[GH-ISSUE #2035] Get Certificate issues on Docker deployment

kerem commented

2026-02-26 18:47:40 +03:00

Owner

Originally created by @norbsss on GitHub (Sep 17, 2025).
Original GitHub issue: https://github.com/documenso/documenso/issues/2035

Issue Description

After successfully signing a document, the document stays on pending state and in the logs we can see:

Submitting job to endpoint: https://docs.nesqualtech.com/api/jobs/internal.seal-document/cmfnw4d9o0043qv21w6ysbe8d [JOBS]: Triggering job internal.seal-document with payload { documentId: 3, requestMetadata: { ipAddress: '162.158.14.213', userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0' } } Failed to get certificate PDF browserType.launch: Executable doesn't exist at /ms-pw/chromium_headless_shell-1169/chrome-linux/headless_shell ╔═════════════════════════════════════════════════════════════════════════╗ ║ Looks like Playwright Test or Playwright was just installed or updated. ║ ║ Please run the following command to download new browsers: ║ ║ ║ ║ npx playwright install ║ ║ ║ ║ <3 Playwright Team ║ ╚═════════════════════════════════════════════════════════════════════════╝ at getCertificatePdf (/app/apps/remix/build/server/hono/packages/lib/server-only/htmltopdf/get-certificate-pdf.js:27:30) at async Module.run (/app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.handler.js:118:64) at async Object.handler (/app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.js:25:5) at async file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:101:9 at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async file:///app/apps/remix/build/server/hono/server/router.js:57:3 at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async requestId2 (/app/node_modules/hono/dist/middleware/request-id/request-id.js:16:5) at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async contextStorage2 (/app/node_modules/hono/dist/middleware/context-storage/index.js:6:5) at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async file:///app/node_modules/hono/dist/hono-base.js:195:25 at async responseViaResponseObject (/app/node_modules/@hono/node-server/dist/index.mjs:370:13) at async Server.<anonymous> (/app/node_modules/@hono/node-server/dist/index.mjs:446:14) { name: 'Error' } [JOBS:task-06292354c47ced55f2e4d03bfb7e63bc9b46a8180d6f46eb02d23d3ebb8b8a45--cmfnw4d9o0043qv21w6ysbe8d] Task failed Error: Failed to get private key bags at signWithLocalCert (file:///app/apps/remix/build/server/hono/packages/signing/transports/local-cert.js:52:21) at async signPdf (file:///app/apps/remix/build/server/hono/packages/signing/index.js:10:10) at async file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.handler.js:167:23 at async Object.runTask (file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:204:26) at async Module.run (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.handler.js:134:21) at async Object.handler (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.js:25:5) at async file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:101:9 at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) at async file:///app/apps/remix/build/server/hono/server/router.js:57:3 at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) { code: 'GenericFailure' } [JOBS]: Job internal.seal-document failed BackgroundTaskFailedError: Task failed at Object.runTask (file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:231:17) at async Module.run (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.handler.js:134:21) at async Object.handler (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.js:25:5) at async file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:101:9 at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) at async file:///app/apps/remix/build/server/hono/server/router.js:57:3 at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) at async requestId2 (file:///app/node_modules/hono/dist/middleware/request-id/request-id.js:16:5) at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17)

Now the configuration looks like this:

`version: "3.8"
services:
postgres:
image: postgres:16
volumes:
- documenso-data:/var/lib/postgresql/data
environment:
- POSTGRES_USER=documenso
- POSTGRES_PASSWORD=password
- POSTGRES_DB=documenso
healthcheck:
test: ["CMD-SHELL", "pg_isready -U documenso"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s

