How to get a certificate for a subdomain?

Question

Nginx

There is a server on Nginx. The server is running a site with a certificate from Let's Encrypt
I installed phpMyAdmin and decided to make it a subdomain, here is the Nginx config:

server {
  listen 80 http2;
  listen [::]:80 http2;
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  
  root /usr/share/phpmyadmin/;
  index index.php;
  autoindex off;
  server_name phpmyadmin.site.ru www.phpmyadmin.site.ru;

  ssl_certificate /home/Webserver/site.ru/SSL/fullchain.pem;
  ssl_certificate_key /home/Webserver/site.ru/SSL/privkey.pem;
  ssl_trusted_certificate /home/Webserver/site.ru/SSL/chain.pem;

  location ^~ /.well-known/acme-challenge/ {
    default_type "text/plain";
    root /usr/share/phpmyadmin/;
  }

  location = /.well-known/acme-challenge/ {
    return 404;
  }

  location ~ /\.ht {
    deny all;
  }
  
  location / {
    try_files $uri $uri/ =404;
  }
  
  location ~ \.php$ {
    root /usr/share/phpmyadmin/;
    try_files $uri =404;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_pass unix:/run/php/php-fpm-site.ru.sock;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
  }
}

Of course, I created the /.well-known/acme-challenge/ directory in /usr/share/phpmyadmin and directed DNS to the subdomain and waited an hour.
After that, I try to expand with the command:

certbot certonly --dry-run --webroot -w /usr/share/phpmyadmin/ --expand -d phpmyadmin.site.ru -d www.phpmyadmin.site.ru

But the bot throws an error:

Failed authorization procedure. phpmyadmin.site.ru (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://phpmyadmin.site.ru/.well-known/acme-challenge/f0VCqUCbl1UC23M92EwElY4OcICO5gV48bKjRIiZxqw: Error getting validation data, www.phpmyadmin.site.ru (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://www.phpmyadmin.site.ru/.well-known/acme-challenge/AoIxyKLTCL7gzbnH9s7qhaNMPUveA71kMWzZsIxCO3M: Error getting validation data

Judging by the error, he can not access, but I do not understand why?

Answer 1

Beat on HTTP 2.0, leaving in the block responsible for port 80 only the location for LE verification and an unconditional redirect to HTTPS:

server {
        listen 80;

        location /.well-known/acme-challenge {
                root /usr/share/phpmyadmin;
        }

        location / {
        rewrite ^/(.*) https://$host/$1;
        }
}