mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-26 09:55:51 +03:00
[GH-ISSUE #2011] SSL certificate error #1453
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#1453
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ahmedelemamn on GitHub (Apr 19, 2022).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2011
Checklist
jc21/nginx-proxy-manager:latestdocker image?Describe the bug
i have a fresh NPM image running and tried to generate SSL certificate for my domain
i tried both http/dns challenges
for http challenge i get this error:
or this one:
for the second error i made sure my DNS record is configured as DNS only and not proxied on cloudflare and i have both port 80 and 443 forwarded on my WAN router
if i opted for DNS challenge i get this error
although the API key is working fine
Nginx Proxy Manager Version
v2.9.14
i tried the latest as well but i had the same issue and i saw a post here recommending downgrading helped but unfortunately it didn't help me ref. https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1862
To Reproduce
Steps to reproduce the behavior:
Expected behavior
wildcard SSL certificate to be created
Operating System
ubuntu server 21.10
@Lzyct commented on GitHub (Aug 16, 2022):
Any update about this issue?
@evlo commented on GitHub (Aug 17, 2022):
can you do *.example.com or just example.com?
Anyways i have same error with just example.com after clicking on test, but not when domain is unavailable, maybe this happens if domain points to different location. I'm using cloud flare dns without proxy do i need to use dns challenge?
With token I get
Error determining zone_id: 6003 Invalid request headers. Please confirm that you have supplied valid Cloudflare API credentials. (Did you copy your entire API token/key? To use Cloudflare tokens, you'll need the python package cloudflare>=2.3.1. This certbot is running cloudflare 2.9.12)(yes i'm sure, i'm used same one in traefik, but i wanted to switch to something with web ui management)
Without dns challenge i get
UPDATE: weirdly after 3 attempts (no change in token) it did succeeded even with wildcard, i dunno what it does say about trying same thing expecting different result
@vm75 commented on GitHub (Nov 28, 2022):
I am facing the same issue. Have enabled port forwarding for both 80 & 443. keep getting the same errors outlined in the original post
@Evilernie2001 commented on GitHub (Nov 29, 2022):
Same Problem here. Can`t renew the or create SSL via Letsencrypt
@BL3CKM00N commented on GitHub (Nov 29, 2022):
guessing im not the only one here today xD
@Yannic-reust commented on GitHub (Nov 29, 2022):
same here
@g4xx commented on GitHub (Nov 29, 2022):
Same here
@CameronMacG commented on GitHub (Nov 29, 2022):
+1
@msawyer91 commented on GitHub (Nov 30, 2022):
I'm seeing the same "Communication with the API failed, is NPM running correctly?" on NPM 2.9.19 on a Raspberry Pi using Docker. The error occurs when I test connectivity, but ultimately succeeded in requesting the certificate from Let's Encrypt.
@HostLabs-LLC commented on GitHub (Nov 30, 2022):
I'm also getting Communication with the API failed, is NPM running correctly?" after pulling :latest this morning. I'm glad its not just me, hopefully we get this fixed. Thanks!!!
@BL3CKM00N commented on GitHub (Nov 30, 2022):
Well... u can request a certificate but only the check does currently not work. Requesting and renewing does work just fine ;)
@Barzoo7 commented on GitHub (Dec 1, 2022):
+1 hope solve it
@roo12312 commented on GitHub (Dec 2, 2022):
same here
@DomBrownInOz commented on GitHub (Dec 3, 2022):
Yep. same here?
@xnrbdev commented on GitHub (Dec 3, 2022):
Anyone had any luck with a older version ?
@OfficialMuffin commented on GitHub (Dec 3, 2022):
Same issue here
@Srcodesalittle commented on GitHub (Dec 3, 2022):
Same here, please advise
@MarkoS046 commented on GitHub (Dec 4, 2022):
Same here :/
@YuraBogdan commented on GitHub (Dec 5, 2022):
whenever you try to see if the server reachable, docker logs will display this error.
I've tried to pinpoint script that triggers but had no luck so far
@lazyzyf commented on GitHub (Dec 5, 2022):
@DelScipio commented on GitHub (Dec 6, 2022):
Same problem in all my servers. Nothing changed, worked fine till it doesnt.
@CristianEduardMihai commented on GitHub (Dec 6, 2022):
Same here. PM works fine on my Oracle Cloud hosts, but I'm facing this issue on my home server.
@kiennt048 commented on GitHub (Dec 7, 2022):
same here, even install lastest version hardware
@gylove1994 commented on GitHub (Dec 8, 2022):
same here.
@Radiofreqq commented on GitHub (Dec 9, 2022):
same. no joy. I'm new to all this and I've been beating my head thinking I messed up somewhere.
@bigbeka commented on GitHub (Dec 9, 2022):
I'm having the same issue.
@tarkh commented on GitHub (Dec 9, 2022):
Yep, same issue.
@bigbeka commented on GitHub (Dec 9, 2022):
The only way I was able to get SSL is to Add host and request the SSL through the Host setup process.
