# Error creating Certs

**URL:** <https://community.letsencrypt.org/t/error-creating-certs/153213>\
**Category:** Help\
**Created:** [June 5, 2021, 8:12pm UTC](https://community.letsencrypt.org/t/error-creating-certs/153213 "2021-06-05T20:12:29Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![asenges400](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/asenges400/32/43480_2.png) [@asenges400](https://community.letsencrypt.org/u/asenges400)\
**Post date:** [June 5, 2021, 8:12pm UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/1 "2021-06-05T20:12:29Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: [gpostman.com](http://gpostman.com)

I ran this command: certbot --nginx

It produced this output:

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:  
Domain: [gpostman.com](http://gpostman.com)  
Type: unauthorized  
Detail: Invalid response from [http://gpostman.com/.well-known/acme-challenge/A9wjhrFh\_mbt3TxTfoaNwJk90802-gQsx4tQF0JC5ok](http://gpostman.com/.well-known/acme-challenge/A9wjhrFh_mbt3TxTfoaNwJk90802-gQsx4tQF0JC5ok) [167.114.128.25]: "\r\n404 Not Found\r\n\r\n

# 404 Not Found
\r\n
* * *
nginx/1.20.1\</ce"

Domain: [host.gpostman.com](http://host.gpostman.com)  
Type: unauthorized  
Detail: Invalid response from [http://host.gpostman.com/.well-known/acme-challenge/VCXXiQKNECF7NvCRbybS2xex5a5VN84-37msXDwNTeM](http://host.gpostman.com/.well-known/acme-challenge/VCXXiQKNECF7NvCRbybS2xex5a5VN84-37msXDwNTeM) [167.114.128.25]: "\r\n404 Not Found\r\n\r\n

# 404 Not Found
\r\n
* * *
nginx/1.20.1\</ce"

Domain: [wss.gpostman.com](http://wss.gpostman.com)  
Type: unauthorized  
Detail: Invalid response from [http://wss.gpostman.com/.well-known/acme-challenge/yQVyHV8w-x37Qw42Nn1W201ltzEHLzY0lzIZrSbkviU](http://wss.gpostman.com/.well-known/acme-challenge/yQVyHV8w-x37Qw42Nn1W201ltzEHLzY0lzIZrSbkviU) [167.114.128.25]: "\r\n404 Not Found\r\n\r\n

# 404 Not Found
\r\n
* * *
nginx/1.20.1\</ce"

Domain: [www.gpostman.com](http://www.gpostman.com)  
Type: unauthorized  
Detail: Invalid response from [http://www.gpostman.com/.well-known/acme-challenge/WxWP019\_Q-baKqAbs5xo\_tjycPsiLKuSHacVvcpFbWE](http://www.gpostman.com/.well-known/acme-challenge/WxWP019_Q-baKqAbs5xo_tjycPsiLKuSHacVvcpFbWE) [167.114.128.25]: "\r\n404 Not Found\r\n\r\n

# 404 Not Found
\r\n
* * *
nginx/1.20.1\</ce"

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

My web server is (include version): NGINX

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is: VPS

I can login to a root shell on my machine (yes or no, or I don't know): YES

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): CWP

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 1.16.0

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [June 5, 2021, 11:17pm UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/2 "2021-06-05T23:17:26Z")

</div>

Is there any option within CWP to obtain an SSL cert?

If not, maybe we should have a look at the output of:  
`nginx -T`  
`certbot certificates`  
(and the renewal config file)

---

<div class="post-metadata">

**Author:** ![asenges400](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/asenges400/32/43480_2.png) [@asenges400](https://community.letsencrypt.org/u/asenges400)\
**Post date:** [June 6, 2021, 1:18am UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/3 "2021-06-06T01:18:15Z")

</div>

[root@vps-c2000e86 centos]# nginx -T  
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok  
nginx: configuration file /etc/nginx/nginx.conf test is successful

# configuration file /etc/nginx/nginx.conf:

user nobody;  
worker\_processes auto;  
#worker\_rlimit\_nofile 65535;  
error\_log /var/log/nginx/error.log crit;  
pid /var/run/nginx.pid;

events {  
worker\_connections 1024;  
use epoll;  
multi\_accept on;

