mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-25 01:15:51 +03:00
[GH-ISSUE #1625] Internal error on SSL certificates when force SSL is active #1219
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#1219
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Mystery-X on GitHub (Dec 2, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1625
When disabling the Force SSL option the renewal went flawless.
So to me it looks like NPM is also trying to forward the http request for cert renewal to SSL and thus it fails to complete the request.
@chaptergy commented on GitHub (Dec 2, 2021):
Please provide us with the full letsencrypt logs. See https://github.com/jc21/nginx-proxy-manager/issues/1271#user-content-certificate-error
@Mystery-X commented on GitHub (Dec 2, 2021):
It's not the full, but it contains the proof that it failed to access the file needed todo the verification.
@chaptergy commented on GitHub (Dec 2, 2021):
Are you using cloudflare? Does the same error occur if you disable cloudflare?
@Mystery-X commented on GitHub (Dec 2, 2021):
No there is no cloudflare.
But due to your question I think I start to have an idea what's going on...
NPM is serving this website for internal use only on port 443, I've only opened port 80 to the outside because I was hopeing this was enought (like certbot) to fetch an SSL cert.
But I guess if you enable "Force SSL" it doesn't care if the traffic is going to /.well-known/acme-challenge or not, but instead redirects it always to the SSL port.
@Strugglechen1337 commented on GitHub (Dec 6, 2021):
Hello, i get this if i try to make a new certificate for my nginx proxy manager proxy host
Error: Command failed: certbot certonly --config "/etc/letsencrypt.ini" --cert-name "npm-14" --agree-tos --authenticator webroot --email "" --preferred-challenges "dns,http" --domains ""
Saving debug log to /var/log/letsencrypt/letsencrypt.log
An unexpected error occurred:
There were too many requests of a given type :: Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/rate-limits/
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
can someone help me?
I use nginx proxy manager as docker version on unraid
@robertorubioguardia commented on GitHub (Dec 9, 2021):
Hi,
Same here, but not just when force SSL is active but all the time. Can't generate nor renew SSL certificates.
Any help will be gratefully thanked.
@the1ts commented on GitHub (Dec 14, 2021):
I don''t believe that force SSL is pushing /well-known/acme-challenge to SSL. I'm able to get the configured 404 error when hitting that path on HTTP as is done by the letsencrypt-acme-challenge.conf, any path outside that does redirect to SSL.
It may look like its forcing that URL to SSL if HSTS is turned on and your browser caches that first. This would not be the case for letsencrypt hitting your website for the challenge since its not designed for SSL communications but just plain HTTP so would ignore the HSTS header leaving it on the HTTP connection.
@erdoukki commented on GitHub (Dec 31, 2021):
Same for me (at first)...!
I have checked twice all the Firewall / router redirection to my docker NPM / NextCloud...
I have now the check availability working (and green)...
But too much try on certificate renewal make it postpone... will try later
@Schlumpf9 commented on GitHub (Apr 26, 2022):
I have the same problem. When turning on
force SSLthen Certbot is not able to renew the certificate:If i connect to the container and try to curl https://XY/well-known/acme-challenge/lqC8CqFhvzDci89waVFP_4-GgUWqqh273mA6Plv5naI I receive a 404 error so there is no firewall issue there. Requesting http will response with a redirect 301. If i turn off force SSL for the specific domain and try to renew the certificate everything works. So i can definitely agree that forcing SSL prevents certbot from cert renewal... Really annoying -.-
@AtryFox commented on GitHub (May 4, 2022):
I have the same issue here, exactly as described above. As soon as I disable "Force SSL", renewing my certificates works without issues. The renew mechanism should disable "Force SSL" temporarily or add the /well-known/acme-challange/... path as a default rule where SSL is not forced.
@the1ts commented on GitHub (May 4, 2022):
I did notice one difference in config over time. The include of force-ssl.conf is in the server section for newly created hosts, but in the location / section for older hosts. I can break currently working proxy hosts by moving the force-ssl.conf include into the server section, outside the location / section.
This change was in #1017, which fixes the custom locations ignoring the force-ssl.conf but appears to override the specific letsencrypt exception to force-ssl.
Therefore, I think the test for redirect needs to test both $scheme = "http" and not contains /.well-known/acme-challenge/
As you can't do multiple conditions in one if or nest them, I think this can be done with setting a variable on $scheme = http to H and concatenating a D to the same variable if outside /.well-known/acme-challenge/ so only do the return 301 if the variable = HD.