@Sebekerga commented on GitHub (Dec 9, 2022):
The wall of "same here" messages doesn't speed up the process of resolving this issue and it creates an unnecessary spam for those who follow issues via email.
If you want to help, please provide additional information such as logs, your settings, info about your setup or anything else that you think might be helpful.
If you want to show that you also are interested in solving this issue, consider just up-voting initial issue message, so that the counter will go up.
But please, stop spamming "same here"
EDIT: Want to make it clear, that I do not think bad of people who posted "same here" and just wanted to point out that it is not the most helpful approach for participating in issues, with peace and love
@bigbeka commented on GitHub (Dec 9, 2022):
@Sebekerga Agreed.
Here are most recent logs with Error/Failed tags. Happy to provide more if these are not helpful.
@LucaVignati commented on GitHub (Dec 9, 2022):
After spending the night on it I found what was my issue.
I'm using NPM as a docker in unRAID, and for whatever reason the port settings of the template (where you specify the port forwarding at docker network level) changed.
Instead of forwarding port 180 to the internal port 80 and port 1443 to the internal port 443, the template was forwarding port 180 to port 180 and port 1443 to port 1443.
I changed it back to forwarding to 80 and 443 and now it's working.
@bigbeka commented on GitHub (Dec 9, 2022):
@LucaVignati Thanks for sharing, glad you solved your issue.
But this doesn't explain my case.
I am not using NPM, and my NGINX host is a docker image and ports 80 and 443 are pointing at the NGINX Proxy Manager Docker Container.
@Radiofreqq commented on GitHub (Dec 9, 2022):
My apologies, I believe the reason people are adding "same here" or some derivative of that is because it makes them part of the conversation. So, when there is any update on the matter, they get notified. Please forgive me if there is a less intrusive way to accomplish these results. If you know of any, go ahead an inform the forum so future users don't follow the same method.
One a side note. My issue resolved by deleting the host and SSL cert in nginx and recreating it. I have done this a bunch of times in the past already and it didn't work. It just "worked" last night. Not sure why.
@patrick250709 commented on GitHub (Dec 9, 2022):
"Same Here" -> use the button Subscribe at the top on the right sidebar (pc)
I was having the same problems, and just to test it out, i disabled IPv6 through my docker-compose.yml
And now it creating proxy host with ssl work.
Will return when my instance of Nextcloud-aio is up and running, then i can test if my https://sub.domain-name.tld works
Edit
Tested my domain and Proxy Host works with ssl.
I still gets a error when testing the SSL certificate "Test Server Reachability"
Error:
Communication with the API failed, is NPM running correctly?@bigbeka commented on GitHub (Dec 9, 2022):
@patrick250709 Could you please try getting just the certificate under
SSL Certificatestab (Without creating the host first)?The
Communication with the API failed, is NPM running correctly?error comes up when you try to add the Cert before creating the host but after pointing your DNS Records at the NGINX Proxy Manager host.@patrick250709 commented on GitHub (Dec 9, 2022):
I just tried.
@bigbeka commented on GitHub (Dec 9, 2022):
@patrick250709 No joy for me.
It turned out that my yml already had IPv6 disabled.
Test Server Reachabilitygives meCommunication with the API failed, is NPM running correctly?and trying to request the SSL without testing gives me this:@Srcodesalittle commented on GitHub (Dec 9, 2022):
Hi, for what it's worth, I solved it by remembering to change my dns records on cloudflare from proxied to DNS only, turning off both HTTPS only, automatic HTTPS rewrite., and changing certificate security from full to flexible This allowed proper HTTP communication to actually reach my server and the certs were pulled in 100% of the time. Once I received the required certs, I turned the protections and rewrites back on.
@bigbeka commented on GitHub (Dec 9, 2022):
@Srcodesalittle Exact steps that I used to take every time I created Certs. Since the issue started, nothing has changed. I have tried to reduce to Flexible, no joy either.
I might be missing something very obvious, I just need to sleep on it maybe.
@Srcodesalittle commented on GitHub (Dec 9, 2022):
Sorry to hear that, the only thing I can think is whether the dns resolver on your docker image is working correctly and if you try too many cert requests, letsencrypt will time you out for a while (logs should tell you this). Other than that, not sure what could be happening.
@bigbeka commented on GitHub (Dec 9, 2022):
@Srcodesalittle No, not at all mate.
I will give a try to fresh install on a fresh host to reproduce this. I will report back with results, hopefully with positive ones.
@davix3f commented on GitHub (Dec 10, 2022):
I get the same errors. I didn't change anything in my container since installation a year ago and just started popping this error on new certs, or updating old ones, updating the image didn't solve this issue. I also tried rolling back acme as suggested in the main post but didn't work. Any ideas? This is annoying
@r-hmn commented on GitHub (Dec 13, 2022):
Worked for me!✔
i had version v2.9.18, and noticed the SSL outdated, and renewal failed as this topic.
