[GH-ISSUE #1424] Issuing new certbot cerificate - certbot: error: unrecognized arguments: --key-type=ecdsa --elliptic-curve=secp384r1 #1108

Closed
opened 2026-02-26 06:35:47 +03:00 by kerem · 12 comments
Owner

Originally created by @kolorafa on GitHub (Sep 24, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1424

Checklist

  • Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
    • Yes (latest and 2.9.9)
  • Are you sure you're not using someone else's docker image?
    • Yes (jc21/nginx-proxy-manager:latest)
  • Have you searched for similar issues (both open and closed)?
    • Yes (no match at "is:issue certbot unrecognized arguments" )

Describe the bug
Failed to issue certbot certificate

It it failing with:

certbot: error: unrecognized arguments: --key-type=ecdsa --elliptic-curve=secp384r1

Add Let's Encrypt Certificate
Internal Error

Error: Command failed: certbot certonly --non-interactive --config "/etc/letsencrypt.ini" --cert-name "npm-29" --agree-tos --authenticator webroot --email "admin@itdesk.eu" --preferred-challenges "dns,http" --domains "next.brask.pl" 
usage: 
  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

Certbot can obtain and install HTTPS/TLS/SSL certificates.  By default,
it will attempt to use a webserver both for obtaining and installing the
certificate. 
**certbot: error: unrecognized arguments: --key-type=ecdsa --elliptic-curve=secp384r1**

    at ChildProcess.exithandler (node:child_process:397:12)
    at ChildProcess.emit (node:events:394:28)
    at maybeClose (node:internal/child_process:1064:16)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5)

Nginx Proxy Manager Version
v2.9.9

To Reproduce
Steps to reproduce the behavior:

  1. Go to SSL Certificates
  2. Click on [Add SSL Certificate] => Let's encrypt
  3. Type domain, select "I agree"
  4. See error

Expected behavior
Work :)

Screenshots
obraz

Operating System
Linux, Docker compose

Additional context
github.com/jc21/nginx-proxy-manager@b1ceda3af4

Can't downgrade to 2.9.6 to check.

Originally created by @kolorafa on GitHub (Sep 24, 2021). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1424 **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes (latest and 2.9.9) - Are you sure you're not using someone else's docker image? - Yes (jc21/nginx-proxy-manager:latest) - Have you searched for similar issues (both open and closed)? - Yes (no match at "is:issue certbot unrecognized arguments" ) **Describe the bug** Failed to issue certbot certificate It it failing with: > **certbot: error: unrecognized arguments: --key-type=ecdsa --elliptic-curve=secp384r1** ``` Add Let's Encrypt Certificate Internal Error Error: Command failed: certbot certonly --non-interactive --config "/etc/letsencrypt.ini" --cert-name "npm-29" --agree-tos --authenticator webroot --email "admin@itdesk.eu" --preferred-challenges "dns,http" --domains "next.brask.pl" usage: certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ... Certbot can obtain and install HTTPS/TLS/SSL certificates. By default, it will attempt to use a webserver both for obtaining and installing the certificate. **certbot: error: unrecognized arguments: --key-type=ecdsa --elliptic-curve=secp384r1** at ChildProcess.exithandler (node:child_process:397:12) at ChildProcess.emit (node:events:394:28) at maybeClose (node:internal/child_process:1064:16) at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5) ``` **Nginx Proxy Manager Version** v2.9.9 **To Reproduce** Steps to reproduce the behavior: 1. Go to SSL Certificates 2. Click on [Add SSL Certificate] => Let's encrypt 3. Type domain, select "I agree" 4. See error **Expected behavior** Work :) **Screenshots** ![obraz](https://user-images.githubusercontent.com/921517/134657237-e78b3814-b5c6-4afd-946a-92caba6d374d.png) **Operating System** Linux, Docker compose **Additional context** https://github.com/jc21/nginx-proxy-manager/commit/b1ceda3af4c4e14f8867443c9e333dc288389992 Can't downgrade to 2.9.6 to check.
kerem 2026-02-26 06:35:47 +03:00
  • closed this issue
  • added the
    bug
    label
Author
Owner

@kolorafa commented on GitHub (Sep 24, 2021):

manually removed those 2 line from /etc/letsencrypt.ini to make current instance working

<!-- gh-comment-id:926527383 --> @kolorafa commented on GitHub (Sep 24, 2021): manually removed those 2 line from /etc/letsencrypt.ini to make current instance working
Author
Owner

@chaptergy commented on GitHub (Oct 5, 2021):

Hm, is your certbot somehow outdated? Could you please run certbot --version inside your container?

