I am running Sentry on AWS using Docker. The service is now running on port 9000.

I would like to use HTTPS, getting the certificate from Let's Encrypt. However I get the following error:

sudo certbot --nginx certonly
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Which names would you like to activate HTTPS for?
------------------------------------------------------------------------------- 1: sentry.example.com
------------------------------------------------------------------------------- Select the appropriate numbers separated by commas and/or spaces, or
leave input blank to select all options shown (Enter 'c' to cancel): **1**
Obtaining a new certificate Performing the following challenges:
tls-sni-01 challenge for sentry.example.com Waiting for
verification... Cleaning up challenges Failed authorization procedure.
sentry.example.com (tls-sni-01): urn:acme:error:connection :: The
server could not connect to the client to verify the domain ::
Connection reset by peer

 - The following errors were reported by the server:

   Domain: sentry.example.com    Type:   connection    Detail:
Connection reset by peer

   To fix these errors, please make sure that your domain name was   
entered correctly and the DNS A/AAAA record(s) for that domain   
contain(s) the right IP address. Additionally, please check that   
your computer has a publicly routable IP address and that no   
firewalls are preventing the server from communicating with the   
client. If you're using the webroot plugin, you should also verify   
that you are serving files from the webroot path you provided.
root@ip-172-31-23-107:/home/ubuntu/onpremise# netstat -ntlp Active
Internet connections (only servers)
netstat -ntlp

enter image description here

AWS 'firewall' rules

enter image description here

Online DNS lookup

enter image description here

2 Answers 2


I share my experience without docker but definitely with apache.

  1. It's possible the internet busy. Just try it later.
  2. Try with webroot. https://certbot.eff.org/docs/using.html#nginx

  3. Have you ever been applied this domain? Try to revoke it and then apply it.

Since a new support, there is a CAA record may be met when you get successful. Just add CAA to AWS if AWS support this record.

Wish these are able to help you.


Apparantly it worked better when first generating a self signed certificate and later requesting a Let's encrypt cert.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .