I think there is a bug inside the template, because the ssl section has the following lines: ssl_certificate <tmpl_var name='document_root'>/ssl/<tmpl_var name='ssl_domain'>.crt; ssl_certificate_key <tmpl_var name='document_root'>/ssl/<tmpl_var name='ssl_domain'>.key; But only for redirects! In "normal" webservers are ssl settings correct: ssl_certificate <tmpl_var name='ssl_crt_file'>; ssl_certificate_key <tmpl_var name='ssl_key_file'>; So i think the rewrites should be patched to make letsencrypt possible ;) Otherwise the $domain-le.crt files will not be found.