Hi,
Cron task execution is logged in /var/log/cron. You will find there all the tasks that were executed.
How do you back up your data? Is it scheduled within this timeframe?
That leaves you with a strace:
dnf install strace
strace -s1024 -o output.txt httpd -X -e Debug
zip the output.txt file and send it in a private message. The file will contain references of all the hosted files, system users and IP addresses.
Don't post it in the thread!
We also observed high traffic volumes from that huge subnet. The simplest approach is to block it since you don't expect traffic from a different hosting company.
In your case, firewall blocking won't help since your firewall will see only Cloudflare IP addresses. You can block in nginx but it...
Interesting. Taking another look at my /etc/nginx/plesk.conf.d/server.conf, it's exactly the same as yours.
If you reconfigure, do you still get the error message?
plesk sbin httpdmng --reconfigure-all
I ran into a similar issue. In my case, it pointed out that I didn't have TLS1.3 enabled:
plesk bin server_pref -s | grep ssl
Since ssl-protocols didn't have TLSv1.3, I used:
plesk bin server_pref -u -ssl-protocols 'TLSv1.2 TLSv1.3'
Afterwards, I reconfigured the webserver and I had HTTP/3...
The domain DNS zone. Some registrars provide IPv6 by default in the hosted DNS zone. You changed only the A record while you still have AAAA records without having an IPv6 address on your server.
Interesting. Check the User-Agent used by the Let's Encrypt server. In the logs section of the website in Plesk, look for requests to /.well-known/. Please share the requests made while the certificate issue is attempted.