}  
http {  
sendfile on;  
tcp\_nopush on;  
tcp\_nodelay on;  
client\_header\_timeout 3m;  
client\_body\_timeout 3m;  
client\_max\_body\_size 256m;  
client\_header\_buffer\_size 4k;  
client\_body\_buffer\_size 256k;  
large\_client\_header\_buffers 4 32k;  
send\_timeout 3m;  
keepalive\_timeout 60 60;  
reset\_timedout\_connection on;  
server\_names\_hash\_max\_size 1024;  
server\_names\_hash\_bucket\_size 1024;  
ignore\_invalid\_headers on;  
connection\_pool\_size 256;  
request\_pool\_size 4k;  
output\_buffers 4 32k;  
postpone\_output 1460;

```
include mime.types;
default_type application/octet-stream;

# Compression gzip
gzip on;
gzip_vary on;
gzip_disable "MSIE [1-6]\.";
gzip_proxied any;
gzip_min_length 512;
gzip_comp_level 6;
gzip_buffers 8 64k;
gzip_types text/plain text/xml text/css text/js application/x-javascript application/xml image/png image/x-icon image/gif image/jpeg image/svg+xml application/xml+rss text/javascript application/atom+xml application/javascript application/json application/x-font-ttf font/opentype;

# Proxy settings
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass_header Set-Cookie;
proxy_connect_timeout 300;
proxy_send_timeout 300;
proxy_read_timeout 300;
proxy_buffers 32 4k;
proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m max_size=512m;
proxy_cache_key "$host$request_uri $cookie_user";
proxy_temp_path /var/cache/nginx/temp;
proxy_ignore_headers Expires Cache-Control;
proxy_cache_use_stale error timeout invalid_header http_502;
proxy_cache_valid any 1d;

open_file_cache_valid 120s;
open_file_cache_min_uses 2;
open_file_cache_errors off;
open_file_cache max=5000 inactive=30s;
open_log_file_cache max=1024 inactive=30s min_uses=2;

# SSL Settings
ssl_session_cache shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA!RC4:EECDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS";

# Logs
log_format main '$remote_addr - $remote_user [$time_local] $request '
	                '"$status" $body_bytes_sent "$http_referer" '
	                '"$http_user_agent" "$http_x_forwarded_for"';
log_format bytes '$body_bytes_sent';
#access_log /var/log/nginx/access.log main;
access_log off;

# Cache bypass
map $http_cookie $no_cache {
	default 0;
	~SESS 1;
	~wordpress_logged_in 1;
}

# Include additional configuration
include /etc/nginx/cloudflare.inc;
include /etc/nginx/conf.d/*.conf;

```

}

# configuration file /etc/nginx/mime.types:

types {  
text/html html htm shtml;  
text/css css;  
text/xml xml;  
image/gif gif;  
image/jpeg jpeg jpg;  
application/javascript js;  
application/atom+xml atom;  
application/rss+xml rss;

```
text/mathml mml;
text/plain txt;
text/vnd.sun.j2me.app-descriptor jad;
text/vnd.wap.wml wml;
text/x-component htc;

image/png png;
image/svg+xml svg svgz;
image/tiff tif tiff;
image/vnd.wap.wbmp wbmp;
image/webp webp;
image/x-icon ico;
image/x-jng jng;
image/x-ms-bmp bmp;

font/woff woff;
font/woff2 woff2;

application/java-archive jar war ear;
application/json json;
application/mac-binhex40 hqx;
application/msword doc;
application/pdf pdf;
application/postscript ps eps ai;
application/rtf rtf;
application/vnd.apple.mpegurl m3u8;
application/vnd.google-earth.kml+xml kml;
application/vnd.google-earth.kmz kmz;
application/vnd.ms-excel xls;
application/vnd.ms-fontobject eot;
application/vnd.ms-powerpoint ppt;
application/vnd.oasis.opendocument.graphics odg;
application/vnd.oasis.opendocument.presentation odp;
application/vnd.oasis.opendocument.spreadsheet ods;
application/vnd.oasis.opendocument.text odt;
application/vnd.openxmlformats-officedocument.presentationml.presentation
                                                 pptx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
                                                 xlsx;
application/vnd.openxmlformats-officedocument.wordprocessingml.document
                                                 docx;
application/vnd.wap.wmlc wmlc;
application/x-7z-compressed 7z;
application/x-cocoa cco;
application/x-java-archive-diff jardiff;
application/x-java-jnlp-file jnlp;
application/x-makeself run;
application/x-perl pl pm;
application/x-pilot prc pdb;
application/x-rar-compressed rar;
application/x-redhat-package-manager rpm;
application/x-sea sea;
application/x-shockwave-flash swf;
application/x-stuffit sit;
application/x-tcl tcl tk;
application/x-x509-ca-cert der pem crt;
application/x-xpinstall xpi;
application/xhtml+xml xhtml;
application/xspf+xml xspf;
application/zip zip;

application/octet-stream bin exe dll;
application/octet-stream deb;
application/octet-stream dmg;
application/octet-stream iso img;
application/octet-stream msi msp msm;

audio/midi mid midi kar;
audio/mpeg mp3;
audio/ogg ogg;
audio/x-m4a m4a;
audio/x-realaudio ra;

video/3gpp 3gpp 3gp;
video/mp2t ts;
video/mp4 mp4;
video/mpeg mpeg mpg;
video/quicktime mov;
video/webm webm;
video/x-flv flv;
video/x-m4v m4v;
video/x-mng mng;
video/x-ms-asf asx asf;
video/x-ms-wmv wmv;
video/x-msvideo avi;