<!-- gh-comment-id:934830903 --> @chaptergy commented on GitHub (Oct 5, 2021): Hm, is your certbot somehow outdated? Could you please run `certbot --version` inside your container?
Author
Owner

@kolorafa commented on GitHub (Oct 6, 2021):

[root@docker-f035ab8821f3:/app]# certbot --version
certbot 1.7.0
<!-- gh-comment-id:936351442 --> @kolorafa commented on GitHub (Oct 6, 2021): ```bash [root@docker-f035ab8821f3:/app]# certbot --version certbot 1.7.0 ```
Author
Owner

@kolorafa commented on GitHub (Oct 6, 2021):

crazy

If I run this docker-compose without old data:

$ docker exec -it nginx_proxy_manager_test_app_1 certbot --version
certbot 1.19.0

If I restore my old data:
$ docker exec -it nginx_proxy_manager_test_app_1 certbot --version
certbot 1.7.0

the only thing that come in mind is that I use directadmin plugin for some domains, and probably have very old account?

$ find . -type d -ls
   927865      4 drwxr-xr-x   4 root     root         4096 paź  6 16:55 .
   927870      4 drwxr-xr-x   7 root     root         4096 paź  6 16:55 ./data
   927871      4 drwxr-xr-x   2 root     root         4096 wrz 24 12:26 ./data/logs
   927904      4 drwxr-xr-x   2 root     root         4096 maj  6 17:27 ./data/access
   927905      4 drwxr-xr-x   9 root     root         4096 mar  8  2021 ./data/nginx
   927906      4 drwxr-xr-x   2 root     root         4096 paź  6 16:38 ./data/nginx/temp
   927907      4 drwxr-xr-x   2 root     root         4096 mar  8  2021 ./data/nginx/redirection_host
   927908      4 drwxr-xr-x   2 root     root         4096 paź  6 16:55 ./data/nginx/proxy_host
   927932      4 drwxr-xr-x   2 root     root         4096 mar  8  2021 ./data/nginx/stream
   927934      4 drwxr-xr-x   2 root     root         4096 mar  8  2021 ./data/nginx/dead_host
   927935      4 drwxr-xr-x   2 root     root         4096 paź  6 16:55 ./data/nginx/default_host
   927937      4 drwxr-xr-x   2 root     root         4096 maj 11 15:53 ./data/nginx/default_www
   927939      4 drwxr-xr-x   4 root     root         4096 mar 18  2021 ./data/custom_ssl
   927940      4 drwxr-xr-x   2 root     root         4096 mar 18  2021 ./data/custom_ssl/npm-7
   927943      4 drwxr-xr-x   2 root     root         4096 mar 11  2021 ./data/custom_ssl/npm-1
   927946      4 drwxr-xr-x   2 root     root         4096 wrz 12 13:55 ./data/letsencrypt-acme-challenge

Something in data directory is causing certbot to downgrade

<!-- gh-comment-id:936448070 --> @kolorafa commented on GitHub (Oct 6, 2021): crazy If I run this docker-compose without old data: $ docker exec -it nginx_proxy_manager_test_app_1 certbot --version certbot 1.19.0 If I restore my old data: $ docker exec -it nginx_proxy_manager_test_app_1 certbot --version certbot 1.7.0 the only thing that come in mind is that I use directadmin plugin for some domains, and probably have very old account? ``` $ find . -type d -ls 927865 4 drwxr-xr-x 4 root root 4096 paź 6 16:55 . 927870 4 drwxr-xr-x 7 root root 4096 paź 6 16:55 ./data 927871 4 drwxr-xr-x 2 root root 4096 wrz 24 12:26 ./data/logs 927904 4 drwxr-xr-x 2 root root 4096 maj 6 17:27 ./data/access 927905 4 drwxr-xr-x 9 root root 4096 mar 8 2021 ./data/nginx 927906 4 drwxr-xr-x 2 root root 4096 paź 6 16:38 ./data/nginx/temp 927907 4 drwxr-xr-x 2 root root 4096 mar 8 2021 ./data/nginx/redirection_host 927908 4 drwxr-xr-x 2 root root 4096 paź 6 16:55 ./data/nginx/proxy_host 927932 4 drwxr-xr-x 2 root root 4096 mar 8 2021 ./data/nginx/stream 927934 4 drwxr-xr-x 2 root root 4096 mar 8 2021 ./data/nginx/dead_host 927935 4 drwxr-xr-x 2 root root 4096 paź 6 16:55 ./data/nginx/default_host 927937 4 drwxr-xr-x 2 root root 4096 maj 11 15:53 ./data/nginx/default_www 927939 4 drwxr-xr-x 4 root root 4096 mar 18 2021 ./data/custom_ssl 927940 4 drwxr-xr-x 2 root root 4096 mar 18 2021 ./data/custom_ssl/npm-7 927943 4 drwxr-xr-x 2 root root 4096 mar 11 2021 ./data/custom_ssl/npm-1 927946 4 drwxr-xr-x 2 root root 4096 wrz 12 13:55 ./data/letsencrypt-acme-challenge ``` Something in data directory is causing certbot to downgrade
Author
Owner

