It doesn't. You can serve it over http.

With apache2 httpd, you can of course serve the challenge over insecure HTTP, but httpd won't start if you say it should use a cert that doesn't actually exist, so for the sake of automated setup and not having to edit the config multiple times it's way easier to write a self-signed cert and then overwrite it with LE. I think the situation is the same with nginx but not 100% sure.

You can use IfFile to gate the TLS part of the server until the certificate file exists, if you really don't want to edit your config files during TLS bootstrap.

The situation is the same with nginx. It's way easier to write a self-signed cert and then overwrite it with LE.

I just use dns and acme.sh for that reason and not bother about it anymore

Interesting! Thanks for pointing that out.

Though... I think I'd still include the snake oil cert and serve everything over SSL, because it simplifies the configuration.

How I solve this is that I deactivate all configuration files that have missing certificates, and then reactivate them again after the files have been created.

https://github.com/JonasAlfredsson/docker-nginx-certbot