```

}

# configuration file /etc/nginx/cloudflare.inc:

# Cloudflare [IP Ranges](https://www.cloudflare.com/ips)

set\_real\_ip\_from 103.21.244.0/22;  
set\_real\_ip\_from 103.22.200.0/22;  
set\_real\_ip\_from 103.31.4.0/22;  
set\_real\_ip\_from 104.16.0.0/12;  
set\_real\_ip\_from 108.162.192.0/18;  
set\_real\_ip\_from 131.0.72.0/22;  
set\_real\_ip\_from 141.101.64.0/18;  
set\_real\_ip\_from 162.158.0.0/15;  
set\_real\_ip\_from 172.64.0.0/13;  
set\_real\_ip\_from 173.245.48.0/20;  
set\_real\_ip\_from 188.114.96.0/20;  
set\_real\_ip\_from 190.93.240.0/20;  
set\_real\_ip\_from 197.234.240.0/22;  
set\_real\_ip\_from 198.41.128.0/17;  
#set\_real\_ip\_from 2400:cb00::/32;  
#set\_real\_ip\_from 2606:4700::/32;  
#set\_real\_ip\_from 2803:f800::/32;  
#set\_real\_ip\_from 2405:b500::/32;  
#set\_real\_ip\_from 2405:8100::/32;  
#set\_real\_ip\_from 2c0f:f248::/32;  
#set\_real\_ip\_from 2a06:98c0::/29;  
real\_ip\_header CF-Connecting-IP;

# configuration file /etc/nginx/conf.d/167.114.128.25.conf:

server {  
listen 167.114.128.25:80;   
server\_name 167.114.128.25;  
access\_log /usr/local/apache/domlogs/167.114.128.25.bytes bytes;  
access\_log /usr/local/apache/domlogs/167.114.128.25.log combined;  
error\_log /usr/local/apache/domlogs/167.114.128.25.error.log error;

```
location / {
	location ~.*\.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|html|htm|txt|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso|woff|ttf|svg|eot|sh)$ {
		root /usr/local/apache/htdocs/;						
		expires max;
		try_files $uri @backend;
	}

	location ~ ^/~(.+?)(/.*)?$ {
		internal;
		proxy_pass http://167.114.128.25:8181;
		include proxy.inc;
	}
	
	error_page 405 = @backend;
	error_page 500 = @custom;
	add_header X-Cache "HIT from Backend";
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location @backend {
	internal;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location @custom {
	internal;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location ~ .*\.(php|jsp|cgi|pl|py)?$ {
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/usr/local/apache/htdocs/;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

location /pma {
	proxy_pass https://127.0.0.1:2031;
	include proxy.inc;
}

location /roundcube {
	proxy_pass https://127.0.0.1:2031;
	include proxy.inc;
}

```

}

# configuration file /etc/nginx/proxy.inc:

# More info here: [GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com](http://wiki.nginx.org/HttpProxyModule)

proxy\_buffering off;  
proxy\_connect\_timeout 59s;  
proxy\_send\_timeout 600;  
proxy\_read\_timeout 600;  
proxy\_buffer\_size 64k;  
proxy\_buffers 16 32k;  
proxy\_busy\_buffers\_size 64k;  
proxy\_temp\_file\_write\_size 64k;  
proxy\_pass\_header Set-Cookie;  
proxy\_redirect off;  
proxy\_hide\_header Vary;  
proxy\_hide\_header X-Powered-By;  
proxy\_set\_header Accept-Encoding '';  
#If you want to get the cache-control and expire headers from apache, comment out 'proxy\_ignore\_headers' and uncomment 'proxy\_pass\_header Expires;' and 'proxy\_pass\_header Cache-Control  
#proxy\_pass\_header Expires;  
#proxy\_pass\_header Cache-Control;  
proxy\_ignore\_headers Cache-Control Expires;  
proxy\_set\_header Referer $http\_referer;  
proxy\_set\_header Host $host;  
proxy\_set\_header Cookie $http\_cookie;  
proxy\_set\_header X-Real-IP $remote\_addr;  
proxy\_set\_header X-Forwarded-Host $host;  
proxy\_set\_header X-Forwarded-Server $host;  
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
proxy\_set\_header X-Forwarded-Proto $scheme;

# configuration file /etc/nginx/conf.d/vhosts.conf:

include /etc/nginx/conf.d/vhosts/\*.conf;

