Hi,
I'm encountering an issue while trying to set up SSL for my domain monzerpro.com using Certbot. After following a guide to deploy my Django app with Nginx and uWSGI, I attempted to request a certificate via the following command:
sudo certbot --nginx --test-cert
However, I received the following error:
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:monzerpro.com http://monzerpro.com/.well-known/acme-challenge/2DmHl0I2jZc0nxiWy-RzdT2yOncbp_B9kf-Pl_j6XM8: 404
Domain: www.monzerpro.com http://www.monzerpro.com/.well-known/acme-challenge/xQeW2-Sn3bkfyGUGhCzqL0Wyidw3uf36avtxeH8cveE: 404
It seems like the certificate authority couldn't verify the domains due to a 404 error for the .well-known/acme-challenge directory, which might indicate an issue with Nginx or domain resolution.
Here’s what I’ve done:
Configured my Nginx server for both monzerpro.com and www.monzerpro.com in the server block.
Tried running Certbot with --nginx to automatically configure the SSL, but it’s not working.
Any guidance on how to resolve this issue would be greatly appreciated! I’m unsure whether it’s a misconfiguration in Nginx, DNS, or something else. The domains are properly pointed to my server’s IP.
problem most likly from: /.well-known/acme-challenge/
Hello @cyberBow ,
Testing and debugging are best done using the Staging Environment Rate Limits
Here is a list of issued certificates crt.sh | monzerpro.com , several today; watch out for the Rate Limits.
1 Like
sudo certbot --nginx --test-cert
Which names would you like to activate HTTPS for?
1: monzerpro.com www.monzerpro.com
Select the appropriate numbers separated by commas and/or spaces, or leave inputmonzerpro.com and www.monzerpro.com
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:monzerpro.com http://monzerpro.com/.well-known/acme-challenge/2DmHl0I2jZc0nxiWy-RzdT2yOncbp_B9kf-Pl_j6XM8: 404
Domain: www.monzerpro.com http://www.monzerpro.com/.well-known/acme-challenge/xQeW2-Sn3bkfyGUGhCzqL0Wyidw3uf36avtxeH8cveE: 404
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
Some challenges have failed.https://community.letsencrypt.org . See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
this is the command i run
cyberBow:
i am using --test-cert
There is also --dry-run; User Guide — Certbot 4.0.0 documentation
Please show the output of each of the following commands
sudo certbot --versionsudo certbot certificatessudo nginx -T that is a capital T
2 Likes
certbot --version: certbot 2.9.0
sudo certbot certificates
No certificates found.
monzerpro@srv822283:~$ sudo nginx -T
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
# multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
types_hash_max_size 2048;
# server_tokens off;
# server_names_hash_bucket_size 64;
# server_name_in_redirect off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# SSL Settings
##
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
##
# Logging Settings
##
access_log /var/log/nginx/access.log;
##
# Gzip Settings
##
gzip on;
# gzip_vary on;
# gzip_proxied any;
# gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
##
# Virtual Host Configs
##
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
#mail {
# # See sample authentication script at:
# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
# # auth_http localhost/auth.php;
# # pop3_capabilities "TOP" "USER";
# # imap_capabilities "IMAP4rev1" "UIDPLUS";
# server {
# listen localhost:110;
# protocol pop3;
# proxy on;
# }
# server {
# listen localhost:143;
# protocol imap;
# proxy on;
# }
#}
# configuration file /etc/nginx/mime.types:
types {
text/html html htm shtml;
text/css css;
text/xml xml;
image/gif gif;
image/jpeg jpeg jpg;
application/javascript js;
application/atom+xml atom;
application/rss+xml rss;
text/mathml mml;
text/plain txt;
text/vnd.sun.j2me.app-descriptor jad;
text/vnd.wap.wml wml;
text/x-component htc;
image/avif avif;
image/png png;
image/svg+xml svg svgz;
image/tiff tif tiff;
image/vnd.wap.wbmp wbmp;
image/webp webp;
image/x-icon ico;
image/x-jng jng;
image/x-ms-bmp bmp;
font/woff woff;
font/woff2 woff2;
application/java-archive jar war ear;
application/json json;
application/mac-binhex40 hqx;
application/msword doc;
application/pdf pdf;
application/postscript ps eps ai;
application/rtf rtf;
application/vnd.apple.mpegurl m3u8;
application/vnd.google-earth.kml+xml kml;
application/vnd.google-earth.kmz kmz;
application/vnd.ms-excel xls;
application/vnd.ms-fontobject eot;
application/vnd.ms-powerpoint ppt;
application/vnd.oasis.opendocument.graphics odg;
application/vnd.oasis.opendocument.presentation odp;
application/vnd.oasis.opendocument.spreadsheet ods;
application/vnd.oasis.opendocument.text odt;
application/vnd.openxmlformats-officedocument.presentationml.presentation
pptx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
xlsx;
application/vnd.openxmlformats-officedocument.wordprocessingml.document
docx;
application/vnd.wap.wmlc wmlc;
application/wasm wasm;
application/x-7z-compressed 7z;
application/x-cocoa cco;
