Nginx 403 Forbidden Even After Setting The Permission - django

Question

I want to get Letsencrpyt SSL for my domain. Part of the process is, the site needs to be authorized before getting the certificate.
I created the folder ./well-known and ran the command I was asked to and I got;
Nginx 403 forbidden.
I'm on nginx/1.10.0 (Ubuntu)
I chown the directory and granted it 755 yet still the same. Check out the permissions in my directory below.
namei -l /var/www/example.com/.well-known
f: /var/www/example.com/.well-known
drwxr-xr-x root root /
drwxr-xr-x root root var
drwxr-xr-x root root www
drwxr-xr-x cman sudo example.com
drwxr-xr-x cman sudo .well-known
I also created a working.html file in the /.well-known folder and I load example.com/.well-known/working.html, I got the same 403 Forbidden.
Nginx.conf
upstream kip_app_server {
# fail_timeout=0 means we always retry an upstream even if it failed
# to return a good HTTP response (in case the Gunicorn master nukes a
# single worker for timing out).
server unix:/var/www/example.com/src/run/trav.sock fail_timeout=0;
}
server {
listen 80;
server_name example.com www.example.com;
location = /favicon.ico { access_log off; log_not_found off; }
access_log /var/www/example.com/logs/access.log;
error_log /var/www/example.com/logs/nerror.log;
charset utf-8;
client_max_body_size 75M;
location /static/ {
alias /var/www/example.com/src/static/;
}
location /media/ {
alias var/www/example.com/src/media/;
}
location ~ /\.well-known {
allow all;
alias /var/www/example.com/.well-known/;
}
location / {
include proxy_params;
proxy_pass http://kip_app_server;
#proxy_set_header X-Forwarded-Host $server_name;
#proxy_set_header X-Real-IP $remote_addr;
}
}

Answer 1

Your code would work if you were not using an alias.
Try this:
location ^~ /.well-known {
allow all;
alias /var/www/example.com/.well-known/;
}
or this:
location ^~ /.well-known {
allow all;
auth_basic off;
alias /path/to/.well-known/;
}
When aliasing, the ^ is required.
This is Nginx specific behaviour, to the way they perform matching. There is a detailed write-up here on matching logic and caveats, it is confusing: https://github.com/letsencrypt/acme-spec/issues/221

Answer 2

I tried but could not figure this out. I believe certbot is not getting the correct location and is probably writing the challenge to some other location. I had a script watching the acme challenge directory and nothing was ever created there. Ended by using the webroot option.
certbot certonly -d example.com -a webroot
It prompts for the webroot location, but only for the 1st time - not for renewal, which allows for auto-renewal. It may work without the certonly option, but I did not try it. I updated the NGINX config manually with the cert location.