Communication with the API failed, is NPM running correctly?i renewed the docker image and started, now version v2.9.19 and also SSL renewal failed.
I went to the "proxy-host" and disabled "force SSL" for that host.
Then under the "SSL sertificates" tried "renew now" for that host, and it worked!
@bigbeka commented on GitHub (Dec 13, 2022):
Renewing an existing SSL cert is not an issue from the SSL tab.
Generating new SSL cert for a domain that is correctly pointed to the NGINX Proxy Manager fails.
Can you try to generate a new SSL cert for a domain that is pointing to your host, but doesn't have the cert yet?
@Srcodesalittle commented on GitHub (Dec 13, 2022):
I'm away from my server at the moment and can't check right now. I'll try to get back to you soon.
@rumplin commented on GitHub (Dec 13, 2022):
Today some certificates expired for my sites and I'm struggling to get it back.
Here are the logs from the container:
and logs from /var/log/letsencrypt/letsencrypt.log
@rumplin commented on GitHub (Dec 13, 2022):
As a workaround I did the following:
@Srcodesalittle commented on GitHub (Dec 18, 2022):
Hi I just created a new cert for my domain and it works fine. No issues
@RobusTetus commented on GitHub (Dec 19, 2022):
It works only for a while when you first pull the images and make a completely new and fresh container of npm without any volumes saved. Then after I add like 4 hosts, each with it's own cert, it breaks and refuses to even make a new certificate. No matter if I try to add it when adding a new proxy host or directly through the SSL cert tab.
@Srcodesalittle commented on GitHub (Dec 19, 2022):
Not to discount your experience, but my NPM is already running close to ten hosts on different domains. As I mentioned in my comment, that is the state where I added a new cert to a new sub domain and it worked fine.
@RobusTetus commented on GitHub (Dec 20, 2022):
That is even more confusing to me then. What version of npm are you using? I'm on v2.9.19 - which should be the latest from docker hub. It did it the first time I set up my server (that was like 2.9.18) and then repulled the images and rebuilt the container and it broke again.
@Srcodesalittle commented on GitHub (Dec 21, 2022):
I'm on 2.9.18 just checked
@Voxis commented on GitHub (Dec 21, 2022):
hey guys, i just started my own domain. I tried the button it did not work (test if it works) like the thread indicates. but I am able to create ssl cert fine. I dont know about renew as of yet. so just letting you know that the creation part is working for me.
@rumplin commented on GitHub (Dec 22, 2022):
This morning all my sites are greeting visitors with a red background and "Google Safe Browsing recently detected phishing", it must be related to recent certificate shenanigans... Ohh joy.
@kitoming commented on GitHub (Dec 27, 2022):
Hello, in my case I solved the problem.
First I also got this "internal error" or "Communication with the API failed, is NPM running correctly?".
Then I removed the certificat and tried to recertify it and got the same, but got the message in the red box "Another instance of Certbot is already running".
My solution I found: https://community.letsencrypt.org/t/solved-another-instance-of-certbot-is-already-running/44690
After doing that I registered the certificat by the "edit proxy host" menu!
PS: I updated my version to 2.9.19
@bigbeka commented on GitHub (Dec 27, 2022):
@kitoming Yes, but that still doesn't solve the problem with getting new certificated under 'SSL Cert' tab. A fresh cert without host pointing at a service.
By way of update, I have installed a new droplet on DO, with a fresh IP, with fresh Docker, with fresh install of NGINX Proxy Manager, and tried to 'Test reachability', still gives me the same error. Not sure if it is even worth typing here, as no contributors or maintainers of this project have replied.
@SriharshaShesham commented on GitHub (Dec 27, 2022):
Hi all,
In my case the error got resolved by itself. I have tried many of the things above. Initially disabling force SSL and trying to generate the certificate failed. However it worked the next day. From last couple of days all the methods are working as expected. I personally think LetsEncrypt have updated something recently.
@lmatzer commented on GitHub (Dec 28, 2022):
I can not reproduce that. Still none of the certificate generation methods works for me, even above cloudflare workaround has no effect.
@SriharshaShesham commented on GitHub (Dec 28, 2022):
Try these
-> Create Proxy, close
-> edit proxy, request SSL without force
Forgot to mention, I had to do the DNS Challenge way couple of times before getting the SSL to work without DNS challenge
@johndoe0815 commented on GitHub (Jan 10, 2023):
My NPM was working fine for months, now I just realized that it does not auto-renew certificates anymore (which it did until a certain point in time, maybe the last update?).
The odd thing is, issuing new certificates works. Also when I manually click on "renew now", it renews without any issues. But when I click on "test server reachability" I get "Communication with the API failed, is NPM running correctly?". So basically I am just missing the automatism to not have to renew my certificates manually every few months.