documenso:
image: documenso/documenso:latest
depends_on:
postgres:
condition: service_healthy
environment:
- PORT=${DOCUMENSO_PORT}
- NEXTAUTH_URL=https://${DOCUMENSO_HOST}
- NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
- NEXT_PRIVATE_ENCRYPTION_KEY=${NEXT_PRIVATE_ENCRYPTION_KEY}
- NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=${NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY}
- NEXT_PUBLIC_WEBAPP_URL=https://${DOCUMENSO_HOST}
- NEXT_PRIVATE_DATABASE_URL=postgres://documenso:password@postgres:5432/documenso
- NEXT_PRIVATE_DIRECT_DATABASE_URL=postgres://documenso:password@postgres:5432/documenso
- NEXT_PUBLIC_UPLOAD_TRANSPORT=s3
- NEXT_PRIVATE_UPLOAD_ENDPOINT=https://hel1.your-objectstorage.com
- NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE=true
- NEXT_PRIVATE_UPLOAD_REGION=hel1
- NEXT_PRIVATE_UPLOAD_BUCKET=nesqual
- NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID=KHEZRX5IXM5ANTM59FRJ
- NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY=${HETZ_SEC}
- NEXT_PRIVATE_SMTP_TRANSPORT=smtp-auth
- NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=/opt/documenso/certi.p12
- NEXT_PRIVATE_SIGNING_PASSPHRASE=${SIGNING_PASSPHRASE}
- NEXT_PRIVATE_SMTP_TRANSPORT=smtp-auth
- NEXT_PRIVATE_SMTP_HOST=smtp-relay.brevo.com
- NEXT_PRIVATE_SMTP_PORT=587
- NEXT_PRIVATE_SMTP_SECURE=false
- NEXT_PRIVATE_SMTP_USERNAME=support@nesqualtech.com
- NEXT_PRIVATE_SMTP_PASSWORD=${BREVO_API}
- NEXT_PRIVATE_SMTP_FROM_NAME=NoReply Docs
- NEXT_PRIVATE_SMTP_FROM_ADDRESS=noreply@nesqualtech.com
- NEXT_PUBLIC_DISABLE_SIGNUP=false
- NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT=100
ports:
- ${DOCUMENSO_PORT}
volumes:
- /certs/certi.p12:/opt/documenso/certi.p12:ro,Z

volumes:
documenso-data:`

I tried running another container in this docker compose for Playwright but nothing worked

Steps to Reproduce

Uploading a document
Configuring signers
Sign the document

Expected Behavior

Uploading a document
Configuring signers
Sign the document
Document completed

Current Behavior

Uploading a document
Configuring signers
Sign the document
Document pending

Screenshots (optional)

Operating System [e.g., Windows 10]

MacOS, Windows 11, iOS

Browser [e.g., Chrome, Firefox]

Chrome, Edge, Safari

Version [e.g., 2.0.1]

No response

Please check the boxes that apply to this issue report.

I have searched the existing issues to make sure this is not a duplicate.
I have provided steps to reproduce the issue.
I have included relevant environment information.
I have included any relevant screenshots.
I understand that this is a voluntary contribution and that there is no guarantee of resolution.
I want to work on creating a PR for this issue if approved

