2023-02-11T14:39:57Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![IBA20](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/iba20/32/67712_2.png) [@IBA20](https://community.letsencrypt.org/u/IBA20)\
**Post date:** [February 11, 2023, 2:39pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-nginx/192642/1 "2023-02-11T14:39:57Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:  
[bakecake.3m.ru](http://bakecake.3m.ru)  
I ran this command:  
certbot --nginx  
It produced this output:  
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:  
Domain: [bakecake.3m.ru](http://bakecake.3m.ru)  
Type: unauthorized  
Detail: 91.200.84.25: Invalid response from [http://bakecake.3m.ru/.well-known/acme-challenge/uA52oCN4\_pIh8fseN\_-jYV5L4yFkfC8SjC6-Pjf7S10:](http://bakecake.3m.ru/.well-known/acme-challenge/uA52oCN4_pIh8fseN_-jYV5L4yFkfC8SjC6-Pjf7S10:) 404  
My web server is (include version):  
nginx/1.22.1  
The operating system my web server runs on is (include version):  
Ubuntu 22.04.1  
My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):  
yes  
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):  
no  
The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):  
certbot 1.32.2

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [February 11, 2023, 2:55pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-nginx/192642/2 "2023-02-11T14:55:12Z")

</div>

Welcome to the community @IBA20

I don't see anything obviously wrong with your DNS or HTTP site. Can you show us the result of the `nginx -T` command? (capital T). Also, please put 3 _backticks_ before and after the output as it will be very long. Like this:

```  
output of: nginx -T  
```

---

<div class="post-metadata">

**Author:** ![IBA20](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/iba20/32/67712_2.png) [@IBA20](https://community.letsencrypt.org/u/IBA20)\
**Post date:** [February 11, 2023, 3:04pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-nginx/192642/3 "2023-02-11T15:04:56Z")

</div>

Hello, Mike!

output of nginx -T:

```plaintext
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:

user nginx;
worker_processes auto;

error_log /var/log/nginx/error.log notice;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    sendfile on;
    #tcp_nopush on;

    keepalive_timeout 65;

    #gzip on;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

# configuration file /etc/nginx/mime.types:

types {
    text/html html htm shtml;
    text/css css;
    text/xml xml;
    image/gif gif;
    image/jpeg jpeg jpg;
    application/javascript js;
    application/atom+xml atom;
    application/rss+xml rss;

    text/mathml mml;
    text/plain txt;
    text/vnd.sun.j2me.app-descriptor jad;
    text/vnd.wap.wml wml;
    text/x-component htc;

    image/avif avif;
    image/png png;
    image/svg+xml svg svgz;
    image/tiff tif tiff;
    image/vnd.wap.wbmp wbmp;
    image/webp webp;
    image/x-icon ico;
    image/x-jng jng;
    image/x-ms-bmp bmp;

    font/woff woff;
    font/woff2 woff2;

    application/java-archive jar war ear;
    application/json json;
    application/mac-binhex40 hqx;
    application/msword doc;
    application/pdf pdf;
    application/postscript ps eps ai;
    application/rtf rtf;
    application/vnd.apple.mpegurl m3u8;
    application/vnd.google-earth.kml+xml kml;
    application/vnd.google-earth.kmz kmz;
    application/vnd.ms-excel xls;
    application/vnd.ms-fontobject eot;
    application/vnd.ms-powerpoint ppt;
    application/vnd.oasis.opendocument.graphics odg;
    application/vnd.oasis.opendocument.presentation odp;
    application/vnd.oasis.opendocument.spreadsheet ods;
    application/vnd.oasis.opendocument.text odt;
    application/vnd.openxmlformats-officedocument.presentationml.presentation
                                                     pptx;
    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
                                                     xlsx;
    application/vnd.openxmlformats-officedocument.wordprocessingml.document
                                                     docx;
    application/vnd.wap.wmlc wmlc;
    application/wasm wasm;
    application/x-7z-compressed 7z;
    application/x-cocoa cco;
    application/x-java-archive-diff jardiff;
    application/x-java-jnlp-file jnlp;
    application/x-makeself run;
    application/x-perl pl pm;
    application/x-pilot prc pdb;
    application/x-rar-compressed rar;
    application/x-redhat-package-manager rpm;
    application/x-sea sea;
    application/x-shockwave-flash swf;
    application/x-stuffit sit;
    application/x-tcl tcl tk;
    application/x-x509-ca-cert der pem crt;
    application/x-xpinstall xpi;
    application/xhtml+xml xhtml;
    application/xspf+xml xspf;
    application/zip zip;

    application/octet-stream bin exe dll;
    application/octet-stream deb;
    application/octet-stream dmg;
    application/octet-stream iso img;
    application/octet-stream msi msp msm;

    audio/midi mid midi kar;
    audio/mpeg mp3;
    audio/ogg ogg;
    audio/x-m4a m4a;
    audio/x-realaudio ra;

    video/3gpp 3gpp 3gp;
    video/mp2t ts;
    video/mp4 mp4;
    video/mpeg mpeg mpg;
    video/quicktime mov;
    video/webm webm;
    video/x-flv flv;
    video/x-m4v m4v;
    video/x-mng mng;
    video/x-ms-asf asx asf;
    video/x-ms-wmv wmv;
    video/x-msvideo avi;
}

# configuration file /etc/nginx/conf.d/default.conf:
server {
    listen 80;
    server_name localhost;

    #access_log /var/log/nginx/host.access.log main;

    location / {
        root /usr/share/nginx/html;
        index index.html index.htm;
    }

    #error_page 404 /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    # proxy_pass http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    # root html;
    # fastcgi_pass 127.0.0.1:9000;
    # fastcgi_index index.php;
    # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
    # include fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    # deny all;
    #}
}

# configuration file /etc/nginx/sites-enabled/bakecake:
server {
  listen bakecake.3m.ru:80;
  location / {
    include '/etc/nginx/proxy_params';
    proxy_pass http://127.0.0.1:8080/;
  }
  location /media/ {
    alias /opt/bakecake/media/;
  }
  location /static/ {
    alias /opt/bakecake/staticfiles/;
  }
}

# configuration file /etc/nginx/proxy_params:
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

