Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
It produced this output:
getting 403 error
My web server is (include version): nginx 1.26
The operating system my web server runs on is (include version): ubuntu 25.04
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Certbot 2.11
The 403 forbidden error is served by nginx and it's actually communicated from the server to the webbrowser securely with a Let's Encrypt certificate. You assumed incorrectly.
You need to look at your nginx configuration or, if it's not nginx itself, whatever is being served by nginx.
I would like to recommend you to stop and read/learn a lot more about webservers, certificates and ACME. From what you're mentioning now, and I don't mean this in a hurtful way, you don't seem to even grasp the most basic things about configuring/running a webserver.
I'm curious as to how this is working anyhow given that the webroot authenticator is being used and apparently no installer. I suppose the existing configuration could already be pointing to the symlink. Manually configured?
I concur with @Osiris that the certificate is installed properly and thus this isn't a certificate problem.
The current attempts to "fix" the 403 might not be the same command as initially used. Their first certificate was 5 days ago.
Wondering why they didn't hit the 5 duplicate certs per week rate limit though Nevermind, due to a change in LE's method of timing. No longer a sliding window of 7 days, but "The ability to request new certificates for the same exact set of identifiers refills at a rate of 1 certificate every 34 hours."