@kolorafa commented on GitHub (Oct 6, 2021):

If I check certbot right after it starts, it say 1.19, after few seconds it says 1.7.0

<!-- gh-comment-id:936450854 --> @kolorafa commented on GitHub (Oct 6, 2021): If I check certbot right after it starts, it say 1.19, after few seconds it says 1.7.0
Author
Owner

@chaptergy commented on GitHub (Oct 6, 2021):

So it does not depend on something inside the data folder but instead on how long you wait after starting? Do the logs of the container contain anything which might have something to do with this?

<!-- gh-comment-id:936454438 --> @chaptergy commented on GitHub (Oct 6, 2021): So it does not depend on something inside the data folder but instead on how long you wait after starting? Do the logs of the container contain anything which might have something to do with this?
Author
Owner

@kolorafa commented on GitHub (Oct 6, 2021):

If I remove the data, it stays on 1.19

<!-- gh-comment-id:936462360 --> @kolorafa commented on GitHub (Oct 6, 2021): If I remove the data, it stays on 1.19
Author
Owner

@kolorafa commented on GitHub (Oct 6, 2021):

# docker logs -f nginx_proxy_manager_test_app_1
[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 01_perms.sh: executing... 
Changing ownership of /data/logs to 0:0
[cont-init.d] 01_perms.sh: exited 0.
[cont-init.d] 01_s6-secret-init.sh: executing... 
[cont-init.d] 01_s6-secret-init.sh: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
Disabling IPV6 in hosts
❯ Disabling IPV6 in hosts: /etc/nginx/conf.d
  ❯ /etc/nginx/conf.d/production.conf
  ❯ /etc/nginx/conf.d/include/letsencrypt-acme-challenge.conf
  ❯ /etc/nginx/conf.d/include/force-ssl.conf
  ❯ /etc/nginx/conf.d/include/ip_ranges.conf
  ❯ /etc/nginx/conf.d/include/proxy.conf
  ❯ /etc/nginx/conf.d/include/assets.conf
  ❯ /etc/nginx/conf.d/include/ssl-ciphers.conf
  ❯ /etc/nginx/conf.d/include/block-exploits.conf
  ❯ /etc/nginx/conf.d/include/resolvers.conf
  ❯ /etc/nginx/conf.d/default.conf
Disabling IPV6 in hosts
❯ Disabling IPV6 in hosts: /data/nginx
  ❯ /data/nginx/proxy_host/14.conf
  ❯ /data/nginx/proxy_host/13.conf
  ❯ /data/nginx/proxy_host/18.conf
  ❯ /data/nginx/proxy_host/20.conf
  ❯ /data/nginx/proxy_host/5.conf
  ❯ /data/nginx/proxy_host/2.conf
  ❯ /data/nginx/proxy_host/16.conf
  ❯ /data/nginx/proxy_host/22.conf
  ❯ /data/nginx/proxy_host/23.conf
  ❯ /data/nginx/proxy_host/6.conf
  ❯ /data/nginx/proxy_host/4.conf
  ❯ /data/nginx/proxy_host/9.conf
  ❯ /data/nginx/proxy_host/19.conf
  ❯ /data/nginx/proxy_host/7.conf
  ❯ /data/nginx/proxy_host/10.conf
  ❯ /data/nginx/proxy_host/25.conf
  ❯ /data/nginx/proxy_host/3.conf
  ❯ /data/nginx/proxy_host/11.conf
  ❯ /data/nginx/proxy_host/15.conf
  ❯ /data/nginx/proxy_host/21.conf
  ❯ /data/nginx/proxy_host/12.conf
  ❯ /data/nginx/proxy_host/17.conf
  ❯ /data/nginx/default_host/site.conf
[10/6/2021] [3:01:00 PM] [Global   ] › ℹ  info      Generating Sqlite db configuration from environment variables
[10/6/2021] [3:01:00 PM] [Global   ] › ℹ  info      Wrote db configuration to config file: ./config/production.json
[10/6/2021] [3:01:02 PM] [Migrate  ] › ℹ  info      Current database version: none
[10/6/2021] [3:01:02 PM] [Setup    ] › ℹ  info      Creating a new JWT key pair...
[10/6/2021] [3:01:10 PM] [Setup    ] › ℹ  info      Wrote JWT key pair to config file: /app/config/production.json
[10/6/2021] [3:01:16 PM] [Setup    ] › ℹ  info      Added Certbot plugins certbot-dns-directadmin==0.0.20 
[10/6/2021] [3:01:16 PM] [Setup    ] › ℹ  info      Logrotate Timer initialized
[10/6/2021] [3:01:16 PM] [Setup    ] › ℹ  info      Logrotate completed.
[10/6/2021] [3:01:16 PM] [IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[10/6/2021] [3:01:16 PM] [IP Ranges] › ℹ  info      Fetching https://ip-ranges.amazonaws.com/ip-ranges.json
[10/6/2021] [3:01:16 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[10/6/2021] [3:01:16 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[10/6/2021] [3:01:16 PM] [SSL      ] › ℹ  info      Let's Encrypt Renewal Timer initialized
[10/6/2021] [3:01:16 PM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...
[10/6/2021] [3:01:16 PM] [IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized
[10/6/2021] [3:01:16 PM] [Global   ] › ℹ  info      Backend PID 243 listening on port 3000 ...
[10/6/2021] [3:01:18 PM] [SSL      ] › ✖  error     Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation  
usage: 
  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

