Certbot: Invalid response http://www.example.org/.well-known/acme-challenge

Help
22 
root        3366       1  0 Jun24 ?        00:00:00 nginx: master process /usr/local/nginx/sbin/nginx
www-data    3367    3366  0 Jun24 ?        00:00:00 nginx: worker process
www-data    3368    3366  0 Jun24 ?        00:00:01 nginx: worker process
www-data    3369    3366  0 Jun24 ?        00:00:00 nginx: worker process
www-data    3370    3366  0 Jun24 ?        00:00:00 nginx: worker process
www-data    3371    3366  0 Jun24 ?        00:00:04 nginx: cache manager process
23

That looks correct.

hmm...

You tried using:
listen 80;
? ? ?

3 Likes
24

Here the new conf:

server {
listen 80;
listen [::]:80 ipv6only=on default_server;
  server_name bitwarden.walrussi.com; #Change this to your domain name
}


server {
  listen 443 ssl http2;
  server_name bitwarden.walrussi.com; #Change this to your domain name
    ssl_certificate /etc/letsencrypt/live/bitwarden.walrussi.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/bitwarden.walrussi.com/privkey.pem; # managed by Certbot

  ssl_dhparam /etc/ssl/certs/dhparam.pem;

  # Allow large attachments
  client_max_body_size 128M;

  location / {
    proxy_pass http://0.0.0.0:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location /notifications/hub {
    proxy_pass http://0.0.0.0:3012;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
  }

  location /notifications/hub/negotiate {
    proxy_pass http://0.0.0.0:8080;
  }

location ~ /.well-known/acme-challenge/ {
    allow all;
}
}

You seem to be puzzling too, probably something simple haha.

25

Like most magic tricks... it always is!

3 Likes
26

But it helps that I'm not totally blind. It could have been something everybody sees at first sight and only I struggle.

27

Please show:
nginx -T | grep -Ei 'listen|server_name'

2 Likes
28

So there are all my domains but probably that's not a problem:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;
#		listen     localhost:110;
#		listen     localhost:143;
listen 80;
listen [::]:80 ipv6only=on default_server;  
  server_name bitwarden.walrussi.com; #Change this to your domain name
  listen 443 ssl http2;
  server_name bitwarden.walrussi.com; #Change this to your domain name
   server_name calmingsurround.de;
    listen 443 ssl; 
#listen 80;
#   server_name calmingsurround.de;
#    listen 80;
#   server_name nextcloud.walrussi.com;       	
#  return 301 https://$server_name$request_uri;
    listen 443 ssl;
    server_name nextcloud.walrussi.com;
    listen 443 ssl;
    server_name onlyoffice.walrussi.com;
   server_name pitlivesforever.de;
    listen 443 ssl;
#listen 80;
#   server_name pitlivesforever.de;
   server_name walrussi.com;
    listen 443 ssl; # managed by Certbot
#listen 80;
#   server_name walrussi.com;
29

Try removing this line:

2 Likes
30

After removing and restarting with systemctl restart ngingx.service this is the output, again...

nginx[1940247]: nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Unknown error)

31

Try temporarily changing that name to anything else.

[this is my last attempt in resolving this - I'm out of ideas]

2 Likes
32

Sadly doesn't work. But thanks alot for your help! Especially because this is an nginx matter.

2 Likes
33

That isn't the nginx server that is replying. The port 80 response includes a set-cookie which isn't visible in that server block (at least I didn't see one).

Also, the version number is 1.22 but you said yours was 1.18

There must be something in front of that server. Is there some sort of service at your hosting company to inspect incoming requests?

Or, the DNS IP isn't pointing to the right server (I didn't read every post to see if you've checked that)

curl -i bitwarden.walrussi.com
HTTP/1.1 500 Internal Server Error
Server: nginx/1.22.0
Date: Thu, 29 Jun 2023 19:27:48 GMT
Set-Cookie: route=6fc78612f4af1269e1e36673b8f87cee; Expires=Fri, 30-Jun-2023 03:27:48 GMT; Path=/
4 Likes
34

When I run : nginx -v

this comes out:
nginx version: nginx/1.18.0 (Ubuntu)

With DNS IP you mean if the IP the Domain directs is the same as my VPS right?

I checked and it directs to the right address.

When I ping it the right IP is shown.

35

Can you show result of this? Let's make sure we're talking about same IP

curl -4 https://ifconfig.io

That answer should match this number

dig +noall +answer A bitwarden.walrussi.com
bitwarden.walrussi.com. 273     IN      A       92.205.16.206

Do you see the different nginx version in the response header?

Do you have anything else that might see requests to that IP before your 1.18 nginx server?

3 Likes
36

curl -4 https://ifconfig.io
92.205.16.206

37

The IP is right and Rudy looked at plenty of things.

I don't know what else to suggest other than it looks like some other nginx system is responding and not your 1.18 version one.

Maybe talk to your hosting service or a forum devoted to your particular configuration.

4 Likes
38

Okay thank you! I already posted a stack overflow post.

I will contact my hosts but I don't think they are the problem. They didn't do anything and I already got it working since I want to renew the certificates not add new ones.

But thank you for everything!

2 Likes
39

How are you running bitwarden? Is it through docker by any chance?

3 Likes
40

Yes it is.

41

I don't have any insight how this container is made, but I suspect it's nginx inside the container that listens on port 80.

2 Likes