Lets Encrypt Certificate Renewal Fails With Nginx After Configuration Change

Help
1

I am running an Ubuntu VPS with Nginx and I have a Lets Encrypt SSL Certificate managed through Certbot. The Website works normally over HTTPS but the automatic certificate renewal is failing When I run the renewal test I get an error during the HTTP 01 challenge

sudo certbot renew --dry run

The output shows that Certbot cannot complete the challenge and the validation request appears to reach the server but returns a 404 response I checked my Nginx configuration and it currently looks similar to this

server {
listen 80;
server_name example com www example com;

location / {
    return 301 https://$host$request_uri;
}

}

server {
listen 443 ssl;
server_name example com www example com;

ssl_certificate /etc/letsencrypt/live/example com/fullchain pem;
ssl_certificate_key /etc/letsencrypt/live/example com/privkey pem;

location / {
    proxy_pass http://127 0 0 1:3000;
}

}

I understand that Lets Encrypt needs to access the challenge file before the certificate can be renewed I also checked that Nginx is running and port 80 is accessible from outside the server

sudo nginx -t
sudo systemctl reload nginx
sudo ss -tulpn | grep :80

What would be the correct Nginx configuration to allow the Lets Encrypt HTTP 01 challenge while keeping the normal HTTP to HTTPS redirect Can I use a dedicated well known location for Certbot instead of disabling the redirect completely I am following the official Certbot documentation here https://eff.certbot.org/instructions

2

The Certbot renew command uses the same options that you used when getting the first certificate. This means your system and nginx need to retain that same config. We'll need to see what those were to give proper advice.

Please show the contents of the conf file for this domain in the /etc/letsencrypt/renewal directory. You can redact the account id in that file if you wish but please show the rest.

3

Yes.
That is actually recommended [when the proxy is the one obtaining the cert].