Let's encrypt not working with Nginx on ubuntu 16.04

[daisai]

Hello Everyone,
I have a MEAN stack web site that runs on node.js server.

I followed the guild to obtain a ssl file using this command.
sudo certbot --nginx -d xxx.xxx.com
But I got this error.

======================
Type: unauthorized
Detail: Invalid response from
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address.

How can I fix this error? Thx.

[Osiris]

@daisai

I have a MEAN stack web site that runs on node.js server.

@daisai

sudo certbot --nginx (…)

Do you even run a nginx webserver?

[daisai]

sure.

Nginx webserver works well.

[Osiris]

@daisai

Nginx webserver works well.

That might have been something to put in your post. You're running it as a reverse proxy then, right?

Also, you're already setting the HSTS header when your HTTPS isn't working at all:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Probably not very wise until you're absolutely certain your HTTPS is working flawlessly.

[daisai]

This is configurations for ngnix.

[daisai]

It has worked without ssl so far.

[Osiris]

You should make sure requests for the path /.well-known/acme-challenge/ aren't processed through your reverse proxy.

@daisai

It has worked without ssl so far.

That's because the HSTS header is only processed when it is received through HTTPS. But if you have a flaky HTTPS setup, some users might receive the HSTS header through HTTPS, enabeling it, after which perhaps your HTTPS setup, because not very stable for some reason, is disabled. Result: users with an enabled HSTS can't reach your site any longer.

@daisai

I already tested it. But it returned the entire content of index file.

Tested it how? We can only work with the information you're giving us. In this case, more is better..

[daisai]

I already tested it. But it returned the entire content of index file.

[daisai]

@Osiris

Tested it how?

I could find some blogs and followed it.
Could you let me know how to test it again here?