starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 09:25:55 +03:00

[GH-ISSUE #1712] Desec DNS provider renewals don't work #1274

New issue

Closed

opened 2026-02-26 06:36:31 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 06:36:31 +03:00

Owner

Originally created by @FarisZR on GitHub (Jan 1, 2022).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1712

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
- Yes
Are you sure you're not using someone else's docker image?
- Yes
- Have you searched for similar issues (both open and closed)?
- Yes

Describe the bug

Desec needs more than the default 5 seconds for propagation.
you can change the propagation when generating the certificate, but not in the renewals.
maybe the renewal command should follow the propagation seconds used to generate the certificate.

Nginx Proxy Manager Version

v2.9.13

To Reproduce
Steps to reproduce the behavior:

create a cert using desec DNS challenge
it will fail, because you need to increate the propgation seconds.
NPM will use the default 5 seconds in renewals
renewal fails

Expected behavior

renewals should use the propagation second used to generate the certificate, or should use more seconds in renewals since its automatic and in the background.

Screenshots

logs

  "status": "invalid",
  "expires": "2022-01-0XTXX:16:51Z",
  "challenges": [
    {
      "type": "dns-01",
      "status": "invalid",
      "error": {
        "type": "urn:ietf:params:acme:error:dns",
        "detail": "DNS problem: NXDOMAIN looking up TXT for _acme-challenge.domain.tld - check that a DNS record exists for this domain",
        "status": 400
      },
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/XXXXXXXX/gA_GEQ",
      "token": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
      "validated": "2022-01-0XTXX:17:02Z"
    }
  ]
}
2022-01-01 13:17:03,902:DEBUG:acme.client:Storing nonce: XXXXXXXXXXXXXXXXXXXXXXX
2022-01-01 13:17:03,903:INFO:certbot._internal.auth_handler:Challenge failed for domain domain.tld
2022-01-01 13:17:03,903:INFO:certbot._internal.auth_handler:Challenge failed for domain domain.tld
2022-01-01 13:17:03,903:INFO:certbot._internal.auth_handler:dns-01 challenge for domain.tld
2022-01-01 13:17:03,903:INFO:certbot._internal.auth_handler:dns-01 challenge for domain.tld
2022-01-01 13:17:03,903:DEBUG:certbot._internal.display.obj:Notifying user: 
Certbot failed to authenticate some domains (authenticator: certbot-dns-desec:dns-desec). The Certificate Authority reported these problems:
  Domain: domain.tld
  Type:   dns
  Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.domain.tld - check that a DNS record exists for this domain

  Domain: domain.tld
  Type:   dns
  Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.domain.tld - check that a DNS record exists for this domain

Hint: The Certificate Authority failed to verify the DNS TXT records created by --certbot-dns-desec:dns-desec. Ensure the above domains are hosted by this DNS provider, or try increasing --certbot-dns-desec:dns-desec-propagation-seconds (currently 5 seconds)

Operating System

Debian 11

Additional context

Originally created by @FarisZR on GitHub (Jan 1, 2022). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1712  **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes **Describe the bug**  Desec needs more than the default 5 seconds for propagation. you can change the propagation when generating the certificate, but not in the renewals. maybe the renewal command should follow the propagation seconds used to generate the certificate. **Nginx Proxy Manager Version**  v2.9.13 **To Reproduce** Steps to reproduce the behavior: 1. create a cert using desec DNS challenge 2. it will fail, because you need to increate the propgation seconds. 3. NPM will use the default 5 seconds in renewals 4. renewal fails **Expected behavior**  renewals should use the propagation second used to generate the certificate, or should use more seconds in renewals since its automatic and in the background. **Screenshots**  ## logs ``` "status": "invalid", "expires": "2022-01-0XTXX:16:51Z", "challenges": [ { "type": "dns-01", "status": "invalid", "error": { "type": "urn:ietf:params:acme:error:dns", "detail": "DNS problem: NXDOMAIN looking up TXT for _acme-challenge.domain.tld - check that a DNS record exists for this domain", "status": 400 }, "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/XXXXXXXX/gA_GEQ", "token": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "validated": "2022-01-0XTXX:17:02Z" } ] } 2022-01-01 13:17:03,902:DEBUG:acme.client:Storing nonce: XXXXXXXXXXXXXXXXXXXXXXX 2022-01-01 13:17:03,903:INFO:certbot._internal.auth_handler:Challenge failed for domain domain.tld 2022-01-01 13:17:03,903:INFO:certbot._internal.auth_handler:Challenge failed for domain domain.tld 2022-01-01 13:17:03,903:INFO:certbot._internal.auth_handler:dns-01 challenge for domain.tld 2022-01-01 13:17:03,903:INFO:certbot._internal.auth_handler:dns-01 challenge for domain.tld 2022-01-01 13:17:03,903:DEBUG:certbot._internal.display.obj:Notifying user: Certbot failed to authenticate some domains (authenticator: certbot-dns-desec:dns-desec). The Certificate Authority reported these problems: Domain: domain.tld Type: dns Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.domain.tld - check that a DNS record exists for this domain Domain: domain.tld Type: dns Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.domain.tld - check that a DNS record exists for this domain Hint: The Certificate Authority failed to verify the DNS TXT records created by --certbot-dns-desec:dns-desec. Ensure the above domains are hosted by this DNS provider, or try increasing --certbot-dns-desec:dns-desec-propagation-seconds (currently 5 seconds) ``` **Operating System**  Debian 11 **Additional context**

kerem

2026-02-26 06:36:31 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-26 06:36:31 +03:00

Author

Owner

@chaptergy commented on GitHub (Jan 1, 2022):

NPM does not have control over this, as this information is only passed to certbot, who then stores this information in the renewal config file, e.g. /etc/letsencrypt/renewal/npm-1.conf. This file should then contain a line similar to

dns_desec_propagation_seconds = 60

If this is not honored, this is either an issue with certbot or the deSEC DNS plugin.

@chaptergy commented on GitHub (Jan 1, 2022): NPM does not have control over this, as this information is only passed to certbot, who then stores this information in the renewal config file, e.g. `/etc/letsencrypt/renewal/npm-1.conf`. This file should then contain a line similar to ```ini dns_desec_propagation_seconds = 60 ``` If this is not honored, this is either an issue with [certbot](https://github.com/certbot/certbot) or the [deSEC DNS plugin](https://github.com/desec-io/certbot-dns-desec).

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#1274

No description provided.

Rows
Columns