@nagalakshmi896 commented on GitHub (Jan 16, 2023):
@bigbeka,
@ahmedelemamn
step 1: The above issue is solved by opening the nginx proxy manager instance or server 80 port to public(check for your server in Digital ocean or others )
step 2:Then try to request new ssl certificate
Note: For generate ssl certficates the nginx proxy manager server should be exposed to public then only ssl certificates will generate without errors
@bigbeka commented on GitHub (Jan 16, 2023):
@nagalakshmi896 Step 1 does not make sense as anyone using NGINX Proxy Manager need to expose port 80 to public.
@nagalakshmi896 commented on GitHub (Jan 16, 2023):
@bigbeka
I am not telling like NGINX Proxy Manager need to expose port 80 to public.(Where NPM is installed that server should be opened to 80 (to public)
please try by open the inbound rules 80 and 443
@bigbeka commented on GitHub (Jan 16, 2023):
@nagalakshmi896 Yes, UFW in/out bound traffic for ports 80 & 443 on UDP & TCP is enabled. Still no joy.
@styxadmin commented on GitHub (Jan 17, 2023):
I am having the same issue as everything above. I initially thought it may have been a change I made to my firewall policies so I reverted them. The issue persisted.
The only way I was able to get it working again was the following:
Delete SSL Certificate for the host.
Delete & Recreate the host and then request a new certificate
EDIT: Nevermind, It only worked for the first host I tried this with and then I keep getting an internal error
Another Update: During the recreation/deletion process, suddenly all the certificates which were expired renewed themselves
@lenschith commented on GitHub (Jan 19, 2023):
@jc21 is there any new information. No workaround works for me.
@AlanMW commented on GitHub (Jan 25, 2023):
Some friendly person on Reddit pointed me to the settings for the host, seemed to do the trick for me.
@bigbeka commented on GitHub (Jan 25, 2023):
I don't think this solves the problem.
The main point of getting SSL before setting up the host is to check if the Domain pointing at the public IP has actually propagated or not, hence the need for SSL tab, and the need for "Test" button.
If the domain is not pointing to the correct IP, and you request SSL from Let's Encrypt, you might get penalised for this and get temporary ban. 🤷♂️
@holgerflick commented on GitHub (Jan 30, 2023):
Crazy thing for me is that I can confirm that I see all the error messages given above, but after "some time" the expiration date of my SSL certs changed and they have been renewed even though an error was shown. Sadly, I do not see any other error messages in addition to those that have been reported here.
@tuanhd8789 commented on GitHub (Feb 7, 2023):
I had this issue too, and when i create new cert, output is:
"Another instance of Certbot is already running"
My solutions:
To find the certbot process, try:
ps -ef | grep certb
The process ID would be the first number after the user, like:
root 5555 5100 …
To kill the process, try:
kill 5555
((replace 5555 with your actual certbot PID#))
Kill all certbot pid running and retry then i created success new cert.
Sources:
https://community.letsencrypt.org/t/solved-another-instance-of-certbot-is-already-running/44690/2
Hope to help someone!
@lolekuk commented on GitHub (Feb 8, 2023):
Ok, I believe Cloudflare security (double proxies and other bits) block let's encrypt creating and renewing certs. I've tried disabling bits and bobs on cloudflare with no luck. Issue for me started once I switched to Cloudflare (all was working ok on namecheap but of course namecheap doesn't provide same tools and security as cloudflare).
Switching to Cloudflare cert (free and for 15 years validity) for all my domains and subdomains (8 hosts/subdomains) took less than 5 mins.
Hope this helps you guys:
Log into cloudflare -> SSL/TLS -> Origin Server and create certificate (just one, wildcard certificate will be used for all subdomains)
using notepad
copy and paste certificate into notepad and save as e,g, certificate.crt
copy and paste key into another notepad file and save as key.crt
Log into your NPM:
go to SSL certificates -> add new -> custom
give it a name and then browse and choose cert and key files in the 2 fileds available.
save the cert - should show 15 years expiry date etc.
Go to your domains and subdomains and replace your ssl cert with cloudflare one
All works for me :)
@rodneyt commented on GitHub (Feb 8, 2023):
Ok, this steps work for me Docker
re-deploy container
Remote in container console
Run pip install certbot-dns-cloudflare==$(certbot --version | grep -Eo '0-9+') cloudflare
if you get this error, just update pip install --upgrade --force-reinstall acme==2.2.0
(https://freeimage.host/i/HEzf6jj)
@pwfraley commented on GitHub (Feb 10, 2023):
Same problem here
@lolekuk commented on GitHub (Feb 10, 2023):
Have you tried this?
https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2011#issuecomment-1422399423
@pwfraley commented on GitHub (Feb 10, 2023):
No, I like Lets Encrypt and I do not have a CloudFlare account nor do I manage my Domains through CloudFlare. I add about a Host a Year to NPM and everytime I try to do this NPM is broken. Very anoying. NPM never got certificate renewal automatically working, every 3 Months I have to go into it and update the certificates by hand.
I guess it is time to switch to another proxy.
