HTTP-01 still fails most often when the challenge path is proxied to the app instead of served by nginx. Keep a dedicated location for /.well-known/acme-challenge and reload only after nginx -t.