I experience bad gateway on 2 sites after Certbot changed the Nginx site-conf file of one of them.

No errors all in nginx -t.

Only this comes up in tail /var/log/nginx/error.log:

2017/10/24 15:40:47 [error] 27439#27439: *125 connect() failed (111: Connection refused) while connecting to upstream, client:, server: domain.tld1, request: "GET /category/%D7%9B%D7%9C%D7%9C%D7%99/ HTTP/1.1", upstream: "fastcgi://", host: "contfix.co.il" root@benqzq:~#

Only this comes up in tail /var/log/nginx/access.log: - - [24/Oct/2017:15:44:13 +0000] "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"

  • No error in nginx reset.

This is the site-conf of the site I changed with Certbot:

server {
    root /var/www/html/contfix.co.il;
    server_name contfix.co.il www.contfix.co.il;

    location / {
        index index.php index.html index.htm;
        try_files $uri $uri/ /index.php?$args;

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;

    location ~ /\.ht {
        deny all;

    location ~*  \.(jpg|jpeg|png|gif|ico|css|js|ttf|woff|pdf)$ {
        expires 365d;

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/contfix.co.il/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/contfix.co.il/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    # Redirect non-https traffic to https
    # if ($scheme != "https") {
    #     return 301 https://$host$request_uri;
    # } # managed by Certbot

The site-conf file of the second site that I didn't choose to finish with Certbot, stayed the same.

Both sites worked perfectly before installing and working with Certbot.

I went to nginx/conf.d/ssl but the files there contain keys and not something to work with to debug this.

How should I further debug this?


When using Certbot on my domain, I got the error:

Could not open file: /etc/nginx/sites-enabled/default

When I did certbot renew --dry-run I also got it, but I didn't get it just when doing "certbot renew".


The main problem was that the CGI directives regarding my site (responsible for PHP-dependent data processing), as appears in my site-conf file, weren't as they should be after implementing SSL.

This is the new setting that works:

location ~ \.php$ {
    try_files $uri =404;
    fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;

Regarding the error I had with the detault, just go to sites-enabled and delete the symlink inode called default. Thus, even if you have a default template in sites-available, it won't be utilized.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.