curl: (7) Failed to connect to 127.0.0.1 port 8999: Connection refused

Docker file and lua-resty-auto-ssl version:
```
root@docker-s-1vcpu-2gb-sgp1-01:~# cat /var/discourse/docker-lua-resty-auto-ssl/Dockerfile
FROM openresty/openresty:1.15.8.2-1-bionic

RUN /usr/local/openresty/luajit/bin/luarocks install lua-resty-auto-ssl

RUN openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -subj '/CN=sni-support-required-for-valid-ssl' -keyout /etc/ssl/resty-auto-ssl-fallback.key -out /etc/ssl/resty-auto-ssl-fallback.crt

ADD nginx.conf /usr/local/openresty/nginx/conf/nginx.conf

ENTRYPOINT ["/usr/local/openresty/nginx/sbin/nginx", "-g", "daemon off;"]
```

nginx.conf :
```
# root@docker-s-1vcpu-2gb-sgp1-01:/var/discourse/docker-lua-resty-auto-ssl# docker build . -t antivte/docker-lua-resty-auto-ssl

# docker run -p 80:80 -v /var/discourse/shared/:/var/discourse/shared/ -p 443:443 antivte/docker-lua-resty-auto-ssl
events {
worker_connections 1024;
}

http {
# The "auto_ssl" shared dict must be defined with enough storage space to
# hold your certificate data.
lua_shared_dict auto_ssl 1m;
lua_shared_dict auto_ssl_settings 64k;
# A DNS resolver must be defined for OSCP stapling to function.
resolver 8.8.8.8;

# Initial setup tasks.
init_by_lua_block {
auto_ssl = (require "resty.auto-ssl").new()

-- Define a function to determine which SNI domains to automatically handle
-- and register new certificates for. Defaults to not allowing any domains,
-- so this must be configured.

auto_ssl:set("allow_domain", function(domain, auto_ssl, ssl_options)
return ngx.re.match(domain, "(antivte.com|bbs.antivte.com|ytb.antivte.com|cp.antivte.com)", "ijo")
end)
auto_ssl:set("dir", "/tmp")

auto_ssl:init()
}

init_worker_by_lua_block {
auto_ssl:init_worker()
}


server {
listen 80; listen [::]:80;
server_name bbs.antivte.com; # <-- change this
return 301 https://$host$request_uri;

# Endpoint used for performing domain verification with Let's Encrypt.
location /.well-known/acme-challenge/ {
content_by_lua_block {
auto_ssl:challenge_server()
}
}

}

server {
listen 443 ssl http2; listen [::]:443 ssl http2;
server_name bbs.antivte.com; # <-- change this

# Dynamic handler for issuing or returning certs for SNI domains.
ssl_certificate_by_lua_block {
auto_ssl:ssl_certificate()
}

# You must still define a static ssl_certificate file for nginx to start.
#
# You may generate a self-signed fallback with:
#
# openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
# -subj '/CN=sni-support-required-for-valid-ssl' \
# -keyout /etc/ssl/resty-auto-ssl-fallback.key \
# -out /etc/ssl/resty-auto-ssl-fallback.crt
ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;

http2_idle_timeout 5m; # up from 3m default

location / {
proxy_pass http://unix:/var/discourse/shared/bbs/nginx.http.sock:;
proxy_set_header Host $http_host;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
}
}

server {
listen 80; listen [::]:80;
server_name ytb.antivte.com; # <-- change this
return 301 https://$host$request_uri;

# Endpoint used for performing domain verification with Let's Encrypt.
location /.well-known/acme-challenge/ {
content_by_lua_block {
auto_ssl:challenge_server()
}
}

}
server {
listen 443 ssl http2; listen [::]:443 ssl http2;
server_name ytb.antivte.com; # <-- change this

# Dynamic handler for issuing or returning certs for SNI domains.
ssl_certificate_by_lua_block {
auto_ssl:ssl_certificate()
}

# You must still define a static ssl_certificate file for nginx to start.
#
# You may generate a self-signed fallback with:
#
# openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
# -subj '/CN=sni-support-required-for-valid-ssl' \
# -keyout /etc/ssl/resty-auto-ssl-fallback.key \
# -out /etc/ssl/resty-auto-ssl-fallback.crt
ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;

http2_idle_timeout 5m; # up from 3m default

location / {
proxy_pass http://unix:/var/discourse/shared/ytb/nginx.http.sock:;
