How to avoid an address call loop when renewing an SSL certificate?

Question

Nginx

The situation is as follows:
a site has MYSITE.RU
been configured by certbot to automatically obtain and renew an SSL certificate once a month. Everything worked like clockwork until I set up a forced redirect to HTTPS
. The problem is that the server issuing the SSL certificate (Let's Encrypt) tries every time to contact the address

http://MYSITE.RU/.well-known/acme-challenge/какойтодлинныйключ/код

But we turned on the redirect to HTTPS - and it turns out that the bot first goes to:

1. http://MYSITE.RU/.well-known/acme-challenge/какойтодлинныйключ/код

   receives the code 301and the server sends it to
   

2. https://MYSITE.RU/.well-known/acme-challenge/какойтодлинныйключ/код

   and the bot already receives the code404
   

And so on in a circle to infinity .....
How to get out of this loop? Some kind of nonsense ...
How do you get out of this situation?

Answer 1

So it is not necessary to extend the redirect to .well-known- this is standard practice.

server {
        listen 80;

        location /.well-known/acme-challenge {
                root /var/www/letsencrypt;
        }

        location / {
        return 301 https://$server_name$request_uri;
        }
}

Etc.

Answer 2

CertBot can also validate domains via DNS .
Give it an API key to manage the domain (if your domain is delegated to one of the well-known hosters / registrars, including Google, DigitalOcean, CloudFlare, Linode) and the bot itself creates a temporary TXTrecord, checks it and generates a certificate.
Only when confirmed via DNS can wildcard certificates be created . Those. for any subdomains: *.mysite.ru
The site is not involved in this case and may even lie down.

Answer 3

I suspect that letsencrypt wants to place what letsencrypt wants on the second URL. Now you have nothing there and LE gets a whack. Smoke your NGINX config.

Answer 4

There is a complete utility,
sudo certbot run --nginx
removed the gimor by 99%, it seems everything works, only one site crashed, I just can’t figure out what the cant is ...
PS By the way, try sudo certbot run --nginx, an interesting thing