Rubin Shrestha
Rubin Shrestha
Blog

After running certbot, I get connection refused to my nginx server and can’t see why

by |Published

Problem

Putting mydomain.me into Firefox/Vivaldi fails to connect, with

GET https://mydomain.me/       NS ERROR CONNECTION REFUSED

Firefox is set up to convert http to https (but I’ve tried to turn that setting off – and disabling caching, without success)

Context:

OpenSuse Tubleweed on my desktop: ip 192.168.7.7

uname -a 
Linux tranquility 6.18.0-2-default #1 SMP PREEMPT_DYNAMIC Sat Dec  6 07:14:55 UTC 2025 (371bdaf) x86_64 x86_64 x86_64 GNU/Linux

nginx installed and running

systemctl status nginx
● nginx.service - The nginx HTTP and reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: disabled)
     Active: active (running) since Sun 2025-12-21 18:19:02 GMT; 36min ago
 Invocation: <redacted>
    Process: 117149 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
   Main PID: 117152 (nginx)
      Tasks: 2 (limit: 76779)
        CPU: 78ms
     CGroup: /system.slice/nginx.service
             ├─117152 "nginx: master process /usr/sbin/nginx -g daemon off;"
             └─117157 "nginx: worker process"

Dec 21 18:19:02 tranquility systemd[1]: Starting The nginx HTTP and reverse proxy server...
Dec 21 18:19:02 tranquility nginx[117149]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
Dec 21 18:19:02 tranquility nginx[117149]: nginx: configuration file /etc/nginx/nginx.conf test is successful
Dec 21 18:19:02 tranquility systemd[1]: Started The nginx HTTP and reverse proxy server.

nginx.conf – using a copy of nginx.conf.default but with comment lines removed

events {
    multi_accept on;
    worker_connections 1024;
}
http {
    include mime.types;
    default_type application/octet-stream;

    http2 on;
    sendfile on;
    keepalive_timeout 70;
    include conf.d/*.conf; #empty stub files in here
    server {
        listen 80;
        server_name localhost;
        location / {
            root /srv/www/mydomain.me/htdocs;
            index index.html index.htm;
        }
    }
    include vhosts.d/*.conf;
}

Tried this content in both conf.d/mydomain.me.conf and vhosts.d/mydomain.me.conf (but not at the same time)

server {
    if ($host = mydomain.me) {
        return 301 https://$host$request_uri;
    } # managed by Certbot # IPv4 # IPv6
    server_name  mydomain.me;
    location / {
        proxy_pass http://127.0.0.1:3000; # URL to the Node.js app
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_cache_bypass $http_upgrade;
    }
    listen 443 ssl; # managed by Certbot
    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mydomain.me/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mydomain.me/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
    if ($host = mydomain.me) {
        return 301 https://$host$request_uri;
    } # managed by Certbot
    listen 80;
    listen [::]:80;
    server_name  mydomain.me;
    return 404; # managed by Certbot

My domain reg’s DNS entry for mydomain.me

I do have other A types for other servers but I just want to get a basic web page working with https for the moment

Type    Name    Data            TTL
a   @   My static IP    1 Hour

OpenWRT firewall port forwards (certbot)

config redirect                              
        option dest 'lan'                       
        option target 'DNAT'    
        option name 'certbot'         
        option src 'wan'            
        option src_dport '80'                  
        option dest_ip '192.168.7.7'
        option dest_port '80'             
                                           
config redirect                               
        option dest 'lan'                         
        option target 'DNAT'               
        option name 'certbot6'     
        option src 'wan'                        
        option src_dport '443'           
        option dest_ip '192.168.7.7'  
        option dest_port '443'

I also have firewall rules that forward all DNS requests to PiHole

config redirect                      
        option dest 'lan'          
        option target 'DNAT'                    
        option name 'RedirectLAN-DNS'  
        option src 'lan'              
        option src_ip '192.168.7.77'
        option src_port '53'                
        option src_dport '53'  
        option dest_ip '192.168.7.77'              
        option dest_port '53'

I have checked the location of fullchain.pem & privkey.pem and they exist in /etc/archive/mydomain.me/ and there are aliases to those in /etc/letsencrypt/live/mydomain.me/

I can’t think of anything else to list here but please ask if more is needed. Happy to edit down to make the question more readable but this is new territory for me, so I’m not sure what’s superfluous.

For me there’s a lot going on and I can’t yet identify the working parts, let alone pinpoint the part of the flow that’s wrong: nginx, firewall, firefox, piHole, DNS settings.

Thanks

You may also like