Как исправить ошибку в процессе генерации сертификата Let's encrypt

У меня на сервере есть A-запись:

192.0.2.4 - мой внешний ip (конечно это пример);
master.example.org - A-запись для этого ip-адреса

Команда:

certbot certonly --webroot --agree-tos --email testcert@example.org -w /home/www/acme/ -d master.example.org -d www.master.example.org

Моя часть конфига (master.conf) в конфигах nginx:

server
{
    listen 192.0.2.4;
    listen 192.0.2.4:443 ssl;

    server_name www.master.example.org;

    expires -100;
    #ssl_certificate_key /etc/letsencrypt/live/master.example.org/privkey.pem;
    #ssl_certificate /etc/letsencrypt/live/master.example.org/fullchain.pem;

    error_page 403 @forbidden;
    error_page 404 @notfound;
    error_page 405 @notallowed;
    error_page 500 @internalerror;

    # letsencrypt
    location ~ ^/\.well-known/acme-challenge
    {
        auth_basic off;
        root /home/www/acme;
    }

Ошибка, после генерации давайте зашифруем:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for master.example.org
http-01 challenge for www.master.example.org
Using the webroot path /home/www/acme for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. master.example.org (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://master.example.org/.well-known/acme-challenge/kCDuTttqcv1TchrOJy6HHwXtWMuWPkVfZxXMpWXAiXc: Connection refused

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: master.example.org
   Type:   connection
   Detail: Fetching
   http://master.example.org/.well-known/acme-challenge/kCDuTttqcv1TchrOJy6HHwXtWMuWPkVfZxXMpWXAiXc:
   Connection refused

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.

Что я должен делать ? Я действительно устал, много времени ищу и не нашел ответа, но мне нужно сгенерировать этот сертификат. Где у меня ошибка?