Certbot can obtain and install HTTPS/TLS/SSL certificates.  By default,
it will attempt to use a webserver both for obtaining and installing the
certificate. 
certbot: error: unrecognized arguments: --key-type=ecdsa --elliptic-curve=secp384r1

    at ChildProcess.exithandler (node:child_process:397:12)
    at ChildProcess.emit (node:events:394:28)
    at maybeClose (node:internal/child_process:1064:16)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5)

I think this certbot-dns-directadmin is downgrading certbot due to dependencies

<!-- gh-comment-id:936464740 --> @kolorafa commented on GitHub (Oct 6, 2021): ``` # docker logs -f nginx_proxy_manager_test_app_1 [s6-init] making user provided files available at /var/run/s6/etc...exited 0. [s6-init] ensuring user provided files have correct perms...exited 0. [fix-attrs.d] applying ownership & permissions fixes... [fix-attrs.d] done. [cont-init.d] executing container initialization scripts... [cont-init.d] 01_perms.sh: executing... Changing ownership of /data/logs to 0:0 [cont-init.d] 01_perms.sh: exited 0. [cont-init.d] 01_s6-secret-init.sh: executing... [cont-init.d] 01_s6-secret-init.sh: exited 0. [cont-init.d] done. [services.d] starting services [services.d] done. Disabling IPV6 in hosts ❯ Disabling IPV6 in hosts: /etc/nginx/conf.d ❯ /etc/nginx/conf.d/production.conf ❯ /etc/nginx/conf.d/include/letsencrypt-acme-challenge.conf ❯ /etc/nginx/conf.d/include/force-ssl.conf ❯ /etc/nginx/conf.d/include/ip_ranges.conf ❯ /etc/nginx/conf.d/include/proxy.conf ❯ /etc/nginx/conf.d/include/assets.conf ❯ /etc/nginx/conf.d/include/ssl-ciphers.conf ❯ /etc/nginx/conf.d/include/block-exploits.conf ❯ /etc/nginx/conf.d/include/resolvers.conf ❯ /etc/nginx/conf.d/default.conf Disabling IPV6 in hosts ❯ Disabling IPV6 in hosts: /data/nginx ❯ /data/nginx/proxy_host/14.conf ❯ /data/nginx/proxy_host/13.conf ❯ /data/nginx/proxy_host/18.conf ❯ /data/nginx/proxy_host/20.conf ❯ /data/nginx/proxy_host/5.conf ❯ /data/nginx/proxy_host/2.conf ❯ /data/nginx/proxy_host/16.conf ❯ /data/nginx/proxy_host/22.conf ❯ /data/nginx/proxy_host/23.conf ❯ /data/nginx/proxy_host/6.conf ❯ /data/nginx/proxy_host/4.conf ❯ /data/nginx/proxy_host/9.conf ❯ /data/nginx/proxy_host/19.conf ❯ /data/nginx/proxy_host/7.conf ❯ /data/nginx/proxy_host/10.conf ❯ /data/nginx/proxy_host/25.conf ❯ /data/nginx/proxy_host/3.conf ❯ /data/nginx/proxy_host/11.conf ❯ /data/nginx/proxy_host/15.conf ❯ /data/nginx/proxy_host/21.conf ❯ /data/nginx/proxy_host/12.conf ❯ /data/nginx/proxy_host/17.conf ❯ /data/nginx/default_host/site.conf [10/6/2021] [3:01:00 PM] [Global ] › ℹ info Generating Sqlite db configuration from environment variables [10/6/2021] [3:01:00 PM] [Global ] › ℹ info Wrote db configuration to config file: ./config/production.json [10/6/2021] [3:01:02 PM] [Migrate ] › ℹ info Current database version: none [10/6/2021] [3:01:02 PM] [Setup ] › ℹ info Creating a new JWT key pair... [10/6/2021] [3:01:10 PM] [Setup ] › ℹ info Wrote JWT key pair to config file: /app/config/production.json [10/6/2021] [3:01:16 PM] [Setup ] › ℹ info Added Certbot plugins certbot-dns-directadmin==0.0.20 [10/6/2021] [3:01:16 PM] [Setup ] › ℹ info Logrotate Timer initialized [10/6/2021] [3:01:16 PM] [Setup ] › ℹ info Logrotate completed. [10/6/2021] [3:01:16 PM] [IP Ranges] › ℹ info Fetching IP Ranges from online services... [10/6/2021] [3:01:16 PM] [IP Ranges] › ℹ info Fetching https://ip-ranges.amazonaws.com/ip-ranges.json [10/6/2021] [3:01:16 PM] [IP Ranges] › ℹ info Fetching https://www.cloudflare.com/ips-v4 [10/6/2021] [3:01:16 PM] [IP Ranges] › ℹ info Fetching https://www.cloudflare.com/ips-v6 [10/6/2021] [3:01:16 PM] [SSL ] › ℹ info Let's Encrypt Renewal Timer initialized [10/6/2021] [3:01:16 PM] [SSL ] › ℹ info Renewing SSL certs close to expiry... [10/6/2021] [3:01:16 PM] [IP Ranges] › ℹ info IP Ranges Renewal Timer initialized [10/6/2021] [3:01:16 PM] [Global ] › ℹ info Backend PID 243 listening on port 3000 ... [10/6/2021] [3:01:18 PM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation usage: certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ... Certbot can obtain and install HTTPS/TLS/SSL certificates. By default, it will attempt to use a webserver both for obtaining and installing the certificate. certbot: error: unrecognized arguments: --key-type=ecdsa --elliptic-curve=secp384r1 at ChildProcess.exithandler (node:child_process:397:12) at ChildProcess.emit (node:events:394:28) at maybeClose (node:internal/child_process:1064:16) at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5) ``` I think this certbot-dns-directadmin is downgrading certbot due to dependencies
Author
Owner