# configuration file /etc/nginx/conf.d/vhosts/gpostman.com.conf:

server {  
listen 167.114.128.25:80;   
server\_name [gpostman.com](http://gpostman.com)[www.gpostman.com](http://www.gpostman.com);

```
access_log /usr/local/apache/domlogs/gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/gpostman.com.log combined;
error_log /usr/local/apache/domlogs/gpostman.com.error.log error;

location / {
	location ~.*\.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|html|htm|txt|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso|woff|ttf|svg|eot|sh|webp)$ {
		root /home/gpostma/public_html;					
		expires max;
		try_files $uri $uri/ @backend;
	}
	
	error_page 405 = @backend;
	error_page 500 = @custom;
	add_header X-Cache "HIT from Backend";
	add_header X-XSS-Protection "1; mode=block" always;
	add_header X-Content-Type-Options "nosniff" always;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location @backend {
	internal;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location @custom {
	internal;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location ~ .*\.(php|jsp|cgi|pl|py)?$ {
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/gpostma/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:80;   
server\_name [webmail.gpostman.com](http://webmail.gpostman.com);

```
access_log /usr/local/apache/domlogs/gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/gpostman.com.log combined;
error_log /usr/local/apache/domlogs/gpostman.com.error.log error;

location / {
	proxy_pass http://127.0.0.1:2095;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/gpostma/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:80;   
server\_name [mail.gpostman.com](http://mail.gpostman.com);

```
access_log /usr/local/apache/domlogs/gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/gpostman.com.log combined;
error_log /usr/local/apache/domlogs/gpostman.com.error.log error;

location / {
	proxy_pass http://127.0.0.1:2095;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/gpostma/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:80;   
server\_name [cpanel.gpostman.com](http://cpanel.gpostman.com);

```
access_log /usr/local/apache/domlogs/gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/gpostman.com.log combined;
error_log /usr/local/apache/domlogs/gpostman.com.error.log error;

location / {
	proxy_pass https://127.0.0.1:2083;
	include proxy.inc;
}

location /pma {
	proxy_pass https://127.0.0.1:2031;
	include proxy.inc;
}

location /roundcube {
	proxy_pass https://127.0.0.1:2031;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/gpostma/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

# configuration file /etc/nginx/conf.d/vhosts/gpostman.com.ssl.conf:

server {  
listen 167.114.128.25:443 ssl ;  
server\_name [gpostman.com](http://gpostman.com)[www.gpostman.com](http://www.gpostman.com);

```
access_log /usr/local/apache/domlogs/gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/gpostman.com.log combined;
error_log /usr/local/apache/domlogs/gpostman.com.error.log error;

ssl_certificate /etc/pki/tls/certs/gpostman.com.bundle;
ssl_certificate_key /etc/pki/tls/private/gpostman.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA!RC4:EECDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 60m;

location / {
	location ~.*\.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|html|htm|txt|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso|woff|ttf|svg|eot|sh|webp)$ {
		root /home/gpostma/public_html;
		expires max;
		try_files $uri $uri/ @backend;
	}
	
	error_page 405 = @backend;
	error_page 500 = @custom;
	add_header X-Cache "HIT from Backend";
	add_header Strict-Transport-Security "max-age=31536000";
	add_header X-XSS-Protection "1; mode=block" always;
	add_header X-Content-Type-Options "nosniff" always;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location @backend {
	internal;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location @custom {
	internal;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location ~ .*\.(php|jsp|cgi|pl|py)?$ {
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/gpostma/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:443 ssl ;   
server\_name [webmail.gpostman.com](http://webmail.gpostman.com);

```
access_log /usr/local/apache/domlogs/gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/gpostman.com.log combined;
error_log /usr/local/apache/domlogs/gpostman.com.error.log error;

ssl_certificate /etc/pki/tls/certs/gpostman.com.bundle;
ssl_certificate_key /etc/pki/tls/private/gpostman.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA!RC4:EECDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 60m;

location / {
	proxy_pass http://127.0.0.1:2095;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/gpostma/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:443 ssl ;   
server\_name [mail.gpostman.com](http://mail.gpostman.com);

```
access_log /usr/local/apache/domlogs/gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/gpostman.com.log combined;
error_log /usr/local/apache/domlogs/gpostman.com.error.log error;

ssl_certificate /etc/pki/tls/certs/gpostman.com.bundle;
ssl_certificate_key /etc/pki/tls/private/gpostman.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA!RC4:EECDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 60m;

location / {
	proxy_pass http://127.0.0.1:2095;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/gpostma/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:443 ssl ;   
server\_name [cpanel.gpostman.com](http://cpanel.gpostman.com);

```
access_log /usr/local/apache/domlogs/gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/gpostman.com.log combined;
error_log /usr/local/apache/domlogs/gpostman.com.error.log error;

ssl_certificate /etc/pki/tls/certs/gpostman.com.bundle;
ssl_certificate_key /etc/pki/tls/private/gpostman.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA!RC4:EECDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 60m;

location / {
	proxy_pass https://127.0.0.1:2083;
	include proxy.inc;
}

location /pma {
	proxy_pass https://127.0.0.1:2031;
	include proxy.inc;
}

location /roundcube {
	proxy_pass https://127.0.0.1:2031;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/gpostma/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

