Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate for shredderfood.com
Performing the following challenges:
http-01 challenge for shredderfood.com
Using default addresses 80 and [::]:80 ipv6only=on for authentication.
Waiting for verification...
Challenge failed for domain shredderfood.com
http-01 challenge for shredderfood.com
Cleaning up challenges
Failed to renew certificate shredderfood.com with error: Some challenges have failed.
All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/shredderfood.com/fullchain.pem (failure)
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
My web server is (include version):
nginx 1.18.0
The operating system my web server runs on is (include version):
debian 15
My hosting provider, if applicable, is:
Self
I can login to a root shell on my machine (yes or no, or I don't know):
Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 1.12.0
HTTP requests to your domain name are broken. My first guess is your nginx config is wrong. My second guess is your NAT or port-forwarding is setup wrong. HTTP requests are being handled by an nginx server block that requires HTTPS. You have an unusual warning message for your certbot request which makes me think nginx config is wrong.
Can you upload the config.txt file (use upload button on post menu) from this command (capital T)
sudo nginx -T >config.txt
or, copy/paste the output (which is very long) placing 3 backticks before and after the output like this
```
pasted output of: sudo nginx -T
```
This shouldn't be happening
curl http://shredderfood.com
<html>
<head><title>400 The plain HTTP request was sent to HTTPS port</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
</body>
</html>
It's a mastodon instance, it ran perfectly up until the cert expiration.. Tried to do a renew and it seems to be getting stuck behind the HTTP-->HTTPS redirect but I have no idea how to undo that.
It would seem that your Port 80 is expecting HTTPS connections
HTTP to Port 80
$ curl -Ii http://shredderfood.com/.well-known/acme-challenge/sometestfile
HTTP/1.1 400 Bad Request
Server: nginx/1.18.0
Date: Thu, 30 Mar 2023 15:44:27 GMT
Content-Type: text/html
Content-Length: 255
Connection: close
Strict-Transport-Security: max-age=31536000
$ curl http://shredderfood.com/.well-known/acme-challenge/sometestfile
<html>
<head><title>400 The plain HTTP request was sent to HTTPS port</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>The plain HTTP request was sent to HTTPS port</center>
<hr><center>nginx/1.18.0</center>
</body>
</html>
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate for shredderfood.com
Performing the following challenges:
http-01 challenge for shredderfood.com
Waiting for verification...
Challenge failed for domain shredderfood.com
http-01 challenge for shredderfood.com
Cleaning up challenges
Failed to renew certificate shredderfood.com with error: Some challenges have failed.
All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/shredderfood.com/fullchain.pem (failure)
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
Not exactly. You no longer get the message about these addresses
HTTP requests are not reaching that nginx. Does your router send HTTP (port 80) requests to that nginx server machine on port 80?
And, how does Mastodon interact with nginx? Because any HTTPS request gets a response from Mastodon even when sent to port 80 (which should fail but does not).
This should get an HTTP 400 but Mastodon returns a 200 OK
and, according to your nginx config an HTTP request should get redirected to HTTPS. Instead, it gets HTTP error 400 from an nginx server. This probably means the HTTP request was routed to the wrong nginx port by something (your router for example).
curl -I http://shredderfood.com:80
HTTP/1.1 400 Bad Request
Server: nginx/1.18.0
I had the 80-->443 configured in nginix, I ALSO had 80-->443 configured in the firewall.
I had to rebuild my PFSense last week and did so hastily, So that's on me, though the firewall redirection rules were restored from a backup so I'm not sure why it ever worked.
Reconfigured the 80-->80 and 443-->443
root@mast1:/etc/nginx/conf.d# certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate for shredderfood.com
Performing the following challenges:
http-01 challenge for shredderfood.com
Waiting for verification...
Cleaning up challenges
new certificate deployed with reload of nginx server; fullchain is
/etc/letsencrypt/live/shredderfood.com/fullchain.pem
Congratulations, all renewals succeeded:
/etc/letsencrypt/live/shredderfood.com/fullchain.pem (success)
It probably was not working for HTTP requests since that backup. You just might not have known it until now if just using HTTPS requests. Some browsers (like Chrome) may even try both HTTP and HTTPS and use HTTPS if it works. Which yours would have until the cert expired.