So we would have:
Guessing here, but we don't see this issues at first creation since the default_host is hit until the cert is obtained and the proxy_host config is written and nginx HUP'd.
@n0bbi commented on GitHub (May 12, 2022):
Same here, if "Force SSL" is enabled, i'm not able to renew the letsencrypt-certificate.
@Schlumpf9 commented on GitHub (May 29, 2022):
+1
@lazerlabs commented on GitHub (Jun 5, 2022):
+1
@lovetox commented on GitHub (Jun 11, 2022):
Disabling
Force SSLfixed this problem also for me@andriuch commented on GitHub (Aug 25, 2022):
Hi
Same here, I'm trying to create a new Letsencrypt certificate, with and without Force SSL checked, respond with Internal Server Error, in Nginx Proxy Manager Log is wrote:
I can't find the logfile /data/logs/letsencrypt/letsencrypt.log
@Schlumpf9 commented on GitHub (Sep 9, 2022):
Annoying hat this central functionality is still broken :/
@EDIflyer commented on GitHub (Oct 2, 2022):
Any thoughts on this @jc21 or others? All my subdomain certs are now up for renewal including the one to access npm itself and all are failing...
EDIT: eventually managed to get back into the npm website (blocked by Chrome due to invalid cert, but Firefox let me bypass the warning) and switching off Force SSL let me renew OK, but with 12 sites it's quite a pain to toggle off, renew, then toggle back on!
@JulsSkogs commented on GitHub (Nov 17, 2022):
I am also experiencing this issue, but even disabling Force SSL changes nothing. I'll try to get a log tomorrow.
@EDIflyer commented on GitHub (Dec 11, 2022):
So interestingly using :latest I'm still having issues renewing certs but have tried deleting some that wouldn't renew and re-requesting them - they now seem to be renewing OK. Will take a while to re-do them all though!
@pierluigizagaria commented on GitHub (Jan 10, 2023):
Still having this issue, cannot renew my certificates
@EDIflyer commented on GitHub (Jan 20, 2023):
I'm now having this issue on another site too. If I delete and recreate they seem to work but renewal has been failing.
@jc21 would really appreciate any help here - I keep on having to delete and recreate certs from scratch which with lots of subdomains can take quite a while! Weirdly the other site where I recreated them still seems to be renewing OK?
@EDIflyer commented on GitHub (Jan 20, 2023):
There also seems to be an issue when deleting certificates too (from within the interface!) as end up with these sorts of errors:
I've found copying existing good directories across to the missing ones then allows re-creation but it seems like the nginx config isn't updated when a cert is deleted? Workaround seems to be to create a new certificate and then delete the old one.
@EDIflyer commented on GitHub (Feb 12, 2023):
Any update on this @jc21 ?
I'm running two servers and one of them seems to be OK...
The other still has errors...
Yet it was the other way round previously. It's like they get stuck renewing at some point and then that's it!
@github-actions[bot] commented on GitHub (Feb 29, 2024):
Issue is now considered stale. If you want to keep it open, please comment 👍
@rushhee commented on GitHub (Feb 29, 2024):
Did this ever get addressed?
On Thu, 29 Feb 2024, 12:48 pm github-actions[bot], @.***>
wrote:
@gabrio79 commented on GitHub (Mar 23, 2024):
any news?
@github-actions[bot] commented on GitHub (Dec 5, 2024):
Issue is now considered stale. If you want to keep it open, please comment 👍
@EDIflyer commented on GitHub (Dec 5, 2024):
Not fixed, awaiting #3121 to be merged in to fix.
@Dams51 commented on GitHub (Apr 7, 2025):
Still not fixed
@Duglim commented on GitHub (May 16, 2025):
Can confirm still not fixed.
Currently I have to manually deactivate "force SSL" on all proxy hosts, then manually renew all certificates and finally manually reactivate "force SSL" on all hosts.
Would be a great help, if this could be fixed. Not only to avoid the manual work, more I fear forgetting about this and running out of SSL...
Thx, Duglim
@EDIflyer commented on GitHub (May 16, 2025):
@Duglim might be worth trying my PR #3121 to save you having to keep manually deactivating/reactivating?
@github-actions[bot] commented on GitHub (Dec 6, 2025):
Issue is now considered stale. If you want to keep it open, please comment 👍