[GH-ISSUE #1856] NPM not autorenewing certs

kerem commented

2026-02-26 07:30:39 +03:00

Owner

Originally created by @unixbird on GitHub (Feb 15, 2022).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1856

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
- Yes
Are you sure you're not using someone else's docker image?
- Yes
Have you searched for similar issues (both open and closed)?
- Yes

Describe the bug
Auto renew is failing and not running

Nginx Proxy Manager Version
2.9.15

To Reproduce
Steps to reproduce the behavior:
Certs do not auto renew once they get close to expiry

Expected behavior
Certs renew automatically

Screenshots

Operating System
Docker Swarm

Additional context
Renewing SSL certs close to expiry... nginxproxy_app.1.mgfk9romsudb@Ramiel | [2/15/2022] [4:54:15 AM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation nginxproxy_app.1.mgfk9romsudb@Ramiel | Renewal configuration file /etc/letsencrypt/renewal/npm-1.conf is broken. nginxproxy_app.1.mgfk9romsudb@Ramiel | The error was: expected /etc/letsencrypt/live/npm-1/cert.pem to be a symlink nginxproxy_app.1.mgfk9romsudb@Ramiel | Skipping. nginxproxy_app.1.mgfk9romsudb@Ramiel | Renewal configuration file /etc/letsencrypt/renewal/npm-3.conf is broken. nginxproxy_app.1.mgfk9romsudb@Ramiel | The error was: expected /etc/letsencrypt/live/npm-3/cert.pem to be a symlink nginxproxy_app.1.mgfk9romsudb@Ramiel | Skipping. nginxproxy_app.1.mgfk9romsudb@Ramiel | Renewal configuration file /etc/letsencrypt/renewal/npm-4.conf is broken.

Errors above

Originally created by @unixbird on GitHub (Feb 15, 2022). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1856 **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes **Describe the bug** Auto renew is failing and not running **Nginx Proxy Manager Version** 2.9.15 **To Reproduce** Steps to reproduce the behavior: Certs do not auto renew once they get close to expiry **Expected behavior** Certs renew automatically **Screenshots**  **Operating System** Docker Swarm **Additional context** ` Renewing SSL certs close to expiry... nginxproxy_app.1.mgfk9romsudb@Ramiel | [2/15/2022] [4:54:15 AM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation nginxproxy_app.1.mgfk9romsudb@Ramiel | Renewal configuration file /etc/letsencrypt/renewal/npm-1.conf is broken. nginxproxy_app.1.mgfk9romsudb@Ramiel | The error was: expected /etc/letsencrypt/live/npm-1/cert.pem to be a symlink nginxproxy_app.1.mgfk9romsudb@Ramiel | Skipping. nginxproxy_app.1.mgfk9romsudb@Ramiel | Renewal configuration file /etc/letsencrypt/renewal/npm-3.conf is broken. nginxproxy_app.1.mgfk9romsudb@Ramiel | The error was: expected /etc/letsencrypt/live/npm-3/cert.pem to be a symlink nginxproxy_app.1.mgfk9romsudb@Ramiel | Skipping. nginxproxy_app.1.mgfk9romsudb@Ramiel | Renewal configuration file /etc/letsencrypt/renewal/npm-4.conf is broken. ` Errors above

kerem added the

bug

label

2026-02-26 07:30:39 +03:00

kerem commented

2026-02-26 07:30:40 +03:00

Author

Owner

@v1-valux commented on GitHub (Mar 20, 2022):

I can confirm problems on my side with auto-renewal..
Also a completely new request (without dns-challenge) fails, too.
The log instead lists "dns" under --preferred-challenges "dns,http" - is this correct?

Getting the following error when trying to renew my certs manually:

[3/20/2022] [1:03:11 AM] [Express  ] › ⚠  warning   Command failed: certbot certonly --config "/etc/letsencrypt.ini" --cert-name "npm-13" --agree-tos --authenticator webroot --email "webmaster@domain.tld" --preferred-challenges "dns,http" --domains "domain.tld"

Another instance of Certbot is already running.

EDIT:

I reverted to 2.9.15 which didn't work at first,
then I cleared my browser cache and suddenly manual renewal worked.

Don't quite know which one was the solution (at least for the manual renewal)..