Originally created by @norbsss on GitHub (Sep 17, 2025). Original GitHub issue: https://github.com/documenso/documenso/issues/2035 ### Issue Description After successfully signing a document, the document stays on pending state and in the logs we can see: `Submitting job to endpoint: https://docs.nesqualtech.com/api/jobs/internal.seal-document/cmfnw4d9o0043qv21w6ysbe8d [JOBS]: Triggering job internal.seal-document with payload { documentId: 3, requestMetadata: { ipAddress: '162.158.14.213', userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0' } } Failed to get certificate PDF browserType.launch: Executable doesn't exist at /ms-pw/chromium_headless_shell-1169/chrome-linux/headless_shell ╔═════════════════════════════════════════════════════════════════════════╗ ║ Looks like Playwright Test or Playwright was just installed or updated. ║ ║ Please run the following command to download new browsers: ║ ║ ║ ║ npx playwright install ║ ║ ║ ║ <3 Playwright Team ║ ╚═════════════════════════════════════════════════════════════════════════╝ at getCertificatePdf (/app/apps/remix/build/server/hono/packages/lib/server-only/htmltopdf/get-certificate-pdf.js:27:30) at async Module.run (/app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.handler.js:118:64) at async Object.handler (/app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.js:25:5) at async file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:101:9 at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async file:///app/apps/remix/build/server/hono/server/router.js:57:3 at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async requestId2 (/app/node_modules/hono/dist/middleware/request-id/request-id.js:16:5) at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async contextStorage2 (/app/node_modules/hono/dist/middleware/context-storage/index.js:6:5) at async dispatch (/app/node_modules/hono/dist/compose.js:30:17) at async file:///app/node_modules/hono/dist/hono-base.js:195:25 at async responseViaResponseObject (/app/node_modules/@hono/node-server/dist/index.mjs:370:13) at async Server.<anonymous> (/app/node_modules/@hono/node-server/dist/index.mjs:446:14) { name: 'Error' } [JOBS:task-06292354c47ced55f2e4d03bfb7e63bc9b46a8180d6f46eb02d23d3ebb8b8a45--cmfnw4d9o0043qv21w6ysbe8d] Task failed Error: Failed to get private key bags at signWithLocalCert (file:///app/apps/remix/build/server/hono/packages/signing/transports/local-cert.js:52:21) at async signPdf (file:///app/apps/remix/build/server/hono/packages/signing/index.js:10:10) at async file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.handler.js:167:23 at async Object.runTask (file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:204:26) at async Module.run (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.handler.js:134:21) at async Object.handler (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.js:25:5) at async file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:101:9 at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) at async file:///app/apps/remix/build/server/hono/server/router.js:57:3 at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) { code: 'GenericFailure' } [JOBS]: Job internal.seal-document failed BackgroundTaskFailedError: Task failed at Object.runTask (file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:231:17) at async Module.run (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.handler.js:134:21) at async Object.handler (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/internal/seal-document.js:25:5) at async file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:101:9 at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) at async file:///app/apps/remix/build/server/hono/server/router.js:57:3 at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) at async requestId2 (file:///app/node_modules/hono/dist/middleware/request-id/request-id.js:16:5) at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17)` Now the configuration looks like this: `version: "3.8" services: postgres: image: postgres:16 volumes: - documenso-data:/var/lib/postgresql/data environment: - POSTGRES_USER=documenso - POSTGRES_PASSWORD=password - POSTGRES_DB=documenso healthcheck: test: ["CMD-SHELL", "pg_isready -U documenso"] interval: 10s timeout: 5s retries: 5 start_period: 10s documenso: image: documenso/documenso:latest depends_on: postgres: condition: service_healthy environment: - PORT=${DOCUMENSO_PORT} - NEXTAUTH_URL=https://${DOCUMENSO_HOST} - NEXTAUTH_SECRET=${NEXTAUTH_SECRET} - NEXT_PRIVATE_ENCRYPTION_KEY=${NEXT_PRIVATE_ENCRYPTION_KEY} - NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=${NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY} - NEXT_PUBLIC_WEBAPP_URL=https://${DOCUMENSO_HOST} - NEXT_PRIVATE_DATABASE_URL=postgres://documenso:password@postgres:5432/documenso - NEXT_PRIVATE_DIRECT_DATABASE_URL=postgres://documenso:password@postgres:5432/documenso - NEXT_PUBLIC_UPLOAD_TRANSPORT=s3 - NEXT_PRIVATE_UPLOAD_ENDPOINT=https://hel1.your-objectstorage.com - NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE=true - NEXT_PRIVATE_UPLOAD_REGION=hel1 - NEXT_PRIVATE_UPLOAD_BUCKET=nesqual - NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID=KHEZRX5IXM5ANTM59FRJ - NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY=${HETZ_SEC} - NEXT_PRIVATE_SMTP_TRANSPORT=smtp-auth - NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=/opt/documenso/certi.p12 - NEXT_PRIVATE_SIGNING_PASSPHRASE=${SIGNING_PASSPHRASE} - NEXT_PRIVATE_SMTP_TRANSPORT=smtp-auth - NEXT_PRIVATE_SMTP_HOST=smtp-relay.brevo.com - NEXT_PRIVATE_SMTP_PORT=587 - NEXT_PRIVATE_SMTP_SECURE=false - NEXT_PRIVATE_SMTP_USERNAME=support@nesqualtech.com - NEXT_PRIVATE_SMTP_PASSWORD=${BREVO_API} - NEXT_PRIVATE_SMTP_FROM_NAME=NoReply Docs - NEXT_PRIVATE_SMTP_FROM_ADDRESS=noreply@nesqualtech.com - NEXT_PUBLIC_DISABLE_SIGNUP=false - NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT=100 ports: - ${DOCUMENSO_PORT} volumes: - /certs/certi.p12:/opt/documenso/certi.p12:ro,Z volumes: documenso-data:` I tried running another container in this docker compose for Playwright but nothing worked ### Steps to Reproduce - Uploading a document - Configuring signers - Sign the document ### Expected Behavior - Uploading a document - Configuring signers - Sign the document - Document completed ### Current Behavior - Uploading a document - Configuring signers - Sign the document - Document pending ### Screenshots (optional) <img width="547" height="840" alt="Image" src="https://github.com/user-attachments/assets/11965c0e-75fe-4f34-9473-68729f453953" /> <img width="1577" height="1035" alt="Image" src="https://github.com/user-attachments/assets/4c6136d6-3abf-4bed-91e3-af1144236b33" /> ### Operating System [e.g., Windows 10] MacOS, Windows 11, iOS ### Browser [e.g., Chrome, Firefox] Chrome, Edge, Safari ### Version [e.g., 2.0.1] _No response_ ### Please check the boxes that apply to this issue report. - [x] I have searched the existing issues to make sure this is not a duplicate. - [x] I have provided steps to reproduce the issue. - [x] I have included relevant environment information. - [x] I have included any relevant screenshots. - [x] I understand that this is a voluntary contribution and that there is no guarantee of resolution. - [ ] I want to work on creating a PR for this issue if approved

