Hi!
I’ve recently come across this issue with issuing Let’s Encrypt certificates with my domains → [Bug] · Issue #5118 · hestiacp/hestiacp · GitHub . I’ve followed along with the author proposed fix and still couldn’t issue SSLs. After that I figured maybe we’re using a different version, let me try updating the version by following this thread → How do I see what version of 1.2 I am on, and How to I update - #2 by eris .
After that, Hestia seems to have upgraded successfully, but every single route on my server is currently responding with 404s. Some example URL’s that are all running on the same server:
https://dragana.me as well as https://marinkovicvuk.com.
I am more than happy to provide any and all logs, however I am not sure what exactly to start with initially. So, here is everything I though relevant to the issue I’m facing:
/etc/nginx/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log debug;
pid /run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
}
Output of nginx -T
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log debug;
pid /run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
}
# configuration file /etc/nginx/mime.types:
types {
text/html html htm shtml;
text/css css;
text/xml xml;
image/gif gif;
image/jpeg jpeg jpg;
application/javascript js;
application/atom+xml atom;
application/rss+xml rss;
text/mathml mml;
text/plain txt;
text/vnd.sun.j2me.app-descriptor jad;
text/vnd.wap.wml wml;
text/x-component htc;
image/avif avif;
image/png png;
image/svg+xml svg svgz;
image/tiff tif tiff;
image/vnd.wap.wbmp wbmp;
image/webp webp;
image/x-icon ico;
image/x-jng jng;
image/x-ms-bmp bmp;
font/woff woff;
font/woff2 woff2;
application/java-archive jar war ear;
application/json json;
application/mac-binhex40 hqx;
application/msword doc;
application/pdf pdf;
application/postscript ps eps ai;
application/rtf rtf;
application/vnd.apple.mpegurl m3u8;
application/vnd.google-earth.kml+xml kml;
application/vnd.google-earth.kmz kmz;
application/vnd.ms-excel xls;
application/vnd.ms-fontobject eot;
application/vnd.ms-powerpoint ppt;
application/vnd.oasis.opendocument.graphics odg;
application/vnd.oasis.opendocument.presentation odp;
application/vnd.oasis.opendocument.spreadsheet ods;
application/vnd.oasis.opendocument.text odt;
application/vnd.openxmlformats-officedocument.presentationml.presentation
pptx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
xlsx;
application/vnd.openxmlformats-officedocument.wordprocessingml.document
docx;
application/vnd.wap.wmlc wmlc;
application/wasm wasm;
application/x-7z-compressed 7z;
application/x-cocoa cco;
application/x-java-archive-diff jardiff;
application/x-java-jnlp-file jnlp;
application/x-makeself run;
application/x-perl pl pm;
application/x-pilot prc pdb;
application/x-rar-compressed rar;
application/x-redhat-package-manager rpm;
application/x-sea sea;
application/x-shockwave-flash swf;
application/x-stuffit sit;
application/x-tcl tcl tk;
application/x-x509-ca-cert der pem crt;
application/x-xpinstall xpi;
application/xhtml+xml xhtml;
application/xspf+xml xspf;
application/zip zip;
application/octet-stream bin exe dll;
application/octet-stream deb;
application/octet-stream dmg;
application/octet-stream iso img;
application/octet-stream msi msp msm;
audio/midi mid midi kar;
audio/mpeg mp3;
audio/ogg ogg;
audio/x-m4a m4a;
audio/x-realaudio ra;
video/3gpp 3gpp 3gp;
video/mp2t ts;
video/mp4 mp4;
video/mpeg mpeg mpg;
video/quicktime mov;
video/webm webm;
video/x-flv flv;
video/x-m4v m4v;
video/x-mng mng;
video/x-ms-asf asx asf;
video/x-ms-wmv wmv;
video/x-msvideo avi;
}