@v1-valux commented on GitHub (Mar 20, 2022): I can confirm problems on my side with auto-renewal.. Also a completely new request (without dns-challenge) fails, too. The log instead lists "dns" under `--preferred-challenges "dns,http"` - is this correct? Getting the following error when trying to renew my certs manually: ``` [3/20/2022] [1:03:11 AM] [Express ] › ⚠ warning Command failed: certbot certonly --config "/etc/letsencrypt.ini" --cert-name "npm-13" --agree-tos --authenticator webroot --email "webmaster@domain.tld" --preferred-challenges "dns,http" --domains "domain.tld" Another instance of Certbot is already running. ``` EDIT: I reverted to 2.9.15 which didn't work at first, then I cleared my browser cache and suddenly manual renewal worked. Don't quite know which one was the solution (at least for the manual renewal)..

kerem commented

2026-02-26 07:30:40 +03:00

Author

Owner

@boehser-enkel commented on GitHub (Aug 11, 2022):

Same problem for me @2.9.18

@boehser-enkel commented on GitHub (Aug 11, 2022): Same problem for me @2.9.18

kerem commented

2026-02-26 07:30:40 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Feb 24, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Feb 24, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 07:30:40 +03:00

Author

Owner

@battletux commented on GitHub (Dec 18, 2024):

I was having this issue and tried the temp work around from #2881 but it was not working for me initially so I restarted the container and disabled the force SSL for it to start working.

@battletux commented on GitHub (Dec 18, 2024): I was having this issue and tried the temp work around from #2881 but it was not working for me initially so I restarted the container and disabled the force SSL for it to start working.

kerem commented

2026-02-26 07:30:40 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Aug 18, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Aug 18, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 07:30:40 +03:00

Author

Owner

@CuzImBisonratte commented on GitHub (Feb 17, 2026):

This is still an issue (using v2.14.0).

Here is a snippet from docker logs:

[2/17/2026] [12:13:12 PM] [SSL      ] › ℹ  info      Renewing LetsEncrypt certificates for Cert #16: home.dinosaur.farm
[2/17/2026] [12:13:12 PM] [SSL      ] › ℹ  info      Command: certbot renew --force-renewal --config /etc/letsencrypt.ini --work-dir /tmp/letsencrypt-lib --logs-dir /data/logs --cert-name npm-16 --preferred-challenges http --no-random-sleep-on-renew --disable-hook-validation
[2/17/2026] [12:13:13 PM] [SSL      ] › ℹ  info      Renewing LetsEncrypt certificates for Cert #13: admin.dinosaur.farm, npm.dinosaur.farm
[2/17/2026] [12:13:13 PM] [SSL      ] › ℹ  info      Command: certbot renew --force-renewal --config /etc/letsencrypt.ini --work-dir /tmp/letsencrypt-lib --logs-dir /data/logs --cert-name npm-13 --preferred-challenges http --no-random-sleep-on-renew --disable-hook-validation
[2/17/2026] [12:13:14 PM] [SSL      ] › ✖  error     Saving debug log to /data/logs/letsencrypt.log
Renewal configuration file /etc/letsencrypt/renewal/npm-16.conf is broken.
The error was: expected /etc/letsencrypt/live/npm-16/cert.pem to be a symlink
Skipping.
0 renew failure(s), 1 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /data/logs/letsencrypt.log or re-run Certbot with -v for more details.

The workaround from #2881 doesn't help here and manual refresh from the certificates tab doesn't work as well, but rather just selecting the Host > SSL > Request new certificate works. But this doesn't fix auto-renew working again but just requests a new cert.

@CuzImBisonratte commented on GitHub (Feb 17, 2026): This is still an issue (using v2.14.0). Here is a snippet from docker logs: ``` [2/17/2026] [12:13:12 PM] [SSL ] › ℹ info Renewing LetsEncrypt certificates for Cert #16: home.dinosaur.farm [2/17/2026] [12:13:12 PM] [SSL ] › ℹ info Command: certbot renew --force-renewal --config /etc/letsencrypt.ini --work-dir /tmp/letsencrypt-lib --logs-dir /data/logs --cert-name npm-16 --preferred-challenges http --no-random-sleep-on-renew --disable-hook-validation [2/17/2026] [12:13:13 PM] [SSL ] › ℹ info Renewing LetsEncrypt certificates for Cert #13: admin.dinosaur.farm, npm.dinosaur.farm [2/17/2026] [12:13:13 PM] [SSL ] › ℹ info Command: certbot renew --force-renewal --config /etc/letsencrypt.ini --work-dir /tmp/letsencrypt-lib --logs-dir /data/logs --cert-name npm-13 --preferred-challenges http --no-random-sleep-on-renew --disable-hook-validation [2/17/2026] [12:13:14 PM] [SSL ] › ✖ error Saving debug log to /data/logs/letsencrypt.log Renewal configuration file /etc/letsencrypt/renewal/npm-16.conf is broken. The error was: expected /etc/letsencrypt/live/npm-16/cert.pem to be a symlink Skipping. 0 renew failure(s), 1 parse failure(s) Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /data/logs/letsencrypt.log or re-run Certbot with -v for more details. ``` The workaround from #2881 doesn't help here and manual refresh from the certificates tab doesn't work as well, but rather just selecting the Host > SSL > Request new certificate works. But this doesn't fix auto-renew working again but just requests a new cert.

kerem referenced this issue

2026-02-26 08:31:55 +03:00

[PR #3929] Switch from X-Real-IP to X-Forwarded-For in nginx.conf #3780

Rows
Columns

[GH-ISSUE #1856] NPM not autorenewing certs #1358