When Certbot renews over HTTP-01, Nginx must serve /.well-known/acme-challenge/ from disk and not proxy that path to the app. A dedicated location with root or alias, and no proxy_pass, keeps renewals working even if the upstream is down or returns its own 404. After changing the config, run a dry-run renewal and confirm the challenge file is what Nginx returns.