excellent - and are you still getting the same error when running certbot-auto ? if it still gives an error of “invalid response from …” can you reach that URL via curl ?
Well, at least that identifies the problem. Personally I don’t use certbot, so not sure how to get it to change the ownership / permissions. There is a script plugin being developed, which will allow that, but that hasn’t been released yet.
It’s rather odd to see the challenge files certbot created are still there. Typically, they would be deleted, even if the challenge fails. Did you do anything to make that happen (in order to make this easier to debug and see the file permissions), or are the files just there?
The files should be created as world-readable, so the ownership as such should not matter.
Could you re-run the client in verbose mode (-vvvvv) and post the logs from /var/log/letsencrypt? Maybe there’s a clue somewhere in there.
ownership is matter IF you have nginx started as regular user, non root, so nginx can read only directory’s and files which are belongs to him or gorup.
That issue in my case I think.
In same time files are created as 640, instead of 644, and they are not available/readable to any user on server. In additional root:root ownership set.
?