# configuration file /etc/nginx/conf.d/vhosts/wss.gpostman.com.conf:

server {

```
    #if ($host = wss.gpostman.com) {
    # return 301 https://$host$request_uri;
    #} # managed by Certbot

listen 167.114.128.25:80;	
server_name wss.gpostman.com;

access_log /usr/local/apache/domlogs/wss.gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/wss.gpostman.com.log combined;
error_log /usr/local/apache/domlogs/wss.gpostman.com.error.log error;

location / {
	location ~.*\.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|html|htm|txt|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso|woff|ttf|svg|eot|sh|webp)$ {
		root /home/wss/public_html;					
		expires max;
		try_files $uri $uri/ @backend;
	}
	
	error_page 405 = @backend;
	error_page 500 = @custom;
	add_header X-Cache "HIT from Backend";
	add_header X-XSS-Protection "1; mode=block" always;
	add_header X-Content-Type-Options "nosniff" always;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

    location /send {
           proxy_method POST;
           proxy_http_version 1.1;
           proxy_pass http://127.0.0.1:9000/send;
           client_max_body_size 10M;
    }

location @backend {
	internal;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location @custom {
	internal;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location ~ .*\.(php|jsp|cgi|pl|py)?$ {
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/wss/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:80;   
server\_name [webmail.wss.gpostman.com](http://webmail.wss.gpostman.com);

```
access_log /usr/local/apache/domlogs/wss.gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/wss.gpostman.com.log combined;
error_log /usr/local/apache/domlogs/wss.gpostman.com.error.log error;

location / {
	proxy_pass http://127.0.0.1:2095;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/wss/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:80;   
server\_name [mail.wss.gpostman.com](http://mail.wss.gpostman.com);

```
access_log /usr/local/apache/domlogs/wss.gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/wss.gpostman.com.log combined;
error_log /usr/local/apache/domlogs/wss.gpostman.com.error.log error;

location / {
	proxy_pass http://127.0.0.1:2095;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/wss/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:80;   
server\_name [cpanel.wss.gpostman.com](http://cpanel.wss.gpostman.com);

```
access_log /usr/local/apache/domlogs/wss.gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/wss.gpostman.com.log combined;
error_log /usr/local/apache/domlogs/wss.gpostman.com.error.log error;

location / {
	proxy_pass https://127.0.0.1:2083;
	include proxy.inc;
}

location /pma {
	proxy_pass https://127.0.0.1:2031;
	include proxy.inc;
}

location /roundcube {
	proxy_pass https://127.0.0.1:2031;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/wss/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

# configuration file /etc/nginx/conf.d/vhosts/wss.gpostman.com.ssl.conf:

server {  
listen 167.114.128.25:443 ssl ;  
server\_name [wss.gpostman.com](http://wss.gpostman.com);

```
access_log /usr/local/apache/domlogs/wss.gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/wss.gpostman.com.log combined;
error_log /usr/local/apache/domlogs/wss.gpostman.com.error.log error;

ssl_certificate /etc/pki/tls/certs/wss.gpostman.com.bundle;
ssl_certificate_key /etc/pki/tls/private/wss.gpostman.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA!RC4:EECDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 60m;

location / {
	location ~.*\.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|html|htm|txt|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso|woff|ttf|svg|eot|sh|webp)$ {
		root /home/wss/public_html;
		expires max;
		try_files $uri $uri/ @backend;
	}
	
	error_page 405 = @backend;
	error_page 500 = @custom;
	add_header X-Cache "HIT from Backend";
	add_header Strict-Transport-Security "max-age=31536000";
	add_header X-XSS-Protection "1; mode=block" always;
	add_header X-Content-Type-Options "nosniff" always;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location @backend {
	internal;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location @custom {
	internal;
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location ~ .*\.(php|jsp|cgi|pl|py)?$ {
	proxy_pass http://167.114.128.25:8181;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/wss/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:443 ssl ;   
server\_name [webmail.wss.gpostman.com](http://webmail.wss.gpostman.com);

