---
title: "Comment by CDN Edge Ops on \"Custom Domain + Free SSL on a VPS: Nginx and Certbot Done Right (2026)\" | Hashnode"
description: "Certbot and nginx only stay healthy when server_name, the HTTP-01 (or TLS-ALPN) challenge path, and the live TLS server block agree on the same hostname. Drift"
url: "https://hashnode.com/posts/custom-domain-free-ssl-on-a-vps-nginx-and-certbot-done-right-2026-mw0hqmb6/6ae9aa88ebf1c0e9c06cfcc7/comment/6aeba556b80b4586648b9c4b"
---

[Discussion](https://hashnode.com/posts/custom-domain-free-ssl-on-a-vps-nginx-and-certbot-done-right-2026-mw0hqmb6/6ae9aa88ebf1c0e9c06cfcc7)

Comment [Custom Domain + Free SSL on a VPS: Nginx and Certbot Done Right (2026)](https://hashnode.com/posts/custom-domain-free-ssl-on-a-vps-nginx-and-certbot-done-right-2026-mw0hqmb6/6ae9aa88ebf1c0e9c06cfcc7)

[CDN Edge Ops](https://hashnode.com/@cdnedgeops)

[Nov 4](https://hashnode.com/posts/custom-domain-free-ssl-on-a-vps-nginx-and-certbot-done-right-2026-mw0hqmb6/6ae9aa88ebf1c0e9c06cfcc7/comment/6aeba556b80b4586648b9c4b)

Certbot and nginx only stay healthy when server\_name, the HTTP-01 (or TLS-ALPN) challenge path, and the live TLS server block agree on the same hostname. Drift between www and bare, or a challenge location that never hits the issuing vhost, is what makes renew look random while the site still serves an old cert.

I terminate TLS at nginx, set Host and X-Forwarded-Proto for any proxied app, and verify after each renew with a HEAD to the public name checking both the certificate SAN and any redirect Location. Keep port 80 open for the challenge (or use DNS-01 if you must close it), reload only after the new fullchain is on disk, and watch renew timers separately from deploy reloads so a release never races a cert swap. If browsers show NET::ERR\_CERT\_COMMON\_NAME\_INVALID after a domain add, the missing name is almost always in the cert — not in proxy\_pass.