@davix3f commented on GitHub (Feb 11, 2023):
I'm getting the "Communication with API failed, are you sure NPM is running correctly" error too, I can't request any new certificate nor renew my existing ones. I didn't change anything in my docker compose or anything, this issue just came up by itself which to me does not make sense. I also can't find any solution on this, except switching to traefik - but I just can't get it working, either, so I hope this will get fixed fast
@LuisPalacios commented on GitHub (Feb 15, 2023):
Hi team, I'm experiencing exactly the same error. In my case I have NPM as an AddOn in HASS.IO, but the error is the same. Let'sencrypt reaches the box but is discarded with a
connection refused. All mappings are ok, but missing a "web server" attending the request.I've seen that the call to certbot is using
--authenticator webroot; so it needs a web server listening on :80 serving the file that lets encrypt is looking for. Which is not the case !!One solution would be to change to
--standalonebut I'm not sure if it's possible to configure, somehow, NPM to use--standaloneinstead.Thanks
Luis
@wickedyoda commented on GitHub (Feb 21, 2023):
It seems like this topic/issue has not been resolved, as I came here with the same problem. The author needs to check and see about duplicating and resolving the issue.
@timnolte commented on GitHub (Feb 24, 2023):
I just got 2 notices from Let's Encrypt about certificates expiring soon. I checked NPM to also find I'm getting the "Communication with the API failed, is NPM running correctly?" error when using the "Test Server Reachability" option, and I'm concerned about auto renewal not working. In the past with a different setup I never got cert expiration notices from Let's Encrypt.
@timnolte commented on GitHub (Feb 24, 2023):
So looking at my logs and I am getting the same error about certbot already running.
@timnolte commented on GitHub (Feb 25, 2023):
So I used the guidance in this comment to remove the lock files and this seemed to resolve the certbot is already running issue. I'm still faced with renewal failures. My logs are like this:
@GamerClassN7 commented on GitHub (Feb 26, 2023):
Hi did you manage to resolve this problem i am in same state as yu just with slighter difrent error :(
@EDIflyer commented on GitHub (Mar 16, 2023):
Just updated to 2.9.20 after seeing @jc21 did a push to Docker Hub. Unfortunately no change in the SSL certificate renewal bug...
@punkyard commented on GitHub (Apr 7, 2023):
hi
yes, i've tried this. It didn't work before, but this time it worked ..
still, I don't have an explanation for the let's encrypt error in npm .. 🤔
but thanks!!
@gitrummy commented on GitHub (Apr 8, 2023):
I use NPM on Home Assistant Core all running on a Windows PC. For me disabling the Windows firewall and also pausing ESET allowed to me renew all certs one by one from the SSL certificates list.
@vuanhson commented on GitHub (Apr 24, 2023):
My NPM can issue LE certificate normally (domain hosted in CF) but the GUI showing error when doing reachability test. May be a visual bug
@tomvanswam commented on GitHub (Apr 27, 2023):
Same issue happened to me. When testing a message that NPM might not be configured correctly and on an actual try to get a certificate an internal error.
I found out that in the let's encrypt logs, there were two ip addresses found to match the domain I wanted to get a certificate for. One ipv4 (A record) and one ipv6 (AAAA record).
Certbot used the ipv6 one to perform the http-01 challenge on. However that one was still pointing to some default domain registrar ip.
After changing the ipv6 AAAA record to point to my server, all worked as expected.
I did set the environment var to disable ipv6, however apparently the certbot script does not disable ipv6 for the challenge, which one might expect.
So even when disabling ipv6 one should set the AAAA record to your server (and forward it to NPM) or removing the AAAA record completely to make it possible for certbot to create certificates.
@EDIflyer commented on GitHub (Apr 27, 2023):
That gave me hope for a minute, @tomvanswam - unfortunately when I double-checked the AAAA record correctly points to the same server as the A one in my case 😞
@tomvanswam commented on GitHub (Apr 27, 2023):
Make sure (when hosting at home) your router is also forwarding ipv6 traffic to your server. This isn't done by default when forwarding ipv4 traffic.
Check your firewalls that rules are also in place to allow ipv6 traffic to your server.
Request a certificate even though the test fails and check the letsencrypt.log file somewhere in the /tmp folder (I'm on mobile so can't check what folder precisely) in the container and try to find the reason why it's not working. This helped me finding out what I did.
@EDIflyer commented on GitHub (Apr 27, 2023):
Thanks @tomvanswam - I'm on a VPS so no issues re firewalls, etc. If I delete and recreate them fresh it tends to work, it's the auto-renewal that isn't working. I'll look at the logs again later but have posted in a few other ones re this issue, really hoping there'll be a fix soon.
@tomvanswam commented on GitHub (Apr 27, 2023):
I did do a first regustration indeed, not a renewal, maybe my luck runs out in 60 days 🙄
@KoenVanduffel commented on GitHub (May 1, 2023):
I can confirm: I can generate new certificates but cannot renew certificates.
Removing certificates leaves the cert files in place and when running certbot renew in the console it still finds them and tries to renew them.
certbot renew --cert-name npm-42 --force-renewalgives the following error:Renewal configuration file /etc/letsencrypt/renewal/npm-42.conf is broken. The error was: expected /etc/letsencrypt/live/npm-42/cert.pem to be a symlink Skipping.What works is to remove the certificate manually in the SSL Certificates tab and generating a new one.
