No "chown" as acmeuser

[rg305]

@Paul56

server {
    listen 80;
    listen [::]:80;
    server_name meet.freundel.net;

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root         /usr/share/jitsi-meet;   <<<<<<<<<< CHANGE THIS LINE
    }
    location = /.well-known/acme-challenge/ {
        return 404;
    }
    location / {
        return 301 https://$host$request_uri;
    }
}

Change that line to match the --webroot used in the command:
Like in the other vhost:

@Paul56

root /tmp/letsencrypt;

[Paul56]

Thank you very much. Now the acme script reloaded successful.

The script ran without --test succesful. I restarted nginx. But I still cannot reach the website.

Do you have a tip more, where to look for the cause?

[rg305]

@Paul56

I restarted nginx. But I still cannot reach the website.

Which web site exactly?
What message do you get?

[rg305]

It seems that you have two certs (RSA & ECC) in your nginx config:

    ssl_certificate     /etc/letsencrypt/rsa-certs/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/rsa-certs/privkey.pem;
    ssl_certificate     /etc/letsencrypt/ecc-certs/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/ecc-certs/privkey.pem;

But you have only renewed one of them.

You can renew the ECC cert OR remove it from your config.

[Paul56]

Now it works. Thank you very much for your help and your patience.

Just one question more: In all that published information, is there something critical regarding security, which should be changed now.

[rg305]

@Paul56

is there something critical regarding security, which should be changed now.

Not much.
I removed the file for nginx -T for good measure
You can check your with: SSL Server Test: meet.freundel.net (Powered by Qualys SSL Labs)

Cheers from Miami

#FreeCuba

[rg305]

nothing critical...
But you might benefit from adding DNS CAA records and OCSP stapling.

[Paul56]

Thank you. I will have a look on it.