Hello all. Been using an SSL cert granted by certbot for quite a while now. However, I now find it is rejected by browsers as an invalid "self signed" cert.
Bypassing warning gives nginx 401 refusal page.
I have not changed anything and rerunning certbot does not fix the issue.
Can anyone help me figure out what broke?
My domain is: winged-horse.fyi
I ran this command:
It produced this output:
My web server is (include version): nginx/1.28.0
The operating system my web server runs on is (include version): arch
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 5.0.0
Something in your web server configuration would be the obvious guess. Your domain doesn't seem to be accessible from the public Internet, so it's pretty hard to say anything further.
my domain works absolutely fine from the public internet, it has more going on than https. like plain http access for the same site (i serve only static html and do not strictly need security except for browsers who won't load traditional http sources) and a number of other non web hosted services.
I just ran nginx -t and got this wonderful delight:
Your domain doesn't seem to be accessible from the public Internet,
And then posted a screenshot which you believed proved that it isn't.
Ping would show that the domain is, in fact, accessible from the public internet.
You are right though in that I most certainly don't need help from someone who unwittingly demonstrates they don't know how to check a URL exists or not, and then digs himself into a hole over it. Checking if a URL exists is the easy part of the problem.
Sure thing, the conf file is pretty long so I've put it in a pastebin to keep the thread clutter free:
Here's the full output of nginx -t
2025/11/17 00:01:02 [warn] 3480#3480: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:1
2025/11/17 00:01:02 [warn] 3480#3480: could not build optimal types_hash, you should increase either types_hash_max_size: 1024 or types_hash_bucket_size: 64; ignoring types_hash_bucket_size
2025/11/17 00:01:02 [emerg] 3480#3480: cannot load certificate "/etc/letsencrypt/live/winged-horse.fyi/fullchain.pem": BIO_new_file() failed (SSL: error:8000000D:system library::Permission denied:calling fopen(/etc/letsencrypt/live/winged-horse.fyi/fullchain.pem, r) error:10080002:BIO routines::system lib)
nginx: configuration file /etc/nginx/nginx.conf test failed
Me and presumably others are getting a timeout error when trying to connect to https.
You're on certbot 5.0.0. The 5.1.0 release notes say this:
Fixed a bug in certbot-nginx that'd leave nginx configured with self-signed
certificates if a user ran certbot enhance and they didn't have matching
SSL server blocks. certbot enhance now requires the user to have a matching
SSL server block to enable HSTS or OCSP stapling enhancements.
So that could be the cause of your issue. And upgrading might fix it going forward. (Although I'm not sure how you'd get out of this broken state. May have to force a renewal or search on the filesystem for the correct cert/key and move it over manually)
The error in nginx -t could just be because the command is running as a user that's not authorised to acces the file. (The NGINX service probably can access it, although it'd be good to verify this. I'd not expect nginx to start/reload successfully if it weren't able to.)
Your nginx config has two HTTP server blocks. One has a listen 80; directive the other has no such directive but the default nginx behaviour is:
If the directive is not present then either *:80 is used if nginx runs with the superuser privileges, or *:8000 otherwise.
So you might have two server blocks configured to use port 80. That's probably not the cause of your issue, but it'd be good to fix this.
What does sudo nginx -t say?
Can you share the certificate that nginx returns? I can't access the site over https but seeing the cert might help narrow down where the issue is coming from.
2025/11/17 00:49:13 [warn] 1408#1408: could not build optimal types_hash, you should increase either types_hash_max_size: 1024 or types_hash_bucket_size: 64; ignoring types_hash_bucket_size
2025/11/17 00:49:13 [warn] 1408#1408: conflicting server name "winged-horse.fyi" on 0.0.0.0:80, ignored
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