Force renewing the certs I created just now does seem to work.
@EDIflyer commented on GitHub (May 1, 2023):
Thanks for confirming, @KoenVanduffel - interesting finding re cert files being left in place after removal from the UI, that was my suspicion too. Quite a hassle to do if lots of subdomains!
@prom00 commented on GitHub (May 4, 2023):
I deleted the SSL certificate, yet I can't request a complete new ssl certificate..
It's now even getting more weird. I just tried a refresh on my other domain, this wasn't working at first.
Now it has refreshed it. I now requested a new ssl for the 2nd (sub) domain, it's not working again.
@EDIflyer commented on GitHub (May 4, 2023):
it might be worth trying the steps I put in #2881 and see if they work for you at all for renewing. For the removals did you do it via UI or command line? As @KoenVanduffel mentions the UI version doesn't seem to properly remove. In that situation I copied a known 'good' certificate from another site on that domain then refreshed it using the steps mentioned in that linked issue.
@prom00 commented on GitHub (May 4, 2023):
I've done this now:
Part 2 - turn off Force SSL and then renew
Then it created a new ssl certificate... I'm using this through a HA plugin, not sure on how I would need to do the shell commands, but for now it seemed to be ok again for a couple months.
@balones6531 commented on GitHub (May 8, 2023):
Turning 'Force SSL' off was the quick fix for me.
@Wdrussell1 commented on GitHub (May 22, 2023):
Been almost a year and nothing on this issue. To be such a popular application that does see updates, it would be nice to see this fixed.
@wickedyoda commented on GitHub (May 22, 2023):
Theres many forks to this repo, I would recommend tracking one of them and seeing if someone has picked up maintaining the app.
@davix3f commented on GitHub (May 23, 2023):
Any you would recommend? Because honestly I don't know what to look for when choosing a forked repo
@awad0 commented on GitHub (Jul 19, 2023):
Fixed it for me, too. Could it be that the wrong (http) challenge is being checked to start a DNS challenge?
@wickedyoda commented on GitHub (Aug 3, 2023):
Look at the commits and commit dates; the ones that are more current will have more current commits where changes and updates have been applied. I have run into several errors with this repo but still maintains to be one of the best. It's sad that they have not continued to update it.
@wickedyoda commented on GitHub (Aug 3, 2023):
I have found when SSL renewal fails or a challenge fails, restart the container and try again. Been the simplest workaround for me so far.
@gabbas1 commented on GitHub (Aug 4, 2023):
"Same"
My setup:
OpenSuse 15.4
Docker 23.0.6
jc21/nginx-proxy-manager 2.10.4 / 2.10.3
When I try to refresh the certificate:
Meanwhile the logs of nginx:
When I try the "Test the server reachability":
With Version 2.10.3 on "refresh" and on "Test the server reachability" the error was:
Otherwise no changes.
@awad0 commented on GitHub (Aug 8, 2023):
Unfortunately not. I tried this before. I'm in a LXD container, where I can ssh into. It's not a port or connection issue. Manual "dry run" also worked.
@etymotic commented on GitHub (Sep 4, 2023):
If anyone wants to give this a try:
My setup is NPM docker running on the same virtual machine as all of my other docker stuff. I use AdGueard Home, with a DNS rewrite of *.mydomain.com - > Local IP of NPM. I figured there was probably some sort of problem of NPM trying to reach stuff but just getting redirected and never leaving my LAN...
So I set up wireguard in the virtual machine that runs all of my docker stuff. I have a subscription to AirVPN and used their config generator. With the VPN connected, I'm able to add/renew certificates.
My guess is that the VPN forces traffic to leave my LAN, which helps things renew properly. Either that, or it just randomly started working while I was messing around with it.
@prom00 commented on GitHub (Sep 4, 2023):
I've had this before too, where it suddenly started to work again...
@BartAgterbosch commented on GitHub (Sep 4, 2023):
I would like to weigh in here and suggest making sure that "Block common exploits" is disabled in the proxyhost settings for the particular domain you're trying to renew (re-enable it afterwards), also wait a while before doing it if you've been spamming the renew button before trying that, it might be rate limited
@EDIflyer commented on GitHub (Sep 4, 2023):
Just to flag this PR I submitted seems to do the trick - https://github.com/NginxProxyManager/nginx-proxy-manager/pull/3121 - I've done renewals on a few servers since and they seem to go through OK. You can test it via the auto-built Docker image in the PR.
@Tschakko1993 commented on GitHub (Sep 27, 2023):
I had exactly the same problem as described above.
I checked my router settings and it seems that port 80/443 was not forwarded.
I opened the ports and it fixed that issue
@vladtvoeit commented on GitHub (Oct 28, 2023):
I am using ubuntunu+portainer+npm+uptime kuma. I want to get a certificate for uptime kuma. When I click: "Test Server Reachability" I get an error: "Communication with the API failed, is NPM running correctly?". Any help?