@chaptergy commented on GitHub (Oct 6, 2021):

Hm, certbot-dns-admin does not require a specific version of certbot, however it could be that it installs certbot a second time via pip, but why it installs an outdated version I have no idea. Are there any other certbot plugins installed? You can run certbot plugins to get a list of installed plugins.

<!-- gh-comment-id:936475190 --> @chaptergy commented on GitHub (Oct 6, 2021): Hm, `certbot-dns-admin` does not require a specific version of certbot, however it could be that it installs certbot a second time via pip, but why it installs an outdated version I have no idea. Are there any other certbot plugins installed? You can run `certbot plugins` to get a list of installed plugins.
Author
Owner

@kolorafa commented on GitHub (Oct 6, 2021):

https://github.com/cybercinch/certbot-dns-directadmin/issues/4

It's installing 0.0.20 which (according to link) is locked down to 1.7?

<!-- gh-comment-id:936475702 --> @kolorafa commented on GitHub (Oct 6, 2021): https://github.com/cybercinch/certbot-dns-directadmin/issues/4 It's installing 0.0.20 which (according to link) is locked down to 1.7?
Author
Owner

@kolorafa commented on GitHub (Oct 6, 2021):

github.com/cybercinch/certbot-dns-directadmin@10b711ba5a
new in 0.0.21
so it did have a restriction in 0.0.20 to 1.7.0

<!-- gh-comment-id:936478745 --> @kolorafa commented on GitHub (Oct 6, 2021): https://github.com/cybercinch/certbot-dns-directadmin/commit/10b711ba5a6de051022698ce908e3bdbe8bbc147 new in 0.0.21 so it did have a restriction in 0.0.20 to 1.7.0
Author
Owner

@chaptergy commented on GitHub (Oct 6, 2021):

Edit: I misunderstood the file. I'll update the version of the dns plugin which should fix this.

<!-- gh-comment-id:936486988 --> @chaptergy commented on GitHub (Oct 6, 2021): Edit: I misunderstood the file. I'll update the version of the dns plugin which should fix this.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/nginx-proxy-manager-NginxProxyManager#1108
No description provided.