I am trying to configure CertBot and it only works when I serve my site over http. Usually I have an https redirect and I don't want to have to change the site config each time I need to use certbot. I tried to serve only /.well-known/ over http but it is still failing any ideas how to resolve this?
I am trying to copy this idea but not working --> NGINX redirect everything except letsencrypt to https
Eg: This Works:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location / {
proxy_pass http://localhost:8575/;
include /etc/nginx/conf.d/proxy.conf;
}
}
This does not: (Note that the current configured SSL Certs are not correct, but needed for NGinX to start)
server {
listen 80;
listen [::]:80;
server_name www.example.com example.com;
location /.well-known/acme-challenge/ {
proxy_pass http://localhost:8575/;
include /etc/nginx/conf.d/proxy.conf;
}
location / {
return 301 https://$server_name$request_uri;
}
}
server {
listen 443 ssl;
listen [::]:443;
server_name www.example.com example.com;
# ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
# ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_certificate /etc/ssl/crt/crt.crt;
ssl_certificate_key /etc/ssl/crt/key.key;
location / {
proxy_pass http://localhost:8575/;
include /etc/nginx/conf.d/proxy.conf;
}
}
Error Log:
certbot | Saving debug log to /var/log/letsencrypt/letsencrypt.log
certbot | Plugins selected: Authenticator webroot, Installer None
certbot | Registering without email!
certbot | Obtaining a new certificate
certbot | Performing the following challenges:
certbot | http-01 challenge for www.example.com
certbot | http-01 challenge for example.com
certbot | Using the webroot path /var/www/html for all unmatched domains.
certbot | Waiting for verification...
certbot | Challenge failed for domain www.example.com
certbot | Challenge failed for domain example.com
certbot | http-01 challenge for www.example.com
certbot | http-01 challenge for example.com
certbot | Cleaning up challenges
certbot | IMPORTANT NOTES:
certbot | - The following errors were reported by the server:
certbot |
certbot | Domain: www.example.com
certbot | Type: unauthorized
certbot | Detail: Invalid response from
certbot | http://www.example.com/.well-known/acme-challenge/WyVEA5g6BWVDPpYUhEJ0bG5iH6daF1rZpFd0vuTXOa0
certbot | [50.117.156.123]: " <!DOCTYPE html><html lang=\"en-US\">\r\n
certbot | \t<head>\n\n\t\t <meta charset=\"UTF-8\">\r\n <meta
certbot | name=\"viewport\" con"
certbot |
certbot | Domain: example.com
certbot | Type: unauthorized
certbot | Detail: Invalid response from
certbot | https://www.example.com/x61_h9wxFY2Ye8-16GllyMq_dfsXbsEB1lYOjeq4LjU
certbot | [50.117.156.123]: " <!DOCTYPE html><html lang=\"en-US\">\r\n
certbot | \t<head>\n\n\t\t <meta charset=\"UTF-8\">\r\n <meta
certbot | name=\"viewport\" con"
certbot |
certbot | To fix these errors, please make sure that your domain name was
certbot | entered correctly and the DNS A/AAAA record(s) for that domain
certbot | contain(s) the right IP address.
certbot | - Your account credentials have been saved in your Certbot
certbot | configuration directory at /etc/letsencrypt. You should make a
certbot | secure backup of this folder now. This configuration directory will
certbot | also contain certificates and private keys obtained by Certbot so
certbot | making regular backups of this folder is ideal.
certbot | Some challenges have failed.
certbot exited with code 1