# configuration file /etc/nginx/conf.d/01_caching_pool.conf:
# configuration file /etc/nginx/conf.d/0rtt-anti-replay.conf:
# Implement TLS 1.3 0-RTT anti-replay for NGINX
# Requires: NGINX directive "ssl_early_data" on
# Usage:
# Make sure these "map" blocks are included in "http" block
# Put the following two lines in SSL "server" block, before any "location" blocks
# if ($anti_replay = 307) { return 307 https://$host$request_uri; }
# if ($anti_replay = 425) { return 425; }
# Pass "Early-Data" header to backend/upstream
# Only for 0-RTT requests from clients that understand 425 status code (RFC 8470)
# fastcgi_param HTTP_EARLY_DATA $rfc_early_data if_not_empty;
# proxy_set_header Early-Data $rfc_early_data;
# Copyright © myrevery
# Copyright © 7677333 (An anagram of a Anonymous Cybersecurity Research Team)
map "$request_method:$is_args" $ar_idempotent {
default 0;
"~^GET:$|^(HEAD|OPTIONS|TRACE):\?*$" 1;
}
map $http_user_agent $ar_support_425 {
default 0;
"~Firefox/((58|59)|([6-9]\d)|([1-9]\d{2,}))\.\d+" 1;
}
map "$ssl_early_data:$ar_idempotent:$ar_support_425" $anti_replay {
1:0:0 307;
1:0:1 425;
}
map "$ssl_early_data:$ar_support_425" $rfc_early_data {
1:1 1;
}
# configuration file /etc/nginx/conf.d/188.245.167.88.conf:
server {
listen 188.245.167.88:80 default_server;
server_name _;
access_log off;
error_log /dev/null;
location / {
proxy_pass http://188.245.167.88:8080;
}
}
server {
listen 188.245.167.88:443 default_server ssl;
server_name _;
access_log off;
error_log /dev/null;
ssl_certificate /usr/local/hestia/ssl/certificate.crt;
ssl_certificate_key /usr/local/hestia/ssl/certificate.key;
return 301 http://$host$request_uri;
location / {
root /var/www/document_errors/;
}
location /error/ {
alias /var/www/document_errors/;
}
}
# configuration file /etc/nginx/conf.d/agents.conf:
map $http_user_agent $mobile_request {
default desktopversion;
"~*ipad" mobileversion;
"~*android.*mobile" mobileversion;
"~*iphone" mobileversion;
"~*ipod.*mobile" mobileversion;
"~*BlackBerry*Mobile Safari" mobileversion;
"~*BB*Mobile Safari" mobileversion;
"~*Opera.*Mini/7" mobileversion;
"~*IEMobile/10.*Touch" mobileversion;
"~*IEMobile/11.*Touch" mobileversion;
"~*IEMobile/7.0" mobileversion;
"~*IEMobile/9.0" mobileversion;
"~*Firefox.*Mobile" mobileversion;
"~*webOS" mobileversion;
}
# configuration file /etc/nginx/conf.d/http2-directive.conf:
http2 on;
# configuration file /etc/nginx/conf.d/status.conf:
server {
listen 127.0.0.1:8084 default_server;
server_name _;
server_name_in_redirect off;
location / {
stub_status on;
access_log off;
error_log /dev/null;
}
}
nginx.conf for one of the affected domains, located in: /home//conf/web/dragana.me
#=========================================================================#
# Default Web Domain Template #
# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS #
# https://hestiacp.com/docs/server-administration/web-templates.html #
#=========================================================================#
server {
listen 188.245.167.88:80;
server_name dragana.me www.dragana.me;
error_log /var/log/apache2/domains/dragana.me.error.log error;
include /home/showtimezz/conf/web/dragana.me/nginx.forcessl.conf*;
location ~ /\.(?!well-known\/|file) {
deny all;
return 404;
}
location / {
proxy_pass http://188.245.167.88:8080;
location ~* ^.+\.(css|htm|html|js|mjs|json|xml|apng|avif|bmp|cur|gif|ico|jfif|jpg|jpeg|pjp|pjpeg|png|svg|tif|tiff|webp|aac|caf|flac|m4a|midi|mp3|ogg|opus|wav|3gp|av1|avi|m4v|mkv|mov|mpg|mpeg|mp4|mp4v|webm|otf|ttf|woff|woff2|doc|docx|odf|odp|ods|odt|pdf|ppt|pptx|rtf|txt|xls|xlsx|7z|bz2|gz|rar|tar|tgz|zip|apk|appx|bin|dmg|exe|img|iso|jar|msi|webmanifest)$ {
try_files $uri @fallback;
root /home/showtimezz/web/dragana.me/public_html;
access_log /var/log/apache2/domains/dragana.me.log combined;
access_log /var/log/apache2/domains/dragana.me.bytes bytes;
expires max;
}
}
location @fallback {