application/x-java-archive-diff jardiff;
application/x-java-jnlp-file jnlp;
application/x-makeself run;
application/x-perl pl pm;
application/x-pilot prc pdb;
application/x-rar-compressed rar;
application/x-redhat-package-manager rpm;
application/x-sea sea;
application/x-shockwave-flash swf;
application/x-stuffit sit;
application/x-tcl tcl tk;
application/x-x509-ca-cert der pem crt;
application/x-xpinstall xpi;
application/xhtml+xml xhtml;
application/xspf+xml xspf;
application/zip zip;
application/octet-stream bin exe dll;
application/octet-stream deb;
application/octet-stream dmg;
application/octet-stream iso img;
application/octet-stream msi msp msm;
audio/midi mid midi kar;
audio/mpeg mp3;
audio/ogg ogg;
audio/x-m4a m4a;
audio/x-realaudio ra;
video/3gpp 3gpp 3gp;
video/mp2t ts;
video/mp4 mp4;
video/mpeg mpeg mpg;
video/ogg ogv;
video/quicktime mov;
video/webm webm;
video/x-flv flv;
video/x-m4v m4v;
video/x-matroska mkv;
video/x-mng mng;
video/x-ms-asf asx asf;
video/x-ms-wmv wmv;
video/x-msvideo avi;
}
# configuration file /etc/nginx/sites-enabled/default:
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# [NGINX Documentation](https://www.nginx.com/resources/wiki/start/)
# [NGINX Documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/)
# [Nginx/DirectoryStructure - Debian Wiki](https://wiki.debian.org/Nginx/DirectoryStructure)
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
# Default server configuration
server {
listen 80 default_server;
listen [::]:80 default_server;
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
# pass PHP scripts to FastCGI server
#
#location ~ \.php$ {
# include snippets/fastcgi-php.conf;
#
# # With php-fpm (or other unix sockets):
# fastcgi_pass unix:/run/php/php7.4-fpm.sock;
# # With php-cgi (or other tcp sockets):
# fastcgi_pass 127.0.0.1:9000;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
# Virtual Host configuration for [example.com](http://example.com)
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#server {
# listen 80;
# listen [::]:80;
# server_name [example.com](http://example.com);
# root /var/www/example.com;
# index index.html;
# location / {
# try_files $uri $uri/ =404;
# }
#}
# configuration file /etc/nginx/sites-enabled/proaudiosite.conf:
upstream django {
server unix:///home/monzerpro/ProAudioSite/ProAudioSite.sock;
}
server {
listen 80;
server_name [monzerpro.com](http://monzerpro.com) [www.monzerpro.com](http://www.monzerpro.com);
client_max_body_size 75M;
location /media {
alias /home/monzerpro/ProAudioSite/media;
}
location /static {
alias /home/monzerpro/ProAudioSite/static;
}
location / {
uwsgi_pass django;
include /home/monzerpro/ProAudioSite/uwsgi_params;
}
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
}
# configuration file /home/monzerpro/ProAudioSite/uwsgi_params:
uwsgi_param QUERY_STRING $query_string;
uwsgi_param REQUEST_METHOD $request_method;
uwsgi_param CONTENT_TYPE $content_type;
uwsgi_param CONTENT_LENGTH $content_length;
uwsgi_param REQUEST_URI $request_uri;
uwsgi_param PATH_INFO $document_uri;
uwsgi_param DOCUMENT_ROOT $document_root;
uwsgi_param SERVER_PROTOCOL $server_protocol;
uwsgi_param REQUEST_SCHEME $scheme;
uwsgi_param HTTPS $https if_not_empty;
uwsgi_param REMOTE_ADDR $remote_addr;
uwsgi_param REMOTE_PORT $remote_port;
uwsgi_param SERVER_PORT $server_port;
uwsgi_param SERVER_NAME $server_name;
2 Likes
cyberBow:
No certificates found.
Kind of curious where all those issued certificate went.
1 Like
then the problem isn't that certbot cant dedtect .well-known/acme-challenge/
These two are just saying the ACME Token (i.e. file) was not found, thus where did Certbot put the token files that is not mapping to http://<YOUR_DOMAIN>/.well-known/acme-challenge/< TOKEN >?
For debugging purposes consider putting a simple file in the location that you believe the ACME Challenge token to to be put in. Put something like Hello, world. the the simple file. Then try the URL in a web browser.
1 Like
i did that pyt a file inside it test and curl the link it get it fine
could it be i need to wait for the dns to update?
Shouldn't be needed; also Let's Encrypt use the Authoritative Name Server.
Then that would imply that the location Certbot thinks is the place to put the challenge token file is incorrect.
I need to step away for awhile; I expect another volunteer will jump in and help.
But I would try adding the option
-v, --verbose This flag can be used multiple times to incrementally
increase the verbosity of output, e.g. -vvv. (default:
0)
And check what Certbot is actually doing.
I appreciate this, brother. Thank you for helping me. Have a great day!
1 Like
that site replied differently from ipv4 and ipv6: they have same 404 page (nginx 1.24.0 on ubuntu) but from ipv6 it just show default welcome to nginx, not your site.
2 Likes
hi @orangepizza you are right
after hrs of troubleshooting i added to /etc/nginx/sites-available/site.conf
listen [::]:80;
and it worked
3 Likes
system
June 12, 2025, 6:13am
18
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