proxy_set_header Host $http_host;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
}
}

server {
listen 80; listen [::]:80;
server_name cp.antivte.com; # <-- change this
return 301 https://$host$request_uri;

# Endpoint used for performing domain verification with Let's Encrypt.
location /.well-known/acme-challenge/ {
content_by_lua_block {
auto_ssl:challenge_server()
}
}
}

server {
listen 443 ssl http2; listen [::]:443 ssl http2;
server_name cp.antivte.com; # <-- change this

# Dynamic handler for issuing or returning certs for SNI domains.
ssl_certificate_by_lua_block {
auto_ssl:ssl_certificate()
}

# You must still define a static ssl_certificate file for nginx to start.
#
# You may generate a self-signed fallback with:
#
# openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
# -subj '/CN=sni-support-required-for-valid-ssl' \
# -keyout /etc/ssl/resty-auto-ssl-fallback.key \
# -out /etc/ssl/resty-auto-ssl-fallback.crt
ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;

http2_idle_timeout 5m; # up from 3m default

location / {
proxy_pass http://unix:/var/discourse/shared/cp/nginx.http.sock:;
proxy_set_header Host $http_host;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
}
}

}
```
error like this:
```
2019/12/24 18:37:34 [error] 22#22: *3 [lua] lets_encrypt.lua:40: issue_cert(): auto-ssl: dehydrated failed: env HOOK_SECRET=fc35d91dcff7bee3e7debd1579288cb49d4aa5bab151f879deb6314e4fbba994 HOOK_SERVER_PORT=8999 /usr/local/openresty/luajit/bin/resty-auto-ssl/dehydrated --cron --accept-terms --no-lock --domain bbs.antivte.com --challenge http-01 --config /tmp/letsencrypt/config --hook /usr/local/openresty/luajit/bin/resty-auto-ssl/letsencrypt_hooks status: 256 out: # INFO: Using main config file /tmp/letsencrypt/config
+ Generating account key...
+ Registering account key with ACME server...
+ Fetching account ID...
startup_hook
+ Creating chain cache directory /tmp/letsencrypt/chains
Processing bbs.antivte.com
+ Creating new directory /tmp/letsencrypt/certs/bbs.antivte.com ...
+ Signing domains...
+ Generating private key...
+ Generating signing request...
+ Requesting new certificate order from CA...
+ Received 1 authorizations URLs from the CA
+ Handling authorization for bbs.antivte.com
+ 1 pending challenge(s)
+ Deploying challenge tokens...
deploy_challenge
err: Can't load ./.rnd into RNG
139652286972352:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=./.rnd
curl: (7) Failed to connect to 127.0.0.1 port 8999: Connection refused
hook request (deploy_challenge) failed
, context: ssl_certificate_by_lua*, client: 162.158.166.83, server: 0.0.0.0:443
2019/12/24 18:37:34 [error] 22#22: *3 [lua] ssl_certificate.lua:97: issue_cert(): auto-ssl: issuing new certificate failed: dehydrated failure, context: ssl_certificate_by_lua*, client: 162.158.166.83, server: 0.0.0.0:443
2019/12/24 18:37:34 [error] 22#22: *3 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for bbs.antivte.com - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua*, client: 162.158.166.83, server: 0.0.0.0:443
2019/12/24 18:37:41 [error] 22#22: *6 [lua] lets_encrypt.lua:40: issue_cert(): auto-ssl: dehydrated failed: env HOOK_SECRET=fc35d91dcff7bee3e7debd1579288cb49d4aa5bab151f879deb6314e4fbba994 HOOK_SERVER_PORT=8999 /usr/local/openresty/luajit/bin/resty-auto-ssl/dehydrated --cron --accept-terms --no-lock --domain bbs.antivte.com --challenge http-01 --config /tmp/letsencrypt/config --hook /usr/local/openresty/luajit/bin/resty-auto-ssl/letsencrypt_hooks status: 256 out: # INFO: Using main config file /tmp/letsencrypt/config

```
@GUI little help will be appreciated

Start with the Dockerfile and nginx.conf, then reproduce the certificate request while reviewing the dehydrated output in the issue. Trace why the Let's Encrypt hook cannot connect to 127.0.0.1:8999 and verify the challenge completes and a certificate is issued instead of falling back.

Written by the indexing model from the issue text.