80 and 443 ports are available
@EDIflyer commented on GitHub (Oct 29, 2023):
@baxenko where are you clicking 'Test Server Reachability'? I've got the Portainer/NPM/Uptime Kuma setup too and all are working fine (using my PR above for NPM to ensure SSL certs issued/renewed OK)
@etymotic commented on GitHub (Oct 30, 2023):
@baxenko I'm pretty certain, at least for me, that it's network related. Probably NAT Loopback. I think NPM sends out a DNS request for your domain, gets pointed at your home network, and your router never lets anything leave. The solution for me was connecting the machine that runs NPM to a VPN. That forced stuff to leave my home network so the certificate stuff could succeed.
@irhiggs commented on GitHub (Nov 3, 2023):
I found this that seems to help a lot: https://www.reddit.com/r/nginxproxymanager/comments/166fbka/certbot_renew_internal_error/
Looks like we need a different certbot version packaged into this docker container
@misaka00251 commented on GitHub (Nov 11, 2023):
https://old.reddit.com/r/nginxproxymanager/comments/166fbka/certbot_renew_internal_error/k1b9fra/
Yeah this work.
@vladtvoeit commented on GitHub (Nov 11, 2023):
@EDIflyer , @etymotic
My problem was due to an installed Portainer that would not allow npm to "see" uptime kuma. My friend wrote instructions on how to properly install it and configure Portainer to detect the container. I got everything working. Thanks to all of you for your help.
✅ Instructions: https://gist.github.com/Vladkarok/12ed9c11282d1659ecf369028c3202e6
@yasarza commented on GitHub (Nov 12, 2023):
Hello everyone
I had the same issue, and it turns out it has something to do with my firewall setting.
I have a pfsense firewall, and when I checked my settings, I found that I allowed only TCP/UDP connection to the web, which I think wasn't enough for nginx to verify the API token.
@liveinaus commented on GitHub (Nov 17, 2023):
Thanks, it has fixed my issue. Thanks for sharing the fix.
The following commands ran in the container fixed the issue.
cd /opt/certbot/opt/certbot/bin/pip install certbot==2.6.0/opt/certbot/bin/pip install -U certbot-dns-godaddy. /opt/certbot/bin/activate && pip install --upgrade pyopenssl@RobustMarker commented on GitHub (Nov 23, 2023):
What did you change? you allowed a different port or something?
@julianjuan77 commented on GitHub (Dec 9, 2023):
In my case, creating a new certificate did not work for me. The problem was not having created the subdomain in cloudflare and pointing it to my server. Once the subdomain was created in cloud fare I was able to create my new certificate without problems.
En mi caso no me funcionaba crear un nuevo certificado. El problema era no haber creado el subdominio en cloudflare y apuntarlo a mi servidor. Una vez creado el subdominio en cloudflare pude crear mi nuevo certificado sin problemas.
@JtMotoX commented on GitHub (Dec 10, 2023):
Thank you so much @bigbeka ! Your comment worked for me. 👍
@AlaskaJedi commented on GitHub (Dec 17, 2023):
Okay, after a few hours of frustration, re-installs, and changing router configs, I kept getting the internal error or the communication with the API NPM running correctly?
I have another subdomain outside of NPM with its own certificate, so I decided to do a force renewal and it worked right away. I was about to add a wildcard to that certificate and import it to NPM, but I decided to try it one more time. I created a new certificate from scratch with a fresh API key from Cloudflare.
That's when I noticed something. When using the DNS Challenge option, the credentials file content had the example below:
(not my actual token btw)
Cloudflare API token
dns_cloudflare_api_token = 0123456789ABCDEF0123456789ABCDEF01234567
I replaced the token with my Cloudflare token, and it failed. I then tried it again, this time using single quotes around my token, like this:
dns_cloudflare_api_token = '0123456789ABCDEF0123456789ABCDEF01234567'
IT WORKED! I checked the credentials file to verify, and it had:
dns_cloudflare_api_token = \0123456789ABCDEF0123456789ABCDEF01234567\
The weird thing was that my credentials file for my previous certificates that I could not renew did not have any quotes or slashes around the token, but they had worked up until now. Anyway, I thought I would share if anyone else was having the same problem.
@yesid-bocanegra commented on GitHub (Dec 19, 2023):
I had this issue after doing a backup of my folder
dataandletsencrypt. the problem was that I was not aware of the symlinks on the live folder, so after copying back my backup folders I was not able renew the certificates. to fix this problem I had to update the symlinks for every certificate.I decided to create a script to fix it, this script can be executed inside the docker container (haven't tested it from the host), it will search for the most recent certificate in the
archivefolder and create a symlink in thelivefolder pointing to it.afterwards you should be able to execute
certbot renewhttps://gist.github.com/yesid-bocanegra/dfa0cbf0f99a6834340613f43b6610e0
@nsaccente commented on GitHub (Dec 30, 2023):
First time caller, long time listener.
