title: Nginx configuration, folder permissions and lets-encrypt
body: <p>I am trying to use <a href="https://letsencrypt.org" rel="noreferrer">certbot and letsencrypt</a> on my Ubuntu 16.0.4 server, so I can install a mail server.</p>
  
  <p>I am running certbot like this:</p>
  
  <blockquote>
    <p>sudo /opt/letsencrypt/certbot-auto certonly --agree-tos --webroot -w
    /path/to/www/example -d example.com -d www.example.com</p>
  </blockquote>
  
  <p>I get the following output from certbot (snippet shown below):</p>
  
  <pre><code>   Domain: www.example.com
     Type:   unauthorized
     Detail: Invalid response from
     http://www.example.com/.well-known/acme-challenge/QEZwFgUGOJqqXHcLmTmkr5z83dbH3QlrIUk1S3JI_cg:
     "&lt;html&gt;
     &lt;head&gt;&lt;title&gt;404 Not Found&lt;/title&gt;&lt;/head&gt;
     &lt;body bgcolor="white"&gt;
     &lt;center&gt;&lt;h1&gt;404 Not Found&lt;/h1&gt;&lt;/center&gt;
     &lt;hr&gt;&lt;center&gt;"
  
     To fix these errors, please make sure that your domain name was
     entered correctly and the DNS A record(s) for that domain
     contain(s) the right IP address.
  </code></pre>
  
  <p>This is what my directory structure looks like:</p>
  
  <pre><code>root@yourbox:/path/to/www/example$ ls -la
  total 12
  drwxr-xr-x 3 example root    4096 Nov  1 10:17 .
  drwxr-xr-x 5 root        webapps 4096 Nov  1 10:13 ..
  drwxr-xr-x 2 root        root    4096 Nov  1 10:36 .well-known
  root@yourbox:/path/to/www/example$ 
  root@yourbox:/path/to/www/example$ cd .well-known/
  root@yourbox:/path/to/www/example/.well-known$ ls -la
  total 8
  drwxr-xr-x 2 root        root 4096 Nov  1 10:36 .
  drwxr-xr-x 3 example root 4096 Nov  1 10:17 ..
  root@yourbox:/path/to/www/example/.well-known$ 
  </code></pre>
  
  <p>From above, I can see that the challenge file does not exist - (presumably?) because, it looks like the certbot is unable to write to the folder. </p>
  
  <p>However, I first needed to check that nginx was set up correctly, and that it was serving files from folders starting with a period.</p>
  
  <p>This is the configuration file for nginx for the website (/etc/nginx/sites-available/example):</p>
  
  <pre><code>server {
      # Allow access to the letsencrypt ACME Challenge
      location ~ /\.well-known\/acme-challenge {
          allow all;
      }
  }
  </code></pre>
  
  <p>I manually created a testfile (sudo touch /path/to/www/example/fake) and gave it the correct permissions:</p>
  
  <pre><code>root@yourbox:/path/to/www/example/.well-known/acme-challenge$ ls -l
  total 0
  -rw-r--r-- 1 example webapps 0 Nov  1 10:45 fake
  </code></pre>
  
  <p>I then tried to access <a href="http://www.example.com/.well-known/acme-challenge/fake" rel="noreferrer">http://www.example.com/.well-known/acme-challenge/fake</a> from a browser - and got a 404 error.</p>
  
  <p>This means I have two errors:</p>
  
  <ol>
  <li>Nginx is not correctly setup to serve files from the <code>.well-known/acme-challenge</code> folder</li>
  <li>The file permissions in the <code>/path/to/www/example</code> folder are wrong, so certbot can't write its automatically generated files to the <code>.well-known/acme-challenge</code> folder.</li>
  </ol>
  
  <p>How may I fix these issues?</p>