mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-25 01:15:51 +03:00
[GH-ISSUE #1916] Auto SSL certificate renewal failing using AWS Route53 DNS #1396
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#1396
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @coreylane on GitHub (Mar 8, 2022).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1916
Checklist
jc21/nginx-proxy-manager:latestdocker image?Describe the bug
Automatic SSL certificate renewal fails when using AWS Route53 DNS challenge, but renewing manually through NPM console works fine.
Based on initial review of the logs, it looks like the automated renewal command is not setting the required "AWS_CONFIG_FILE" environment variable:
Nginx Proxy Manager Version
v2.9.16
To Reproduce
Steps to reproduce the behavior:
Expected behavior
SSL certificate is renewed as the expiry date approaches
Operating System
Unraid 6.10.0-rc2
Docker version 20.10.9, build c2ea9bc
Additional context
Logs
Workaround: Renewing through the console works as expected
@chaddm commented on GitHub (Apr 22, 2022):
@coreylane I am having the same issue. Would you be kind enough to share the manual command, please? I could not find it. Thank you.
@coreylane commented on GitHub (Apr 22, 2022):
@chaddm Try renewing through the NPM GUI, under SSL Certificates -> Renew Now
@chaddm commented on GitHub (Apr 22, 2022):
@coreylane Thank you. It worked correctly.
@nmbgeek commented on GitHub (Apr 25, 2022):
Same issue. Renewing manually through GUI fixed the issue which was the renewal at 4/25/2022 1:01AM
`[4/24/2022] [10:41:18 PM] [SSL ] › ℹ info Renewing SSL certs close to expiry...
[4/24/2022] [10:41:19 PM] [IP Ranges] › ℹ info Fetching IP Ranges from online services...
[4/24/2022] [10:41:19 PM] [IP Ranges] › ℹ info Fetching https://ip-ranges.amazonaws.com/ip-ranges.json
[4/24/2022] [10:41:19 PM] [IP Ranges] › ℹ info Fetching https://www.cloudflare.com/ips-v4
[4/24/2022] [10:41:19 PM] [IP Ranges] › ℹ info Fetching https://www.cloudflare.com/ips-v6
[4/24/2022] [10:41:19 PM] [Nginx ] › ℹ info Reloading Nginx
[4/24/2022] [10:41:20 PM] [Setup ] › ℹ info Logrotate completed.
[4/24/2022] [10:48:23 PM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation
Failed to renew certificate npm-1 with error: Unable to locate credentials
To use certbot-dns-route53, configure credentials as described at https://boto3.readthedocs.io/en/latest/guide/configuration.html#best-practices-for-configuring-credentials and add the necessary permissions for Route53 access.
All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/npm-1/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
at ChildProcess.exithandler (node:child_process:399:12)
at ChildProcess.emit (node:events:526:28)
at maybeClose (node:internal/child_process:1092:16)
at Process.ChildProcess._handle.onexit (node:internal/child_process:302:5)
[4/24/2022] [11:41:18 PM] [SSL ] › ℹ info Renewing SSL certs close to expiry...
[4/24/2022] [11:43:16 PM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation
Failed to renew certificate npm-1 with error: Unable to locate credentials
To use certbot-dns-route53, configure credentials as described at https://boto3.readthedocs.io/en/latest/guide/configuration.html#best-practices-for-configuring-credentials and add the necessary permissions for Route53 access.
All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/npm-1/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
at ChildProcess.exithandler (node:child_process:399:12)
at ChildProcess.emit (node:events:526:28)
at maybeClose (node:internal/child_process:1092:16)
at Process.ChildProcess._handle.onexit (node:internal/child_process:302:5)
[4/25/2022] [12:41:18 AM] [SSL ] › ℹ info Renewing SSL certs close to expiry...
[4/25/2022] [12:41:49 AM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation
Failed to renew certificate npm-1 with error: Unable to locate credentials
To use certbot-dns-route53, configure credentials as described at https://boto3.readthedocs.io/en/latest/guide/configuration.html#best-practices-for-configuring-credentials and add the necessary permissions for Route53 access.
