My nginx.conf file is as follows:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf; 
#the above include brings in the following default files:

events {
        worker_connections 500;

http {
    include        /etc/nginx/proxy.conf;
    limit_req_zone $binary_remote_addr zone=one:10m rate=100r/m;
    server_tokens  off;

    sendfile on;
    keepalive_timeout   30;
    client_body_timeout 10; client_header_timeout 10; send_timeout 10;

    upstream myapp{

    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name myapi.com;
        ssl_certificate /etc/letsencrypt/live/myapi.com/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/myapi.com/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;

        #Redirects all traffic
        location / {
            proxy_pass http://myapi;
            limit_req  zone=one burst=10;

I installed the certbot and certbot-nginx (ubuntu).

SSL is working fine. Firewall only allows port 443.

I am trying to renew the certbot certificate with command: sudo certbot renew --dry-run

This tries to verify that I own the domain by making a request to http://myapi.com/.well-known/acme-challenge/2d8dvxv8x9dvxd9v (note: I have obfuscated the key value 2d8dvxv8x9dvxd9v as this is something private)

But this time's out. So I have enabled port 80 and added the following additional server item:

   server {
         listen 80;
         server_name myapi.com;
         return 301 https://$host$request_uri;

Now the certbot renew command (sudo certbot renew --dry-run) is able to renew the certificate. Strangely, even if I remove this server block, the certbot renewal works fine.

  1. Where is the .well-known/acme-challenge path? Is it generated/deleted on the fly?

  2. When I remove the server block for port 80, then how is nginx able to renew certificate (because it needs the port 80 for the certbot challenge)?

  • Let the server on port 80 only answer requests for /.well-known/acme-challenge. Your site will be safer if you don't redirect http to https. Feb 16 at 10:09
  • But what is the location of /.well-known/acme-challenge?
    – variable
    Feb 16 at 10:11
  • The documentroot of your nginx server. I seem to remember certbot asking where to put it. Feb 16 at 10:14
  • Is there any config where I can check this?
    – variable
    Feb 16 at 10:21
  • Of course: your nginx config. Isn't the default /var/www/html ? Look for a "root" directive in your configuration, or the "p" commandline parameter when starting nginx. Feb 16 at 10:26

1 Answer 1


You need a firewall that allows access on port 80 (http), certbot will start a webserver to supply the acme-challenge file from your domain.

  • I have done so and its working, I have updated the question with the challenge.
    – variable
    Feb 16 at 10:04
  • I only want to serve the https requests and block all http requests, other than the certbot renewal. What is the change I need to make to the nginx.config?
    – variable
    Feb 16 at 10:05
  • You could also tell the firewall to drop port 80 requests when certbor has run. Much better than having nginx deal with it. Feb 16 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.