```
access_log /usr/local/apache/domlogs/wss.gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/wss.gpostman.com.log combined;
error_log /usr/local/apache/domlogs/wss.gpostman.com.error.log error;

ssl_certificate /etc/pki/tls/certs/wss.gpostman.com.bundle;
ssl_certificate_key /etc/pki/tls/private/wss.gpostman.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA!RC4:EECDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 60m;

location / {
	proxy_pass http://127.0.0.1:2095;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/wss/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:443 ssl ;   
server\_name [mail.wss.gpostman.com](http://mail.wss.gpostman.com);

```
access_log /usr/local/apache/domlogs/wss.gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/wss.gpostman.com.log combined;
error_log /usr/local/apache/domlogs/wss.gpostman.com.error.log error;

ssl_certificate /etc/pki/tls/certs/wss.gpostman.com.bundle;
ssl_certificate_key /etc/pki/tls/private/wss.gpostman.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA!RC4:EECDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 60m;

location / {
	proxy_pass http://127.0.0.1:2095;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/wss/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

server {  
listen 167.114.128.25:443 ssl ;   
server\_name [cpanel.wss.gpostman.com](http://cpanel.wss.gpostman.com);

```
access_log /usr/local/apache/domlogs/wss.gpostman.com.bytes bytes;
access_log /usr/local/apache/domlogs/wss.gpostman.com.log combined;
error_log /usr/local/apache/domlogs/wss.gpostman.com.error.log error;

ssl_certificate /etc/pki/tls/certs/wss.gpostman.com.bundle;
ssl_certificate_key /etc/pki/tls/private/wss.gpostman.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA!RC4:EECDH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 60m;

location / {
	proxy_pass https://127.0.0.1:2083;
	include proxy.inc;
}

location /pma {
	proxy_pass https://127.0.0.1:2031;
	include proxy.inc;
}

location /roundcube {
	proxy_pass https://127.0.0.1:2031;
	include proxy.inc;
}

location ~ /\.ht {deny all;}
location ~ /\.svn/ {deny all;}
location ~ /\.git/ {deny all;}
location ~ /\.hg/ {deny all;}
location ~ /\.bzr/ {deny all;}

disable_symlinks if_not_owner from=/home/wss/public_html;

location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

}

---

<div class="post-metadata">

**Author:** ![asenges400](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/asenges400/32/43480_2.png) [@asenges400](https://community.letsencrypt.org/u/asenges400)\
**Post date:** [June 6, 2021, 1:19am UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/4 "2021-06-06T01:19:53Z")

</div>

[root@vps-c2000e86 centos]# certbot certificates  
Saving debug log to /var/log/letsencrypt/letsencrypt.log

* * *

No certificates found.

* * *

---

<div class="post-metadata">

**Author:** ![asenges400](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/asenges400/32/43480_2.png) [@asenges400](https://community.letsencrypt.org/u/asenges400)\
**Post date:** [June 6, 2021, 1:20am UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/5 "2021-06-06T01:20:41Z")

</div>

I must say that this is a fresh new installation.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [June 6, 2021, 5:06am UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/6 "2021-06-06T05:06:17Z")

</div>

I'm not sure what this code does exactly:  
[where did you get it from?]  
[it has "apache" in the path and yet the server is running `nginx`]

> [@asenges400](#):
>
> ```nohighlight
> location /.well-known/acme-challenge {
> default_type "text/plain";
> alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
> }
> 
> ```

And where/how did you get this LE cert?:  
[you say it's a new install and `certbot` shows no certs - what are we missing?]

> [@asenges400](#):
>
> ```nohighlight
> ssl_certificate /etc/pki/tls/certs/gpostman.com.bundle;
> ssl_certificate_key /etc/pki/tls/private/gpostman.com.key;
> 
> ```

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [June 6, 2021, 6:06am UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/7 "2021-06-06T06:06:45Z")

</div>

Could this be a problem with a conflict between the control panel's management of the site and manual command-line management, like CWP did _something_ related to certificates?

---

<div class="post-metadata">

**Author:** ![asenges400](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/asenges400/32/43480_2.png) [@asenges400](https://community.letsencrypt.org/u/asenges400)\
**Post date:** [June 6, 2021, 1:04pm UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/8 "2021-06-06T13:04:40Z")

</div>

Yes I did a previous bad installation so I get everything done from the scratch again. I'm using Apache2 + Nginx as reverse proxy. But I guess all the problem is the vhost conf I'm using. But I don't know how to fix it.

---

<div class="post-metadata">

**Author:** ![asenges400](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/asenges400/32/43480_2.png) [@asenges400](https://community.letsencrypt.org/u/asenges400)\
**Post date:** [June 6, 2021, 5:57pm UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/9 "2021-06-06T17:57:31Z")

</div>

I guess the problem is here:

When I look for Token on my domain it is there  
[root@vps-c2000e86 vhosts]# ls -a /home/wss/public\_html/.well-known/pki-validation/  
. .. 0F330168792F1B1B953CA77F86840816.txt

But in the vhost there is this one pointing here whicj is not.

location /.well-known/acme-challenge {  
default\_type "text/plain";  
alias /usr/local/apache/autossl\_tmp/.well-known/acme-challenge;  
}

[root@vps-c2000e86 vhosts]# ls -a /usr/local/apache/autossl\_tmp/.well-known/acme-challenge  
. ..

