title: Renewing letsencrypt certificate fails due to DNS A/AAAA records
body: <p>I have a Next.JS app hosted on Linode using nginx and pm2.</p>
  <p>When I try to renew my certificate I run the following command:</p>
  <pre><code>sudo letsencrypt certonly -a webroot --webroot-path=/var/www/project -d example.com -d www.example.com
  </code></pre>
  <p>However this results in some challenges failing, specifically this error:</p>
  <pre><code>IMPORTANT NOTES:
   - The following errors were reported by the server:
  
     Domain: example.com
     Type:   unauthorized
     Detail: Invalid response from
     https://example.com/.well-known/acme-challenge/tdrjf7xqYmTEcZUGxfpDQ179XVA55wcaV6de30nMlJE
     [2a01:7e01::f03c:92ff:fefb:29]: &quot;&lt;html&gt;\r\n&lt;head&gt;&lt;title&gt;404 Not
     Found&lt;/title&gt;&lt;/head&gt;\r\n&lt;body&gt;\r\n&lt;center&gt;&lt;h1&gt;404 Not
     Found&lt;/h1&gt;&lt;/center&gt;\r\n&lt;hr&gt;&lt;center&gt;nginx/1.16.1 (Ub&quot;
  
     Domain: www.example.com
     Type:   unauthorized
     Detail: Invalid response from
     https://example.com/.well-known/acme-challenge/AlIotwMFT_m-mlPvlg30Ya2r4sFm6qxLjZxjnBmmOJA
     [2a01:7e01::f03c:92ff:fefb:29]: &quot;&lt;html&gt;\r\n&lt;head&gt;&lt;title&gt;404 Not
     Found&lt;/title&gt;&lt;/head&gt;\r\n&lt;body&gt;\r\n&lt;center&gt;&lt;h1&gt;404 Not
     Found&lt;/h1&gt;&lt;/center&gt;\r\n&lt;hr&gt;&lt;center&gt;nginx/1.16.1 (Ub&quot;
  
     To fix these errors, please make sure that your domain name was
     entered correctly and the DNS A/AAAA record(s) for that domain
     contain(s) the right IP address.
  </code></pre>
  <p>Now I am not sure if I have to configure something else in Linode or something else. Anyone know what I need to do?</p>
  <p>Here is my nginx setup:</p>
  <pre><code># redirect http to https
  server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
  }
  
  server {
    # listen on *:443 -&gt; ssl; instead of *:80
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
  
    server_name example.com;
  
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include snippets/ssl-params.conf;
  
    location / {
      # reverse proxy for next server
      proxy_pass http://localhost:3000;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection 'upgrade';
      proxy_set_header Host $host;
      proxy_cache_bypass $http_upgrade;
  
      # we need to remove this 404 handling
      # because next's _next folder and own handling
      # try_files $uri $uri/ =404;
    }
  
    location ~ /.well-known {
      allow all;
    }
  }
  </code></pre>