[GH-ISSUE #1305] Wildcard Certs not renew automaticly #1047

New issue

Closed

opened 2026-02-26 06:35:33 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 06:35:33 +03:00

Owner

Originally created by @swoop124 on GitHub (Aug 10, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1305

Hello,

i have installed npm via docker, then i have created several wildcard certificates just fine. I used dns-challenge: dns-rfc2136
Now my first cert has to be renew. But in the log are the following messages:

[8/10/2021] [5:15:13 AM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...,
[8/10/2021] [5:15:13 AM] [IP Ranges] › ℹ  info      Fetching IP Ranges from online services...,
[8/10/2021] [5:15:13 AM] [IP Ranges] › ℹ  info      Fetching https://ip-ranges.amazonaws.com/ip-ranges.json,
[8/10/2021] [5:15:13 AM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4,
[8/10/2021] [5:15:13 AM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6,
[8/10/2021] [5:15:14 AM] [Nginx    ] › ℹ  info      Reloading Nginx,
[8/10/2021] [5:22:29 AM] [SSL      ] › ✖  error     Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation  ,
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.,
Failed to renew certificate npm-5 with error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.,
All renewals failed. The following certificates could not be renewed:,
  /etc/letsencrypt/live/npm-5/fullchain.pem (failure),
1 renew failure(s), 0 parse failure(s),
,
    at ChildProcess.exithandler (node:child_process:326:12),
    at ChildProcess.emit (node:events:369:20),
    at maybeClose (node:internal/child_process:1067:16),
    at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5),
[8/10/2021] [6:15:13 AM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...,
[8/10/2021] [6:21:48 AM] [SSL      ] › ✖  error     Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation  ,
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.,
Failed to renew certificate npm-5 with error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.,
All renewals failed. The following certificates could not be renewed:,
  /etc/letsencrypt/live/npm-5/fullchain.pem (failure),
1 renew failure(s), 0 parse failure(s),
,
    at ChildProcess.exithandler (node:child_process:326:12),
    at ChildProcess.emit (node:events:369:20),
    at maybeClose (node:internal/child_process:1067:16),
    at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5),
Connection Error: Error: read ECONNRESET,
Connection Error: Error: read ECONNRESET,
[8/10/2021] [7:15:13 AM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...,
[8/10/2021] [7:23:00 AM] [SSL      ] › ✖  error     Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation  ,
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.,
Failed to renew certificate npm-5 with error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.,
All renewals failed. The following certificates could not be renewed:,
  /etc/letsencrypt/live/npm-5/fullchain.pem (failure),
1 renew failure(s), 0 parse failure(s),
,
    at ChildProcess.exithandler (node:child_process:326:12),
    at ChildProcess.emit (node:events:369:20),
    at maybeClose (node:internal/child_process:1067:16),
    at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5),
[8/10/2021] [8:15:13 AM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...,
[8/10/2021] [8:15:15 AM] [Nginx    ] › ℹ  info      Reloading Nginx,
[8/10/2021] [8:15:16 AM] [SSL      ] › ℹ  info      Renew Complete

then i just tried to renew it over cli, with this command:
docker exec -it npm_app_1 certbot renew

unfortunately it renewed this one certifiacte just fine.

in the next view days several other wildcard-certs have to be renewed. Is there a way to change the command in the docker-container or is there another solution for this?

best regards

Originally created by @swoop124 on GitHub (Aug 10, 2021). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1305 Hello, i have installed npm via docker, then i have created several wildcard certificates just fine. I used dns-challenge: dns-rfc2136 Now my first cert has to be renew. But in the log are the following messages: ``` [8/10/2021] [5:15:13 AM] [SSL ] › ℹ info Renewing SSL certs close to expiry..., [8/10/2021] [5:15:13 AM] [IP Ranges] › ℹ info Fetching IP Ranges from online services..., [8/10/2021] [5:15:13 AM] [IP Ranges] › ℹ info Fetching https://ip-ranges.amazonaws.com/ip-ranges.json, [8/10/2021] [5:15:13 AM] [IP Ranges] › ℹ info Fetching https://www.cloudflare.com/ips-v4, [8/10/2021] [5:15:13 AM] [IP Ranges] › ℹ info Fetching https://www.cloudflare.com/ips-v6, [8/10/2021] [5:15:14 AM] [Nginx ] › ℹ info Reloading Nginx, [8/10/2021] [5:22:29 AM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation , Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS., Failed to renew certificate npm-5 with error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS., All renewals failed. The following certificates could not be renewed:, /etc/letsencrypt/live/npm-5/fullchain.pem (failure), 1 renew failure(s), 0 parse failure(s), , at ChildProcess.exithandler (node:child_process:326:12), at ChildProcess.emit (node:events:369:20), at maybeClose (node:internal/child_process:1067:16), at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5), [8/10/2021] [6:15:13 AM] [SSL ] › ℹ info Renewing SSL certs close to expiry..., [8/10/2021] [6:21:48 AM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation , Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS., Failed to renew certificate npm-5 with error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS., All renewals failed. The following certificates could not be renewed:, /etc/letsencrypt/live/npm-5/fullchain.pem (failure), 1 renew failure(s), 0 parse failure(s), , at ChildProcess.exithandler (node:child_process:326:12), at ChildProcess.emit (node:events:369:20), at maybeClose (node:internal/child_process:1067:16), at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5), Connection Error: Error: read ECONNRESET, Connection Error: Error: read ECONNRESET, [8/10/2021] [7:15:13 AM] [SSL ] › ℹ info Renewing SSL certs close to expiry..., [8/10/2021] [7:23:00 AM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation , Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS., Failed to renew certificate npm-5 with error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS., All renewals failed. The following certificates could not be renewed:, /etc/letsencrypt/live/npm-5/fullchain.pem (failure), 1 renew failure(s), 0 parse failure(s), , at ChildProcess.exithandler (node:child_process:326:12), at ChildProcess.emit (node:events:369:20), at maybeClose (node:internal/child_process:1067:16), at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5), [8/10/2021] [8:15:13 AM] [SSL ] › ℹ info Renewing SSL certs close to expiry..., [8/10/2021] [8:15:15 AM] [Nginx ] › ℹ info Reloading Nginx, [8/10/2021] [8:15:16 AM] [SSL ] › ℹ info Renew Complete ``` then i just tried to renew it over cli, with this command: `docker exec -it npm_app_1 certbot renew` unfortunately it renewed this one certifiacte just fine. in the next view days several other wildcard-certs have to be renewed. Is there a way to change the command in the docker-container or is there another solution for this? best regards

kerem closed this issue

2026-02-26 06:35:33 +03:00

kerem commented

2026-02-26 06:35:33 +03:00

Author

Owner

@chaptergy commented on GitHub (Aug 10, 2021):

This issue has been fixed in v2.9.7, you just need to update.

@chaptergy commented on GitHub (Aug 10, 2021): This issue has been fixed in v2.9.7, you just need to update.

kerem referenced this issue

2026-02-26 07:38:57 +03:00

[PR #1047] [MERGED] openidc <- develop #3346

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#1047

No description provided.

Rows
Columns