---

<div class="post-metadata">

**Author:** ![asenges400](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/asenges400/32/43480_2.png) [@asenges400](https://community.letsencrypt.org/u/asenges400)\
**Post date:** [June 6, 2021, 6:02pm UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/10 "2021-06-06T18:02:52Z")

</div>

I try copying my TOKEN into /usr/local/apache/autossl\_tmp/.well-known/acme-challenge/ but Im still getting the same error.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [June 7, 2021, 8:39am UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/11 "2021-06-07T08:39:36Z")

</div>

> [@asenges400](#):
>
> [root@vps-c2000e86 vhosts]# ls -a /home/wss/public\_html/.well-known/pki-validation/

`/.well-known/pki-validation` is different from `/.well-known/acme-challenge`.

The former is used by other CAs, but never by Let's Encrypt.

```nohighlight
location /.well-known/acme-challenge {
	default_type "text/plain";
	alias /usr/local/apache/autossl_tmp/.well-known/acme-challenge;
}

```

I wouldn't be surprised if this directive conflicted with what Certbot is trying to do, since Certbot adds a very similar directive except pointing to its own temporary directory (not `autossl_tmp`, autossl being some other non-Certbot software). Perhaps the autossl one is taking precedence here because it's so specific, or something.

I'm not going to criticize autossl here because of the "people who live in glass houses shouldn't throw stones" principle—after all, if you use Certbot to get certificates and then uninstall it, it doesn't remove its changes to your web server configuration—but you have a very complex configuration that includes some specific things related to other non-Certbot tooling that you have previously used to get certificates on this server. (I mean both the nginx directive above and whatever references you have to `/.well-known/pki-validation` that must have been used by software, maybe also autossl, interacting with a _different_ CA!) In order for Certbot to work, you may need to first undo some of the peculiarities that relate to other software.

@rg305's question about how this reference to Apache got into your nginx configuration is also one that I'm really curious about. 🙂

---

<div class="post-metadata">

**Author:** ![JimPas](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jimpas/32/33270_2.png) [@JimPas](https://community.letsencrypt.org/u/JimPas)\
**Post date:** [June 8, 2021, 1:32am UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/12 "2021-06-08T01:32:06Z")

</div>

See the path below where certbot is looking for the challenge? Hint, hint. 🙂 That's where the challenge file Certbot _expected_ it to be and why the challenge continues to fail. You got the same error for each of your subdomains as well.

Invalid response from [http://gpostman.com/.well-known/acme-challenge/A9wjhrFh\_mbt3TxTfoaNwJk90802-gQsx4tQF0JC5ok](http://gpostman.com/.well-known/acme-challenge/A9wjhrFh_mbt3TxTfoaNwJk90802-gQsx4tQF0JC5ok) [167.114.128.25]: "\r\n404 Not Found\r\n\r\n

I see that a **CentOS-WebPanel** test page shows up on `host.gpostman.com`. I haven't looked at the other subdomains. Here's a result of [gpostman.com](http://gpostman.com) scan from last night using Juergen's software.

[https://check-your-website.server-daten.de/?i=be85b72b-618f-4667-95cb-160640e07eb6](https://check-your-website.server-daten.de/?i=be85b72b-618f-4667-95cb-160640e07eb6)

I see you have TLS1.0, 1.1 & 1.2 enabled in your encryption protocol list. TLS1.0 should definitely be removed as it's been deprecated for quite some time. For TLS1.1, meh, keep only if you have users with older browsers. But v1.1 is also deprecated and really should not be used. Otherwise, TLS1.2 is what you should be using.

---

<div class="post-metadata">

**Author:** ![Nummer378](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nummer378/32/49862_2.png) [@Nummer378](https://community.letsencrypt.org/u/Nummer378)\
**Post date:** [June 8, 2021, 9:48pm UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/13 "2021-06-08T21:48:17Z")

</div>

> [@JimPas](#):
>
> For TLS1.1, meh, keep only if you have users with older browsers.

Most orgs have deprecated TLS 1.1 too, so if you consider 1.0 outdated, 1.1 is too.

Also, TLS 1.2 is only two years younger than TLS 1.1. I haven't seen a single client in 2020/2021 that spoke TLS 1.1, but not TLS 1.2\*. There are very, very old things out there that still do SSLv2/v3/TLS1.0, but in all of my research I did not encounter a single internet-facing client that advertised 1.1 as highest available (except clients that were manually configured this way).

For servers this is also backed up by [SSL Labs data](https://www.ssllabs.com/ssl-pulse/), as only 4 servers are known where 1.1 is best protocol available - I presume those 4 machines are test systems.

In security terms, TLS 1.1 is only slightly better than 1.0 and is nowhere as hardened as 1.2 (e.g 1.1 does not have AEAD support). 1.1 was basically a patch release for 1.0 to fix some CBC and padding issues.

