Nginx Django Gunicorn https site cannot be reached error

Question

so I have a Django application, on a droplet running Ubuntu. I have nginx and Gunicorn and I am trying to setup https with Let's Encrypt, but I keep getting a "Site cannot be reached error".

Here is my nginx.conf :

upstream Tutorial2_prod{ server unix:/var/test/proiect/Tutorial2.sock fail_timeout=0; } server { server_name juristnet.ro www.juristnet.ro; listen 443; # <- ssl on; # <- ssl_certificate /etc/letsencrypt/live/juristnet.ro/fullchain.pem; # <- ssl_certificate_key /etc/letsencrypt/live/juristnet.ro/privkey.pem; # <- ssl_protocols TLSv1 TLSv1.1 TLSv1.2; location = /favicon.ico { access_log off; log_not_found off; alias /var/test/proiect/favicon.ico; } location /static/ { autoindex on; root /var/test/proiect; } location /assets/ { autoindex on; alias /var/test/proiect/assets/; } location /.well-known/ { autoindex on; allow all; alias /var/test/proiect/.well-known/; } location / { include /etc/nginx/fastcgi_params; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://unix:/var/test/proiect/Tutorial2.sock; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; } } server { listen 80; server_name www.juristnet.ro juristnet.ro; return 301 https://juristnet.ro$request_uri; } 

Output of netstat -an | grep 443

tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN tcp 0 36 46.101.111.197:22 81.196.30.196:44356 ESTABLISHED 

Gunicorn conf file:

description "Gunicorn application server handling juristnet" start on runlevel [2345] stop on runlevel [!2345] respawn setuid admin setgid root chdir /var/test/proiect exec /var/test/proiect/jurist/bin/gunicorn --workers 3 --bind unix:/var/test/proiect/Tutorial2.sock Tutorial2.wsgi:application 

Error logs are clear. Nginx -t returns no error. I can't figure out what is happening, i think it could be caused by the proxy_pass in the nginx conf. The domain is redirected correctly to https://example.com, but it shows nothing. Just that Connection Refused error. Any help would be appreciated, thank you!

Answer 1

Perhaps running nginx and the Gunicorn process as the same user & group may yield results.

Specifying the user and group in the nginx.conf by specifying:

user username groupname 

Answer 2

You provide little indication as to Let's Encrypt invocation but I'm assuming webroot. In that case you need to serve challenges over port 80 so you need to have a location block for .well-known instead of a catch-all redirect.