I noticed that the jc21/nginx-full has been deprecated in favor of using nginxproxymanager/nginx-full, although, I'm not sure when it was marked deprecated. Even more damning is the fact that the
developandmasterbranches of this repo's README's both use example docker-compose files that still use thejc21/nginx-proxy-manager:latestimage.Strangely enough, it looks like @jc21's account pushed a new image just 12 hours ago, despite this repo not having seen a commit since last month. Even stranger, is that the new image, nginxproxymanager/nginx-full, hasn't seen an update in 9 months!
I have a faint suspicion that most of the issues folks have had in this thread are due to using the deprecated image, IF it truly is deprecated.
I did try spinning up a container with the following docker-compose, but the container exits with code 0 immediately, so I think the
ENTRYPOINTmay be wrong somewhere.docker-compose.yaml
@etymotic commented on GitHub (Dec 30, 2023):
@nsaccente interesting. I haven't had a chance to play with it, but try
nginxproxymanager/nginx-proxy-manager:latest@nsaccente commented on GitHub (Dec 31, 2023):
@etymotic , I attached my docker-compose contents as a
<details>element; already usingnginxproxymanager/nginx-proxy-manager:latestbut no cigar.@nsaccente commented on GitHub (Dec 31, 2023):
Update, it appears that my ISP has changed my IP, which has been the cause of all my troubles. Updating my domain provider's dns with my new IP did just the trick. I guess I can't put off setting up dyndns any longer 🤷
The error message provided by NPM is... vague at best... misguiding at worst.
Despite this small victory, the following are still true:
nginxproxymanager/nginx-proxy-manager:lateststill exits immediately.jc21/nginx-proxy-manager:latestis the image I got working (however, I'll be pinning to2.9.18, and manually updating image versions)DEPRECATEDsentiment on the jc21 image is ... wrong? It's supposed successor crashes on startup and isn't being regularly builtFor those having trouble with NPM's SSL certification feature, please make certain that the IP of your server is still valid!
@moviemakr1620 commented on GitHub (Jan 15, 2024):
Same here but i want to get a wildcard ssl. doing it this way won't let me.
@smibrandon commented on GitHub (Apr 1, 2024):
I found a fix for my issue: allocating more storage space.
Running NPM in a Proxmox CT (no docker at all), and happened to catch that it was at 96% of its storage. I gave it some extra, and boom. Worked!
@Deses commented on GitHub (Apr 20, 2024):
Look. This might seem silly, but I was also having this problem.
Turns out my problem is that I enabled basic WAF protection in my Cloudflare to block anything not coming from Spain and to block Bots.
Well, obviously that blocked Let's Encrypt bot not residing on Spain. Duh. I disabled the filters and it's now working nicely.
I thought I'd leave my 5 cents here if anyone else has been having problems with this.
@RobustMarker commented on GitHub (Apr 25, 2024):
I had a very similar issue, along with my isp blocking port 80 and not telling me. No wonder i coudnt renew my cert. (im also in spain, maybe isps are renewing security configs?)
Thought id also leave my 5 cents.
@abduroshyd commented on GitHub (May 15, 2024):
Its not worked for me 🥲
@BartAgterbosch commented on GitHub (May 15, 2024):
Did you by any chance disable "Block Common Exploits" before renewing the cert? If not then try that (Also wait an hour or so first if you've been spamming the renew button a lot)
@github-actions[bot] commented on GitHub (Nov 27, 2024):
Issue is now considered stale. If you want to keep it open, please comment 👍
@prom00 commented on GitHub (Nov 27, 2024):
I've been adding multiple domains lately and I didn't have any issues anymore. Seems like this has been fixed or it has fixed itself....
@EDIflyer commented on GitHub (Nov 27, 2024):
The issue for me was always with renewals rather that the initial domain add - #3121 fixes it for me though.
@prom00 commented on GitHub (Nov 27, 2024):
I just successfully (manually) refreshed my certs:
@EDIflyer commented on GitHub (Nov 27, 2024):
Interesting, all with local per site certs as opposed to DNS ones? Certainly when I tried latest recently it still didn't work and I had to rebase my PR onto latest to her it working (the ACME 'well-known' challenge wasn't getting through otherwise.
@prom00 commented on GitHub (Nov 27, 2024):
I used to have issues before too.
Those certs I just renewed are all like this:
subDomainA@domain.com
subDomainB@domain.com
subDomainC@domain.com
subDomainD@domain.com
@fquinto commented on GitHub (Feb 12, 2025):
The problem was with my DNS configuration. I was using a CNAME record, which I changed to an A record. This fixed the issue.
@github-actions[bot] commented on GitHub (Aug 17, 2025):
Issue is now considered stale. If you want to keep it open, please comment 👍
@timnolte commented on GitHub (Aug 17, 2025):
I'm not confident that this is actually fixed yet.
@rodoudcom commented on GitHub (Feb 23, 2026):
Feb 2026