```

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [February 11, 2023, 3:12pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-nginx/192642/4 "2023-02-11T15:12:47Z")

</div>

You should include a `server_name` value and I think you should change your `listen` clause also. Like below:

I think the certbot plug-in may not be handling your syntax properly. Below is a more common way to configure a server block.

> [@IBA20](#):
>
> ```nohighlight
> # configuration file /etc/nginx/sites-enabled/bakecake:
> server {
> 
> listen 80;
> server_name bakecake.3m.ru;
> 
> location / {
> include '/etc/nginx/proxy_params';
> proxy_pass http://127.0.0.1:8080/;
> }
> location /media/ {
> alias /opt/bakecake/media/;
> }
> location /static/ {
> alias /opt/bakecake/staticfiles/;
> }
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![IBA20](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/iba20/32/67712_2.png) [@IBA20](https://community.letsencrypt.org/u/IBA20)\
**Post date:** [February 11, 2023, 3:18pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-nginx/192642/5 "2023-02-11T15:18:50Z")

</div>

Thank you!!! Including a `server_name..` solved the problem!

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 11, 2023, 9:49pm UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-nginx/192642/6 "2023-02-11T21:49:19Z")

</div>

Did you also change the `listen` statement?:

`listen bakecake.3m.ru:80;`  
to:  
`listen 80;`

---

<div class="post-metadata">

**Author:** ![IBA20](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/iba20/32/67712_2.png) [@IBA20](https://community.letsencrypt.org/u/IBA20)\
**Post date:** [February 12, 2023, 7:18am UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-nginx/192642/7 "2023-02-12T07:18:54Z")

</div>

Yes. But it works both with listen [bakecake.3m.ru:80](http://bakecake.3m.ru:80) and listen 80.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 12, 2023, 7:30am UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-nginx/192642/8 "2023-02-12T07:30:43Z")

</div>

Using the name there is unnecessary and could be problematic if ever DNS can't properly resolve that name to the local IP address.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [March 14, 2023, 7:30am UTC](https://community.letsencrypt.org/t/certbot-failed-to-authenticate-some-domains-authenticator-nginx/192642/9 "2023-03-14T07:30:46Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.