proxy_pass http://188.245.167.88:8080;
}
location /error/ {
alias /home/showtimezz/web/dragana.me/document_errors/;
}
include /home/showtimezz/conf/web/dragana.me/nginx.conf_*;
}
Output for v-list-sys-nginx-config :
worker_processes auto
worker_connections 1024
#gzip on
config_path /etc/nginx/nginx.conf
nginx error log:
2025/11/20 10:52:30 [notice] 48822#48822: signal 17 (SIGCHLD) received from 55430
2025/11/20 10:52:30 [notice] 48822#48822: worker process 55430 exited with code 0
2025/11/20 10:52:30 [notice] 48822#48822: signal 29 (SIGIO) received
2025/11/20 10:52:30 [notice] 48822#48822: signal 17 (SIGCHLD) received from 55431
2025/11/20 10:52:30 [notice] 48822#48822: worker process 55431 exited with code 0
2025/11/20 10:52:30 [notice] 48822#48822: signal 29 (SIGIO) received
2025/11/20 10:52:30 [notice] 48822#48822: signal 17 (SIGCHLD) received from 55433
2025/11/20 10:52:30 [notice] 48822#48822: worker process 55433 exited with code 0
2025/11/20 10:52:30 [notice] 48822#48822: worker process 55432 exited with code 0
2025/11/20 10:52:30 [notice] 48822#48822: signal 29 (SIGIO) received
2025/11/20 10:52:30 [notice] 48822#48822: signal 17 (SIGCHLD) received from 55432
2025/11/20 10:52:59 [notice] 48822#48822: signal 15 (SIGTERM) received from 65946, exiting
2025/11/20 10:52:59 [notice] 65393#65393: exiting
2025/11/20 10:52:59 [notice] 65395#65395: exiting
2025/11/20 10:52:59 [notice] 65394#65394: exiting
2025/11/20 10:52:59 [notice] 65396#65396: exiting
2025/11/20 10:52:59 [notice] 65393#65393: exit
2025/11/20 10:52:59 [notice] 65395#65395: exit
2025/11/20 10:52:59 [notice] 65394#65394: exit
2025/11/20 10:52:59 [notice] 65396#65396: exit
2025/11/20 10:52:59 [notice] 48822#48822: signal 15 (SIGTERM) received from 1, exiting
2025/11/20 10:52:59 [notice] 65396#65396: signal 15 (SIGTERM) received from 1, exiting
2025/11/20 10:52:59 [notice] 48822#48822: signal 17 (SIGCHLD) received from 65393
2025/11/20 10:52:59 [notice] 48822#48822: worker process 65393 exited with code 0
2025/11/20 10:52:59 [notice] 48822#48822: signal 29 (SIGIO) received
2025/11/20 10:52:59 [notice] 48822#48822: signal 17 (SIGCHLD) received from 65394
2025/11/20 10:52:59 [notice] 48822#48822: worker process 65394 exited with code 0
2025/11/20 10:52:59 [notice] 48822#48822: signal 29 (SIGIO) received
2025/11/20 10:52:59 [notice] 48822#48822: signal 17 (SIGCHLD) received from 65395
2025/11/20 10:52:59 [notice] 48822#48822: worker process 65395 exited with code 0
2025/11/20 10:52:59 [notice] 48822#48822: signal 29 (SIGIO) received
2025/11/20 10:52:59 [notice] 48822#48822: signal 17 (SIGCHLD) received from 65396
2025/11/20 10:52:59 [notice] 48822#48822: worker process 65396 exited with code 0
2025/11/20 10:52:59 [notice] 48822#48822: exit
2025/11/20 10:52:59 [notice] 65948#65948: using the "epoll" event method
2025/11/20 10:52:59 [notice] 65948#65948: nginx/1.29.3
2025/11/20 10:52:59 [notice] 65948#65948: built by gcc 13.3.0 (Ubuntu 13.3.0-6ubuntu2~24.04)
2025/11/20 10:52:59 [notice] 65948#65948: OS: Linux 6.8.0-87-generic
2025/11/20 10:52:59 [notice] 65948#65948: getrlimit(RLIMIT_NOFILE): 1024:524288
2025/11/20 10:52:59 [notice] 65950#65950: start worker processes
2025/11/20 10:52:59 [notice] 65950#65950: start worker process 65951
2025/11/20 10:52:59 [notice] 65950#65950: start worker process 65952
2025/11/20 10:52:59 [notice] 65950#65950: start worker process 65953
2025/11/20 10:52:59 [notice] 65950#65950: start worker process 65954
I’ve tried running the CLI commands to rebuild the domains, add the web domains, rebuild system settings, etc, none of them seem to make a difference.
I’d be more than happy to provide anything else anyone might need, and I deeply appreciate anyone that lends me a hand in this. Thank you.