Certbot: Could not automatically find a matching server block for example.com. Set the `server_name` directive to use the Nginx installer
Certbot's Nginx plugin could not find a server block whose server_name matches the domain you requested.
Could not automatically find a matching server block forSet the `server_name` directive to use the Nginx installerCould not find a usable 'server' blockcertbot nginx server_name not foundCould not automatically find a matching server block for example.com Meaning
The --nginx installer edits configs by server_name. Add the exact domain to a server block (and reload) or switch to certonly --webroot and edit the config yourself. Make sure the config is in an included path (sites-enabled).
Common causes
- server_name missing or different from -d domain
- Config not included by nginx.conf
- Default_server catching everything
- Typo in domain
- Config file not symlinked to sites-enabled
⚡ Quick fix
- Add
server_name example.com www.example.com;andnginx -t && systemctl reload nginx - Or use
certbot certonly --webroot -w /var/www/html -d example.com - Check with
nginx -T | grep server_name
Detailed fix by platform
Linux
sudo nginx -T | grep -n server_namethensudo certbot --nginx -d example.com -d www.example.com
How to diagnose
- server_name — Matches -d?
- Include — Config active?
- Plugin — nginx or webroot?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
- 499 Client Closed Request / client prematurely closed connection Nginx: [info] client prematurely closed connection while reading response header from upstream / access log status 499
- bind() failed (98: Address already in use) nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
- Challenge failed for domain Let’s Encrypt / Certbot: Challenge failed for domain example.com — Invalid response from http://example.com/.well-known/acme-challenge/x: 404
Most viewed in SSL / TLS
- NET::ERR_CERT_COMMON_NAME_INVALID NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain)
- no start line OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch)
- NSURLErrorServerCertificateUntrusted (-1202) iOS: Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be 'example.com'"
Other ways to find it
Where this error sits
Origin: Network. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Report a correction or suggest an improvement
Last updated 4 Nov 2026