I have a simple nginx setup that was working well for dev.camsync.io. Now I'm trying to add a few variants of that domain name, and I'm running into issues. At first I added camsync.io to my same nginx config file, and ran certbot. It prompted me to set up both those domains, then prompted me to (E)xpand the existing cert which covered dev.. I canceled out of that, and made more changes to my nginx config, wanting to separate *dev.camsync.io and *camsync.io configurations.
I had two server blocks in my nginx config; the HTTP/port 80 stuff to serve up .well-known and redirect everything else to HTTPS, and the HTTPS block for dev.camsync.io:
server {
listen [::]:443 ssl;
listen 443 ssl;
server_name dev.camsync.io;
ssl_certificate /etc/letsencrypt/live/dev.camsync.io/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/dev.camsync.io/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
# Serve up any static assets that exist here…
root /var/www/dev.camsync.io/;
location / {
try_files $uri $uri/ $uri/index.html @proxy;
}
# Everything else goes to the API webapp running in a Docker container…
location @proxy {
proxy_pass http://127.0.0.1:8888;
proxy_pass_header Server;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 3s;
proxy_read_timeout 10s;
}
}
I duplicated that block and removed all the dev. bits in it (paths, everything) hoping certbot would see it and create the appropriate files on disk under /etc/letsencrypt/live. It didn't like that, so I commented that block out, and decided to kill the server and just run certbot standalone to create files for two of the domains.
My domain is: camsync.io, api.camsync.io
I ran this command:
certbot certonly --nginx -d camsync.io -d api.camsync.io
It produced this output:
# sudo certbot certonly --standalone -d camsync.io -d api.camsync.io
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for camsync.io and api.camsync.io
Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems:
Domain: api.camsync.io
Type: unauthorized
Detail: 2606:50c0:8000::153: Invalid response from http://api.camsync.io/.well-known/acme-challenge/I26fIA6BL6zn7Gl5kYciPgh0Mwp99WY2dqZbKtVN9tQ: 404
Domain: camsync.io
Type: unauthorized
Detail: 2606:50c0:8002::153: Invalid response from http://camsync.io/.well-known/acme-challenge/ub8e5tPwmiqKeBvc4zzjXJ3fdq3OnO0OXr1grdSG4DE: 404
Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet.
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version): standalone
The operating system my web server runs on is (include version): Ubuntu 22.04
My hosting provider, if applicable, is: DigitalOcean
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
# certbot --version
certbot 2.6.0
Certbot log here.
I went back to trying to run it via Nginx, but alas I've tried 5 times and letsencrypt.org is throttling me (frustrating), figuring I'd try webroot instead.
I’ve checked to make sure nothing is running on port 80 using curl.
UPDATE: Trying with webroot and nginx running, it created a cert for api.dev.camsync.io. I'm still throttled for the other domains. I had to be explicit about the root directory, which didn't exist and I had to create it. What does certbot default to when invoked with --nginx?