title: Certbot failing acme-challenge (connection refused)
body: <p>I'm trying to set up a Django project with docker + nginx following the tutorial <a href="https://pentacent.medium.com/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71" rel="noreferrer">Nginx and Let's Encrypt with Docker in Less Than 5 Minutes</a>.</p>
  <p>The issue is when I run the script init-letsencrypt.sh I end up with failed challenges.</p>
  <p>Here is the content of my script:</p>
  <pre><code>#!/bin/bash
  
  if ! [ -x &quot;$(command -v docker-compose)&quot; ]; then
    echo 'Error: docker-compose is not installed.' &gt;&amp;2
    exit 1
  fi
  
  domains=(xxxx.yyyy.net www.xxxx.yyyy.net)
  rsa_key_size=4096
  data_path=&quot;./data/certbot&quot;
  email=&quot;myemail@example.com&quot; # Adding a valid address is strongly recommended
  staging=1 # Set to 1 if you're testing your setup to avoid hitting request limits
  
  if [ -d &quot;$data_path&quot; ]; then
    read -p &quot;Existing data found for $domains. Continue and replace existing certificate? (y/N) &quot; decision
    if [ &quot;$decision&quot; != &quot;Y&quot; ] &amp;&amp; [ &quot;$decision&quot; != &quot;y&quot; ]; then
      exit
    fi
  fi
  
  
  if [ ! -e &quot;$data_path/conf/options-ssl-nginx.conf&quot; ] || [ ! -e &quot;$data_path/conf/ssl-dhparams.pem&quot; ]; then
    echo &quot;### Downloading recommended TLS parameters ...&quot;
    mkdir -p &quot;$data_path/conf/&quot;
    curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf &gt; &quot;$data_path/conf/options-ssl-nginx.conf&quot;
    curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem &gt; &quot;$data_path/conf/ssl-dhparams.pem&quot;
    echo
  fi
  
  echo &quot;### Creating dummy certificate for $domains ...&quot;
  path=&quot;/etc/letsencrypt/live/$domains&quot;
  mkdir -p &quot;$data_path/conf/live/$domains&quot;
  docker-compose -f docker-compose-deploy.yml run --rm --entrypoint &quot;\
    openssl req -x509 -nodes -newkey rsa:$rsa_key_size -days 1\
      -keyout '$path/privkey.pem' \
      -out '$path/fullchain.pem' \
      -subj '/CN=localhost'&quot; certbot
  echo
  
  
  echo &quot;### Starting nginx ...&quot;
  docker-compose -f docker-compose-deploy.yml up --force-recreate -d proxy
  echo
  
  echo &quot;### Deleting dummy certificate for $domains ...&quot;
  docker-compose -f docker-compose-deploy.yml  run --rm --entrypoint &quot;\
    rm -Rf /etc/letsencrypt/live/$domains &amp;&amp; \
    rm -Rf /etc/letsencrypt/archive/$domains &amp;&amp; \
    rm -Rf /etc/letsencrypt/renewal/$domains.conf&quot; certbot
  echo
  
  
  echo &quot;### Requesting Let's Encrypt certificate for $domains ...&quot;
  #Join $domains to -d args
  domain_args=&quot;&quot;
  for domain in &quot;${domains[@]}&quot;; do
    domain_args=&quot;$domain_args -d $domain&quot;
  done
  
  # Select appropriate email arg
  case &quot;$email&quot; in
    &quot;&quot;) email_arg=&quot;--register-unsafely-without-email&quot; ;;
    *) email_arg=&quot;--email $email&quot; ;;
  esac
  
  # Enable staging mode if needed
  if [ $staging != &quot;0&quot; ]; then staging_arg=&quot;--staging&quot;; fi
  
  docker-compose  -f docker-compose-deploy.yml run --rm --entrypoint &quot;\
    certbot -v certonly --webroot -w /var/www/certbot \
      $staging_arg \
      $email_arg \
      $domain_args \
      --rsa-key-size $rsa_key_size \
      --agree-tos \
      --force-renewal&quot; certbot
  echo
  
  echo &quot;### Reloading nginx ...&quot;
  docker-compose  -f docker-compose-deploy.yml exec proxy nginx -s reload
  </code></pre>
  <p>And my nginx configuration file:</p>
  <pre><code>server {
      listen 80;
      server_name xxxx.yyyy.net;
         
      location ^~ /.well-known/acme-challenge/ {
          root /var/www/certbot;
      }
      
      location / {
          return 301 https://$server_name$request_uri;
      }
  
  }
  
  server {
      listen 443 ssl;
      server_name xxxx.yyyy.net;
      
      ssl_certificate /etc/letsencrypt/live/xxxx.yyyy.net/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/xxxx.yyyy.net/privkey.pem;
      include /etc/letsencrypt/options-ssl-nginx.conf;
      ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; 
      
      location /static {
          alias /vol/static;
      }
  
      location / {
          uwsgi_pass web:8000;
          include /etc/nginx/uwsgi_params;
      }
  
  }
  
  </code></pre>
  <p>The output of the part that fails:</p>
  <pre><code>Requesting a certificate for xxxx.yyyy.net and www.xxxx.yyyy.net
  Performing the following challenges:
  http-01 challenge for xxxx.yyyy.net
  http-01 challenge for www.xxxx.yyyy.net
  Using the webroot path /var/www/certbot for all unmatched domains.
  Waiting for verification...
  Challenge failed for domain xxxx.yyyy.net
  Challenge failed for domain www.xxxx.yyyy.net
  http-01 challenge for xxxx.yyyy.net
  http-01 challenge for www.xxxx.yyyy.net
  
  Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
    Domain: xxxx.yyyy.net
    Type:   connection
    Detail: Fetching http://xxxx.yyyy.net/.well-known/acme-challenge/XJw9w39lRSSbPf-4tb45RLtTnSbjlUEi1f0Cqwsmt-8: Connection refused
  
    Domain: www.xxxx.yyyy.net
    Type:   connection
    Detail: Fetching http://www.xxxx.yyyy.net/.well-known/acme-challenge/b47s4WJARyOTS63oFkaji2nP7oOhiLx5hHp4kO9dCGI: Connection refused
  
  Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.
  
  Cleaning up challenges
  Some challenges have failed.
  Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
  ERROR: 1
  </code></pre>
  <p>One of the comments said:</p>
  <p><a href="https://i.stack.imgur.com/tyhI0.png" rel="noreferrer"><img src="https://i.stack.imgur.com/tyhI0.png" alt="comment" /></a></p>
  <p>But there's no further explanation as to how to solve it.</p>
  <p><a href="https://github.com/certbot/certbot/commit/8bcb04af4a1aec87fa838283eb5c6a4e2d1a625c" rel="noreferrer">Check the certbot commit</a></p>