My domain is:
metalfans.be
I ran this command:
certbot renew
It produced this output:
Simulating renewal of an existing certificate for metalfans.be
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: metalfans.be
Type: unauthorized
Detail: 2a01:4f8:c2c:b6bb::1: Invalid response from http://metalfans.be/.well-known/acme-challenge/uDdjgvmEzQYwdyPNq418b5NwiYAvwE5U8F47xDIpPtY: 404
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
Failed to renew certificate metalfans.be with error: Some challenges have failed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
All simulated renewals failed. The following certificates could not be renewed:
/pathtocert/metalfans.be/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)
My web server is (include version):
nginx/1.22.1
varnish-7.1.1
The operating system my web server runs on is (include version):
debian 12
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 2.8.0
My server is running a nginx that handles the ssl termination for Varnish and sends the request back to the backend. This is a setup that worked for years on my old server, and now when we moved to a new server, where we started with a clean setup, it does not seem to work when running cerbot renew.
Running: certbot renew --dry-run --cert-name metalfans.be --authenticator webroot --webroot-path /var/www/metalfans.be/web works, running certbot renew without the extra parameters does not work.
Relevant part of the Nginx config:
server {
listen 78.46.226.218:443 ssl http2;
listen [::1]:443 ssl http2;
server_name www.metalfans.be;
#ssl on;
ssl_certificate /etc/letsencrypt/live/metalfans.be/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/metalfans.be/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/metalfans.be/chain.pem;
include /etc/nginx/ssl/ssl.conf;
return 301 https://metalfans.be$request_uri;
}
server {
listen 78.46.226.218:443 ssl http2;
listen [::1]:443 ssl http2;
ssl_certificate /etc/letsencrypt/live/metalfans.be/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/metalfans.be/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/metalfans.be/chain.pem;
include /etc/nginx/ssl/ssl.conf;
server_name metalfans.be;
########
#limits#
########
#include /etc/nginx/bots.d/blockbots.conf;
#include /etc/nginx/bots.d/ddos.conf;
location / {
proxy_set_header Connection "";
proxy_http_version 1.1;
proxy_pass http://127.0.0.1:80;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header HTTPS "on";
proxy_read_timeout 150;
}
}
server {
listen *:8084;
server_name metalfans.be *.metalfans.be;
root /var/www/metalfans.be/web;
# Allow "Well-Known URIs" as per RFC 5785
location ~* ^/.well-known/ {
allow all;
}
<rest of the server block that handles the php requests.>
Contents of the renew config file:
cat metalfans.be.conf
# renew_before_expiry = 30 days
version = 2.8.0
archive_dir = /etc/letsencrypt/archive/metalfans.be
cert = /etc/letsencrypt/live/metalfans.be/cert.pem
privkey = /etc/letsencrypt/live/metalfans.be/privkey.pem
chain = /etc/letsencrypt/live/metalfans.be/chain.pem
fullchain = /etc/letsencrypt/live/metalfans.be/fullchain.pem
# Options used in the renewal process
[renewalparams]
account = ID removed
authenticator = nginx
installer = nginx
server = https://acme-v02.api.letsencrypt.org/directory
key_type = ecdsa
