Error generating certificate with certbot command. Help

[JH-Kim88]

I am trying to generate a certificate using the web server method.
The default(80/443) ddns.net is occupied by NAS. So you need to use a different port.

$ sudo certbot --nginx -d xxxx.ddns.net:18080 -v

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Requesting a certificate for xxxx.ddns.net:18080
Performing the following challenges:
http-01 challenge for xxxx.ddns.net
Waiting for verification...
Challenge failed for domain xxxx.ddns.net
http-01 challenge for xxxx.ddns.net

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
  Domain: xxxx.ddns.net
  Type:   unauthorized
  Detail: xxx.xxxx.xxx.xxx: Invalid response from http://xxxx.ddns.net/.well-known/acme-challenge/SbXU_DWIEH1hljJ7PxhP5XGQkSZSoATvdjhVKBCqtoI: 404

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

It is not normally created like this.

Below is the nginx configuration.

nginx.conf
server {
        listen 18080 default_server;
        listen [::]:18080 default_server;

        root /var/www/html;
        index index.nginx-debian.html;
        server_name xxxx.ddns.net;
        location / {
                try_files $uri $uri/ =404;
        }

Please let me know if this problem is because the port of the address is not recognized or if I need to do another option. [ ex : http://xxxx.ddns.net/.well-known/acme-challenge/SbXU_DWIEH1hljJ7PxhP5XGQkSZSoATvdjhVKBCqtoI
-> http://xxxx.ddns.net:18080/.well-known/acme-challenge/SbXU_DWIEH1hljJ7PxhP5XGQkSZSoATvdjhVKBCqtoI ]

[rg305]

Hi @JH-Kim88, and welcome to the LE community forum

HTTP-01 authentication must be done on port 80.
TLS-APLN-01 authentication must be done on port 443.

@JH-Kim88

The default(80/443) ... is occupied by NAS.

That leaves you with three choices:

1. DNS-01 authentication which is not as simple as the other two and, for automation, requires a DSP that allows DNS zone updates via API.
2. Proxy the xxxx.ddns.net challenge requests within the NAS to the other system.
3. Insert an HTTP proxy in front of both [NAS and new system]