kerem added the

status: triage

label

2026-02-26 18:47:40 +03:00

kerem commented

2026-02-26 18:47:41 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Sep 17, 2025):

Thank you for opening your first issue and for being a part of the open signing revolution!

One of our team members will review it and get back to you as soon as it possible 💚

Meanwhile, please feel free to hop into our community in Discord

@github-actions[bot] commented on GitHub (Sep 17, 2025): Thank you for opening your first issue and for being a part of the open signing revolution! <br /> One of our team members will review it and get back to you as soon as it possible 💚 <br /> Meanwhile, please feel free to hop into our community in [Discord](https://documen.so/discord)

kerem commented

2026-02-26 18:47:41 +03:00

Author

Owner

@r1me75 commented on GitHub (Sep 26, 2025):

Same problem, same environment

@r1me75 commented on GitHub (Sep 26, 2025): Same problem, same environment

kerem commented

2026-02-26 18:47:41 +03:00

Author

Owner

@dudustefanello commented on GitHub (Sep 28, 2025):

See https://github.com/documenso/documenso/issues/1634#issuecomment-2948258699

@dudustefanello commented on GitHub (Sep 28, 2025): See https://github.com/documenso/documenso/issues/1634#issuecomment-2948258699

kerem commented

2026-02-26 18:47:41 +03:00

Author

Owner

@boomam commented on GitHub (Sep 28, 2025):

Same issue here.
In testing, both parties have 'signed' but its stuck in pending state, with the same error of Failed to get certificate PDF.