Remember that TLS 1.2 is almost thirteen years old. Sadly, clients were slow to adopt TLS 1.2, but since 2013/2014 TLS 1.2 was widely supported in all major browsers and I see no excuse for running a 9 year old browser today.

\*Many TLS implementations such as NSS in Firefox or OpenSSL turned on TLS 1.1 & 1.2 support at the same time, which is likely one of the reasons why "1.1 only" is so rare.

---

<div class="post-metadata">

**Author:** ![JimPas](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jimpas/32/33270_2.png) [@JimPas](https://community.letsencrypt.org/u/JimPas)\
**Post date:** [June 9, 2021, 1:41am UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/14 "2021-06-09T01:41:46Z")

</div>

> [@JimPas](#):
>
> But v1.1 is also deprecated and really should not be used. Otherwise, TLS1.2 is what you should be using.

True, that's why these were my last two sentences. 😉

> [@Nummer378](#):
>
> ... I see no excuse for running a 9 year old browser today.

I agree. Backward compatability is a terrible thing when the whole world doesn't move on. But the wheels of change turn slowly.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [June 9, 2021, 2:33am UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/15 "2021-06-09T02:33:01Z")

</div>

> [@Nummer378](#):
>
> \*Many TLS implementations such as NSS in Firefox or OpenSSL turned on TLS 1.1 & 1.2 support at the same time, which is likely one of the reasons why "1.1 only" is so rare.

Yeah, I remember being surprised by that at the time, like "wow, you implemented two new versions, not just one—that was quick!".

---

<div class="post-metadata">

**Author:** ![asenges400](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/asenges400/32/43480_2.png) [@asenges400](https://community.letsencrypt.org/u/asenges400)\
**Post date:** [June 9, 2021, 9:43am UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/16 "2021-06-09T09:43:32Z")

</div>

Ok people but this is not helping too much I have installed others certs over same configured machines. This time I ran over failure and I need to figure out the real problem. I guess it's about a path missing or something like that.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [June 9, 2021, 8:38pm UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/17 "2021-06-09T20:38:49Z")

</div>

Please confirm the usability of this location:

> [@asenges400](#):
>
> location /.well-known/acme-challenge {  
> default\_type "text/plain";  
> alias /usr/local/apache/autossl\_tmp/.well-known/acme-challenge;  
> }

Place a `test-file-1234` in that alias location and let's see if it can be reached via the following:  
`http://gpostman.com/.well-known/acme-challenge/test-file-1234`  
OR  
`http://host.gpostman.com/.well-known/acme-challenge/test-file-1234`

---

<div class="post-metadata">

**Author:** ![asenges400](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/asenges400/32/43480_2.png) [@asenges400](https://community.letsencrypt.org/u/asenges400)\
**Post date:** [June 9, 2021, 10:04pm UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/18 "2021-06-09T22:04:14Z")

</div>

[root@vps-c2000e86 acme-challenge]# pwd  
/home/gpostma/public\_html/.well-known/acme-challenge  
[root@vps-c2000e86 acme-challenge]# ll  
total 0  
-rw-r--r-- 1 root root 0 Jun 9 20:59 test-file-1234  
[root@vps-c2000e86 acme-challenge]# cd ..  
[root@vps-c2000e86 .well-known]# cd ..  
[root@vps-c2000e86 public\_html]# touch hola  
[root@vps-c2000e86 public\_html]# chmod 755 .well-known/  
[root@vps-c2000e86 public\_html]# chmod 755 .well-known/acme-challenge/

[root@vps-c2000e86 public\_html]# chmod 755 .well-known/acme-challenge/test-file-1234

But still 404 under .well-known/

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [June 9, 2021, 10:08pm UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/19 "2021-06-09T22:08:09Z")

</div>

> [@asenges400](#):
>
> /home/gpostma/public\_html/.well-known/acme-challenge

Doesn't seem to equal:

> [@asenges400](#):
>
> /usr/local/apache/autossl\_tmp/.well-known/acme-challenge

Or am I missing something?

---

<div class="post-metadata">

**Author:** ![asenges400](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/asenges400/32/43480_2.png) [@asenges400](https://community.letsencrypt.org/u/asenges400)\
**Post date:** [June 9, 2021, 10:08pm UTC](https://community.letsencrypt.org/t/error-creating-certs/153213/20 "2021-06-09T22:08:25Z")

</div>

I also replace the location /.well-known entry

location /.well-known/acme-challenge {  
default\_type "text/plain";  
allow all;  
#alias /usr/local/apache/autossl\_tmp/.well-known/acme-challenge;  
alias /home/gpostman/public\_html/.well-known/acme-challenge;

}

But still reporting 404

[Next page](https://community.letsencrypt.org/t/error-creating-certs/153213.md?page=2)