Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: pictures.go.ro
I ran this command: sudo certbot certonly --webroot -w /var/www/html -d pictures.go.ro
It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for pictures.go.ro
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: pictures.go.ro
Type: unauthorized
Detail: 86.120.33.172: Invalid response from http://pictures.go.ro/.well-known/acme-challenge/10vJj9mn3LWTqZGOBZjmo8ii2EFQuK8VCHCUZhs1Zmo: 404
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version): I'm using prebuilt web servers from immich(Express)
, jellyfin(Kestrel), etc.
The operating system my web server runs on is (include version): Ubuntu 24.04 LTS (GNU/Linux 6.8.0-39-generic x86_64)
My hosting provider, if applicable, is: Self-hosted
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.9.0
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name pictures.go.ro;
root /var/www/html;
# Let's Encrypt verification
location /.well-known/acme-challenge/ {
root /var/www/html;
allow all;
}
# Redirect all HTTP traffic to HTTPS
location / {
return 301 https://$host$request_uri;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name pictures.go.ro;
ssl_certificate /etc/letsencrypt/live/REDACTED/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/REDACTED/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
root /var/www/html;
# Root location (Main Page)
location / {
proxy_pass http://REDACTED:REDACTED;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# Vaultwarden location
location /vaultwarden {
proxy_pass http://REDACTED:REDACTED;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# Jellyfin location
location /jellyfin {
proxy_pass http://REDACTED:REDACTED;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# Error page for blocked access
error_page 403 /blocked.html;
location = /blocked.html {
root /var/www/html;
internal;
}
}
Any help would be greatly appreciated. Cheers!