All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/npm-1/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
at ChildProcess.exithandler (node:child_process:399:12)
at ChildProcess.emit (node:events:526:28)
at maybeClose (node:internal/child_process:1092:16)
at Process.ChildProcess._handle.onexit (node:internal/child_process:302:5)
Connection Error: Error: read ECONNRESET
[4/25/2022] [1:01:25 AM] [Express ] › ⚠ warning connect ECONNREFUSED 172.16.0.3:3306
[4/25/2022] [1:01:31 AM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via Route 53 (Amazon) for Cert #1: *.NOTMYDOMAIN.com
[4/25/2022] [1:01:31 AM] [SSL ] › ℹ info Command: AWS_CONFIG_FILE='/etc/letsencrypt/credentials/credentials-1' certbot renew --config "/etc/letsencrypt.ini" --cert-name "npm-1" --disable-hook-validation --no-random-sleep-on-renew
[4/25/2022] [1:02:15 AM] [SSL ] › ℹ info - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/npm-1.conf
Renewing an existing certificate for *.NOTMYDOMAIN.com
Congratulations, all renewals succeeded:
/etc/letsencrypt/live/npm-1/fullchain.pem (success)
@matthew-larner commented on GitHub (May 17, 2022):
I can replicate this issue. Works manually via the GUI.
@jonathanjuursema commented on GitHub (Jun 8, 2022):
I have the same issue. I'm unable to verify the logs (it's been a week or two since the last manual renewal) but symptoms are the same. Let's Encrypt via Route53 DNS, get e-mail from Let's Encrypt that the cert was not automatically renewed, manual renewal saves the day.
@emkookmer commented on GitHub (Jun 17, 2022):
I have the same Issue, Automatic renewal doesn't work, manual renewal does.
Below a snippet from the docker log:
Auto renewal
Manual renewal
NOTE: I've anonymized the domain names, but the structure is the same
@matthew-larner commented on GitHub (Aug 20, 2022):
I'm still experiencing this issue on the latest version. Is anyone able to fix this issue?
@coreylane commented on GitHub (Aug 25, 2022):
@matthew-larner Renewing through the NPM GUI works fine for me, I posted a screenshot in an earlier comment. If this doesn't work you may have an issue with your AWS credentials. Perhaps the User doesn't have required permissions to route53. What do your logs say?
Required AWS permissions:
@matthew-larner commented on GitHub (Aug 29, 2022):
@coreylane renewing via the GUI works fine. Automatic renewals don't though. Since I have 50+ entries it's a real pain having to renew manually.
How much effort is required to fix the auto renewals?
Thanks for you help on this.
@emkookmer commented on GitHub (Aug 30, 2022):
It looks like the code use for auto renewal isnt using the same renewal functions as the UI, but a simple command to certbot
github.com/NginxProxyManager/nginx-proxy-manager@14b889a85f/backend/internal/certificate.js (L42-L106)It should use this function to renew the certificates
github.com/NginxProxyManager/nginx-proxy-manager@14b889a85f/backend/internal/certificate.js (L999-L1028)I've "quick" fixed my installation by hardcoding the aws credentials:
@matthew-larner commented on GitHub (Sep 3, 2022):
@jc21 if I can push a fix for this would you support a PR?
@miztertea commented on GitHub (Nov 4, 2022):
Still having this issue. I was able to resolve by passing the credentials as an environment variable in docker-compose:
environment: - AWS_CONFIG_FILE=/etc/letsencrypt/credentials/credentials-1@jangeador commented on GitHub (Nov 8, 2022):
Just to thank @miztertea for contributing a solution, and to confirm that the env variable solved the problem for me as well.
@mkzimms commented on GitHub (Dec 2, 2022):
How would I handle this for an install that has multiple credential files? I have 9 domains requiring certificates with all separate AWS keys. credentials-11, credentials-13...etc
@miztertea commented on GitHub (Dec 2, 2022):
Unfortunately this workaround will only help with one credential file. I suppose you could create one IAM user that has access to all of your domains. As long as its the same IAM user, it won't matter which cred file you specify as they would all be the same access/secret pair
@emkookmer commented on GitHub (Dec 9, 2022):
This still would only work from one AWS tenant/account
@Ich-Eben commented on GitHub (Sep 26, 2023):
You can also pass the credentials directly to the certbot by setting two environment vars in your docker-compose file:
AWS_ACCESS_KEY_ID: "AAAAAAAAAAAAAAAAAAAAA"AWS_SECRET_ACCESS_KEY: "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"@jangeador commented on GitHub (Sep 26, 2023):
That is excellent @Ich-Eben. Thanks!
@stevecrozz commented on GitHub (Dec 15, 2023):
I implemented @emkookmer's suggestion in #3392
@sassy-x commented on GitHub (Apr 2, 2024):
Just came to thank you for your attention to detail here <3 Thank you!
@github-actions[bot] commented on GitHub (Oct 3, 2024):
Issue is now considered stale. If you want to keep it open, please comment 👍
@github-actions[bot] commented on GitHub (Oct 13, 2025):
Issue was closed due to inactivity.