Certbot NGINX Cloudflare Issue

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
music.jordanpicton.xyz

I ran this command:
sudo certbot -v --nginx -d jordanpicton.xyz

It produced this output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Requesting a certificate for jordanpicton.xyz
Performing the following challenges:
http-01 challenge for jordanpicton.xyz
Waiting for verification...
Challenge failed for domain jordanpicton.xyz
http-01 challenge for jordanpicton.xyz

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
  Domain: jordanpicton.xyz
  Type:   unauthorized
  Detail: The key authorization file from the server did not match this challenge. Expected "C0eBdELqUFvSskRWK9LN9uU5uL1UW05iXnocGjYHWxI.1p5yWDAxv8N_XD8Ic93lZEnYnYbWFwVdeJ5aZh5T9uI" (got "X-Frame-Options: SAMEORIGIN\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode")

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version):

Distributor ID: Ubuntu
Description:    Ubuntu 24.04.4 LTS
Release:        24.04
Codename:       noble
nginx version:  nginx/1.28.2
certbot:        2.9.0

The operating system my web server runs on is (include version):
Ubuntu

My hosting provider, if applicable, is:
Myself.

I can login to a root shell on my machine (yes or no, or I don't know):
Yes.

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No.

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 2.9.0

2

There appears to be something sending

X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'; scrip

as the page body when you request http://jordanpicton.xyz/.well-known/acme-challenge/C0eBdELqUFvSskRWK9LN9uU5uL1UW05iXnocGjYHWxI.1p5yWDAxv8N_XD8Ic93lZEnYnYbWFwVdeJ5aZh5T9uI, try searching your configuration for this as these fields should not be in the body of a 302 response (or any response).

1 Like
4

Yeah sorry I meant the music.jordanpicton.xyz.
This was all working before I updated and now I've got multiple issues across a bunch of domains.

But fun to see that I've caused another issue haha.
I'm not fully sure what you're asking me to do here in all honestly.

The only domain I got certbot to work with would have been my forums one when I setup Discourse, which is currently broken as well because of my updates.

Though I most likely have broken the NGINX side of things more than anything really. As some work and then others don't, I was honestly just trying to secure things up a little more but don't know much about this stuff so I've messed up haha.

5

Isn't that Cloudflares doing instead of nginx?

1 Like
6

With Cloudflare I have full-strict on along with an edge certificate, automatic https rewrites enabled, and universal ssl.

7

Your Content Security Policy header shouldn't contain any newlines (RFC 9110: HTTP Semantics) and have you tried running certbot with the correct subdomain?

1 Like
8

Yeah I tried the music subdomain with a similar response.

9

From what I can see there doesn't seem to be new lines within my CSP either.

10

I tried to fetch the challenge over HTTP using nc and here's what I got

GET /.well-known/acme-challenge/C0eBdELqUFvSskRWK9LN9uU5uL1UW05iXnocGjYHWxI.1p5yWDAxv8N_XD8Ic93lZEnYnYbWFwVdeJ5aZh5T9uI HTTP/1.0
Host: music.jordanpicton.xyz

HTTP/1.1 404 Not Found
Server: nginx/1.28.2
Date: Sat, 14 Feb 2026 11:39:21 GMT
Content-Type: text/html
Content-Length: 153
Connection: close
Content-Security-Policy: 
    default-src 'self';
    script-src 'self' 'unsafe-inline';
    style-src 'self' 'unsafe-inline' blob:;
    img-src 'self' data: blob:
        https://www.teamspeak.com
        https://res.cloudinary.com;
    font-src 'self' data:;
    connect-src 'self' wss:;
    manifest-src 'self' data:;
    object-src 'none';
    base-uri 'self';
    frame-ancestors 'none';


<html>
<head><title>404 Not Found</title></head>
<body>
<center><h1>404 Not Found</h1></center>
<hr><center>nginx/1.28.2</center>
</body>
</html>
2 Likes
11

Yeah I'm kind of rethinking everything at the moment since I've got certbot applying a certificate for my forums which did work until the updates. But the rest of my domains where going through cloudflare and manually assigning the certs.

So I'm going to sit back view my options and setup something better hopefully. I'd like to use certbot I think because of Discourse using it but if I could I'd probably use cloudflare for it but I've just got to see what I can do really.

12

Have you considered using a Cloudflare Origin CA certificate for your server? Those are very easy to setup. And, do not require using Certbot (or any other standalone ACME Client) to get or renew a cert.

You get this cert from Cloudflare and can set its expiration far in the future. This Origin CA cert is only good for domains proxied at Cloudflare.

5 Likes
13

I was using these originally for my websites though the forums certbot one was broken mostly. Plus I wouldn't say my network is the best when it comes to security so I removed it all and started to redo most of it a few hours ago.

Though I'd be looking for sysadmin help honestly as I'd want to make sure I'm doing what I can though I'm not sure where I'd start or where to find the help. But safe to say I'm not using certbot anymore currently.

Thanks for the help everyone. :slight_smile:

2 Likes