@boomam commented on GitHub (Sep 28, 2025): Same issue here. In testing, both parties have 'signed' but its stuck in pending state, with the same error of `Failed to get certificate PDF`.

kerem commented

2026-02-26 18:47:41 +03:00

Author

Owner

@dexit commented on GitHub (Oct 7, 2025):

Same issue here. In testing, both parties have 'signed' but its stuck in pending state, with the same error of Failed to get certificate PDF.

https://github.com/documenso/documenso/issues/1634#issuecomment-2948258699

@dexit commented on GitHub (Oct 7, 2025): > Same issue here. In testing, both parties have 'signed' but its stuck in pending state, with the same error of `Failed to get certificate PDF`. https://github.com/documenso/documenso/issues/1634#issuecomment-2948258699

kerem commented

2026-02-26 18:47:41 +03:00

Author

Owner

@Novapixel1010 commented on GitHub (Oct 14, 2025):

Are you still having this issue? It looks like the docs have been updated a little bit

@Novapixel1010 commented on GitHub (Oct 14, 2025): Are you still having this issue? It looks like the docs have been updated a little bit

kerem commented

2026-02-26 18:47:41 +03:00

Author

Owner

@ziguane commented on GitHub (Nov 6, 2025):

Hi @Novapixel1010 !
I am encountering a similar problem. Which part of the documentation are you referring to ?

@ziguane commented on GitHub (Nov 6, 2025): Hi @Novapixel1010 ! I am encountering a similar problem. Which part of the documentation are you referring to ?

kerem commented

2026-02-26 18:47:41 +03:00

Author

Owner

@Novapixel1010 commented on GitHub (Nov 6, 2025):

Have you seen this also I opened a PR #2081 to have this done automatically.

@Novapixel1010 commented on GitHub (Nov 6, 2025): Have you seen [this](https://docs.documenso.com/developers/self-hosting/how-to#option-a-generate-certificate-inside-container-recommended) also I opened a PR #2081 to have this done automatically.

kerem commented

2026-02-26 18:47:41 +03:00

Author

Owner

@ziguane commented on GitHub (Nov 10, 2025):

@Novapixel1010 Thank you for the links.

I’ve resolved my certificate issue (self-signed). However, I couldn’t create an account (fresh installation documenso v2)… it was a problem with the HTTP/HTTPS URL configuration (silently blocked).

@ziguane commented on GitHub (Nov 10, 2025): @Novapixel1010 Thank you for the links. I’ve resolved my certificate issue (self-signed). However, I couldn’t create an account (fresh installation documenso v2)… it was a problem with the HTTP/HTTPS URL configuration (silently blocked).

kerem commented

2026-02-26 18:47:41 +03:00

Author

Owner

@goetz79 commented on GitHub (Dec 4, 2025):

@Novapixel1010 Thank you for the links.

I’ve resolved my certificate issue (self-signed). However, I couldn’t create an account (fresh installation documenso v2)… it was a problem with the HTTP/HTTPS URL configuration (silently blocked).

Can you share some more details? I am struggling with the same issue and can't seem to find a solution

@goetz79 commented on GitHub (Dec 4, 2025): > [@Novapixel1010](https://github.com/Novapixel1010) Thank you for the links. > > I’ve resolved my certificate issue (self-signed). However, I couldn’t create an account (fresh installation documenso v2)… it was a problem with the HTTP/HTTPS URL configuration (silently blocked). Can you share some more details? I am struggling with the same issue and can't seem to find a solution

kerem referenced this issue

2026-02-26 19:31:40 +03:00

[PR #583] [MERGED] fix(web): fix typo + refactor empty state messages #1061

Rows
Columns

[GH-ISSUE #2035] Get Certificate issues on Docker deployment #583

Issue Description

Steps to Reproduce

Expected Behavior

Current Behavior

Screenshots (optional)

Operating System [e.g., Windows 10]

Browser [e.g., Chrome, Firefox]

Version [e.g., 2.0.1]

Please check the boxes that apply to this issue report.