Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: rpiweather.net
I ran this command: installation of certbot via snap:
pi@HomeAutomation:~ $ sudo snap install --classic certbot
certbot 2.8.0 from Certbot Project (certbot-eff✓) installed
pi@HomeAutomation:~ $ sudo ln -s /snap/bin/certbot /usr/bin/certbot
pi@HomeAutomation:~ $ sudo certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1
An RSA certificate named rpiweather.net already exists. Do you want to update
its key type to ECDSA?
(U)pdate key type/(K)eep existing key type: U
Renewing an existing certificate for rpiweather.net
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/rpiweather.net/fullchain.pem
Key is saved at: /etc/letsencrypt/live/rpiweather.net/privkey.pem
This certificate expires on 2024-04-13.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
Deploying certificate
Successfully deployed certificate for rpiweather.net to /etc/nginx/sites-enabled/default
Your existing certificate has been successfully renewed, and the new certificate has been installed.
If you like Certbot, please consider supporting our work by:
- Donating to ISRG / Let's Encrypt: Donate - Let's Encrypt
- Donating to EFF: Support EFF's Work on Let's Encrypt | Electronic Frontier Foundation
pi@HomeAutomation:~ $ sudo certbot renew --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Processing /etc/letsencrypt/renewal/rpiweather.net.conf
Account registered.
Simulating renewal of an existing certificate for rpiweather.net
Congratulations, all simulated renewals succeeded:
/etc/letsencrypt/live/rpiweather.net/fullchain.pem (success)
pi@HomeAutomation:~ $
It produced this output:
My web server is (include version): nginx version: nginx/1.14.2
The operating system my web server runs on is (include version): Raspbian GNU/Linux 10 (buster)
My hosting provider, if applicable, is: google domains for DNS
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 0.31.0
DNS for rpiweather.net is with Google Domains and hosted on my Raspberry Pi. Prior to installing certbot I could reach my website using http::/rpiweather.net, but after installation I get this:
The site is still reachable using 71.174.250.159). My router is forwarding ports 443, 80, 8000 and 8080:
This is the content in the 'default' file in /etc/nginx/sites-available folder:
You should look at the following URL's in order to grasp a solid understanding
of Nginx configuration files in order to fully unleash the power of Nginx.
Getting Started | NGINX
Pitfalls and Common Mistakes | NGINX
Nginx/DirectoryStructure - Debian Wiki
In most cases, administrators will remove this file from sites-enabled/ and
leave it as reference inside of sites-available where it will continue to be
updated by the nginx packaging team.
This file will automatically load configuration files provided by other
applications, such as Drupal or Wordpress. These applications will be made
available underneath a path with that package name, such as /drupal8.
Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
Default server configuration
server {
listen 80 default_server;
listen [::]:80 default_server;SSL configuration
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
Note: You should disable gzip for SSL traffic.
See: https://bugs.debian.org/773332
Read up on ssl_ciphers to ensure a secure configuration.
See: https://bugs.debian.org/765782
Self signed certs generated by the ssl-cert package
Don't use them in a production server!
include snippets/snakeoil.conf;
root /var/www/html;
Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}pass PHP scripts to FastCGI server
#location ~ .php$ {
include snippets/fastcgi-php.conf;
# With php-fpm (or other unix sockets):
fastcgi_pass unix:/run/php/php7.3-fpm.sock;
# With php-cgi (or other tcp sockets):
fastcgi_pass 127.0.0.1:9000;
#}
deny access to .htaccess files, if Apache's document root
concurs with nginx's one
#location ~ /.ht {
deny all;
#}
}Virtual Host configuration for example.com
You can move that to a different file under sites-available/ and symlink that
to sites-enabled/ to enable it.
#server {
listen 80;
listen [::]:80;
server_name example.com;
root /var/www/example.com;
index index.html;
location / {
try_files $uri $uri/ =404;
}
#}
server {
SSL configuration
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
Note: You should disable gzip for SSL traffic.
See: https://bugs.debian.org/773332
Read up on ssl_ciphers to ensure a secure configuration.
See: https://bugs.debian.org/765782
Self signed certs generated by the ssl-cert package
Don't use them in a production server!
include snippets/snakeoil.conf;
root /var/www/html;
Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name rpiweather.net; # managed by Certbotlocation / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}pass PHP scripts to FastCGI server
#location ~ .php$ {
include snippets/fastcgi-php.conf;
# With php-fpm (or other unix sockets):
fastcgi_pass unix:/run/php/php7.3-fpm.sock;
# With php-cgi (or other tcp sockets):
fastcgi_pass 127.0.0.1:9000;
#}
deny access to .htaccess files, if Apache's document root
concurs with nginx's one
#location ~ /.ht {
deny all;
#}
listen [::]:443 ssl ipv6only=on; # managed by Certbot listen 443 ssl; # managed by Certbot ssl_certificate /etc/letsencrypt/live/rpiweather.net/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/rpiweather.net/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot}
server {
if ($host = rpiweather.net) {
return 301 https://$host$request_uri;
} # managed by Certbotlisten 80 ;
listen [::]:80 ;
server_name rpiweather.net;
return 404; # managed by Certbot}
Can you suggest how to fix this? thank you.
