Let’s Encrypt renewal failing using Proxy Template

Community Support
1

I was informed by someone trying to access one of my websites that they had the SSL error page and wanted to know how to reach the website, I just told them to click the advanced and click Proceed without thinking anything about it. I then went to go to a different website and came across the same issue but it didn’t show the Proceed suggestion. After going to look at my 35 hosted domains, 4 of them did not have SSL’s issued any longer.

When looking all of these 4 sites use a Proxy Template, 3 forward to other machines, 1 is a FastAPI.

The only way that I could get the sites back up and running was to change the Proxy Template back to default, issue the SSL, then change the Proxy Template again to what it normally uses.

Did something change where HestiaCP is having issues with Let’s Encrypt SSL issuance?

What is really odd as well, is that one other site uses a Proxy Template, that has an identical Proxy Template as one that did not get reissued, but this site’s got issued.

Any ideas or suggestions would be great, kind of a hassle to have to do that every 90 days.

2

Could you please show that proxy template?

Also the output of this command:

grep -rE "LETSENCRYPT_FAIL_COUNT='[1-9][0-9]?'" /usr/local/hestia/data/users
3 
grep -rE "LETSENCRYPT_FAIL_COUNT='[1-9][0-9]?'" /usr/local/hestia/data/users
/usr/local/hestia/data/users/someone/web.conf:
DOMAIN='adomain.com' 
IP='X.0.0.X' 
IP6='' 
CUSTOM_DOCROOT='' 
FASTCGI_CACHE='no' 
FASTCGI_DURATION='0s' 
ALIAS='www.adomain.com' 
TPL='default' 
SSL='yes' 
SSL_HSTS='yes' 
SSL_FORCE='yes' 
SSL_HOME='same' 
LETSENCRYPT_FAIL_COUNT='27' 
LETSENCRYPT='yes' 
FTP_USER='' 
FTP_MD5='' 
BACKEND='default' 
PROXY='default' 
PROXY_EXT='css,htm,html,js,mjs,json,xml,apng,avif,bmp,cur,gif,ico,jfif,jpg,jpeg,pjp,pjpeg,png,svg,tif,tiff,webp,aac,caf,flac,m4a,midi,mp3,ogg,opus,wav,3gp,av1,avi,m4v,mkv,mov,mpg,mpeg,mp4,mp4v,webm,otf,ttf,woff,woff2,doc,docx,odf,odp,ods,odt,pdf,ppt,pptx,rtf,txt,xls,xlsx,7z,bz2,gz,rar,tar,tgz,zip,apk,appx,bin,dmg,exe,img,iso,jar,msi,webmanifest' 
STATS='awstats' 
STATS_USER='' 
STATS_CRYPT='' 
U_DISK='4' 
U_BANDWIDTH='0' 
SUSPENDED='no' 
TIME='07:12:23' DATE='2026-06-01'

mop.tpl
#=========================================================================#
# Default Web Domain Template                                             #
# DO NOT MODIFY THIS FILE! CHANGES WILL BE LOST WHEN REBUILDING DOMAINS   #
# https://hestiacp.com/docs/server-administration/web-templates.html      #
#=========================================================================#

server {
        listen      %ip%:%proxy_port%;
        server_name %domain_idn% %alias_idn%;
        error_log   /var/log/%web_system%/domains/%domain%.error.log error;

        include %home%/%user%/conf/web/%domain%/nginx.forcessl.conf*;

        location ~ /\.(?!well-known\/|file) {
                deny all;
                return 404;
        }
# Allow Let's Encrypt ACME challenge
location ^~ /.well-known/acme-challenge/ {
    root %sdocroot%;
    allow all;
    try_files $uri =404;
}

        location / {
                proxy_pass https://X.0.0.X:443;
#proxy_ssl_server_name on;
#proxy_ssl_verify off;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        location @fallback {
                proxy_pass http://%ip%:%web_port%;
        }

        location /error/ {
                alias %home%/%user%/web/%domain%/document_errors/;
        }

        include %home%/%user%/conf/web/%domain%/nginx.conf_*;
}
4

Hestia doesn’t use files to provide the Let’s Encrypt challenge so you must remove above location from your mop.tpl and mop.stpl templates and rebuild your web domain.

5

If it doesn’t provide files, then how does it complete the challenge and why would it give a 404 error when trying to issue and SSL? All of the other domains have that exact same block and have worked, so why do I need to remove this now? Is this something that has changed recently?

6

Hestia adds a conf fille /home/user/conf/web/yourdomain/nginx.conf_letsencrypt with a content like this:

location ~ "^/\.well-known/acme-challenge/(.*)$" {
    default_type text/plain;
    return 200 "$1.eSr6Tg-ezUcQATLbM-g4XVnCY-R17zUfPphhJBx4mas";
}

If you removed this block:

# Allow Let's Encrypt ACME challenge
location ^~ /.well-known/acme-challenge/ {
    root %sdocroot%;
    allow all;
    try_files $uri =404;
}

And you still get the 404, double check that you removed it also from mop.stpl and you rebuild the web domain and the nginx has been reloaded/restarted.

If you still get the 404 error, move this line:

        include %home%/%user%/conf/web/%domain%/nginx.conf_*;

Before this line:

        include %home%/%user%/conf/web/%domain%/nginx.forcessl.conf*;

Do the same for the mop.stpl template, the line is a bit different, so don’t copy/paste it from the tpl template. Remember to rebuild the web domain.

I don’t know how that can work when block location ^~ /.well-known/acme-challenge/ { invalidates any other location using a regex like the one used by Hestia.

Nothing changed. I don’t know how your other domains are configured but if using that template, and the stpl has the same conf, Nginx can’t provide the correct challenge.

Before trying to issue more certificates for your domain, first test that you receive the challenge http://yourdomain/.well-known/acme-challenge/test

Also, I don’t know whether you are using a CDN like Cloudflare, if you share the actual domain name I could check it.