mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-25 01:15:51 +03:00
[GH-ISSUE #2642] Let's Encrypt SSL certificates renewe #1833
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#1833
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @meiro-zz on GitHub (Feb 28, 2023).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2642
Hello,
It looks like too many requests are being sent for certificate renewal.
Port 80 was not enabled in the router, so the requests are bounced. Apparently so many requests went out that after the port was released, the error message below was in the logs.
"Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation
The renewal of the certificate npm-10 failed with an error: Unexpected error while determining the zone identifier for mydom.de: More than 180 requests per minute. Please wait and try again later. Please contact our customer service to find out if the limit of requests can be increased. (4013)"
The message here is in response to a tip from the Unraid forum.
Thanks and greetings
Nginx Proxy Manager Version
v2.9.19
To Reproduce
Steps to reproduce the behavior:
Expected behavior
Renew cert
Operating System
Unraid, Docker
@sebasdt commented on GitHub (Mar 2, 2023):
I can say this is also for when trying to gain a new cert while 80 and 443 ports are open.
System:
docker amd64
with version v2.9.19.
Couldnt get it to work and seems to mee certbot broke.
@AirstarsAsia commented on GitHub (Mar 3, 2023):
I see that NPM has changed the package name From lets-encrypt https://www.npmjs.com/package/letsencrypt
letsencrypt for node is now greenlock.js
I guess this broke stuff.
@sebasdt commented on GitHub (Mar 3, 2023):
Okay great, is there a fix it that we can use now?
I guess renaming the file or what.
Where is it located?
@leonardoangelini commented on GitHub (Mar 3, 2023):
When I try to get the certificate I receive this error
`Error: Command failed: certbot certonly --config "/etc/letsencrypt.ini" --cert-name "npm-23" --agree-tos --authenticator webroot --email "xxx@xxx.xx" --preferred-challenges "dns,http" --domains "aaaaa.bbbb.cc"
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
`
@ckoeber83 commented on GitHub (Mar 3, 2023):
Can you integrate a renewing of certificates automatically when they have a third of their total lifetime left. For Let's Encrypt's current 90-day certificates, that means renewing 30 days before expiration. See https://letsencrypt.org/docs/integration-guide/ for details.
@leonardoangelini commented on GitHub (Mar 3, 2023):
This is for a new certificate:
`
Error: Command failed: certbot certonly --config "/etc/letsencrypt.ini" --cert-name "npm-24" --agree-tos --authenticator webroot --email "xxx@.xxx.xx" --preferred-challenges "dns,http" --domains "aaa.bbb.cc"
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
`
This is letsencrypt.log
2023-03-03 15:10:01,277:DEBUG:certbot._internal.log:Exiting abnormally: Traceback (most recent call last): File "/usr/bin/certbot", line 8, in <module> sys.exit(main()) File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 19, in main return internal_main.main(cli_args) File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 1744, in main return config.func(config, plugins) File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 1591, in certonly lineage = _get_and_save_cert(le_client, config, domains, certname, lineage) File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 141, in _get_and_save_cert lineage = le_client.obtain_and_enroll_certificate(domains, certname) File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 530, in obtain_and_enroll_certificate cert, chain, key, _ = self.obtain_certificate(domains) File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 442, in obtain_certificate orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names) File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 510, in _get_order_and_authorizations authzr = self.auth_handler.handle_authorizations(orderr, self.config, best_effort) File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/auth_handler.py", line 106, in handle_authorizations self._poll_authorizations(authzrs, max_retries, best_effort) File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/auth_handler.py", line 206, in _poll_authorizations raise errors.AuthorizationError('Some challenges have failed.') certbot.errors.AuthorizationError: Some challenges have failed. 2023-03-03 15:10:01,278:ERROR:certbot._internal.log:Some challenges have failed.@bmmmm commented on GitHub (Mar 4, 2023):
This is a core function of nginx proxy manager and was working before like a charm :) it looks like there are some bugs currently around.
At the moment the community is teaming up and looking for workarounds, as developers are currently preparing the new release: https://github.com/NginxProxyManager/nginx-proxy-manager/discussions/1202
My current workaround is, to delete an old cert and create a new one, if you haven't tried.
@GitMeier commented on GitHub (Mar 8, 2023):
Renewing certificates failed for me. I was able to use this:
https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2411
(For now) I replaced the line
image: 'jc21/nginx-proxy-manager:latest'
in my docker-compose.yaml file with
image: 'jc21/nginx-proxy-manager:github-pr-2411'
Certificate renewal worked again after that.
@schumi2004 commented on GitHub (Mar 16, 2023):
You would expect #2411 to be working in latest docker image right?
Since i installed version: v2.9.20 i'm getting this error on renewal:
[3/16/2023] [1:16:08 PM] [Express ] › ⚠ warning invalid signature
QueryBuilder#allowEagermethod is deprecated. You should useallowGraphinstead.allowEagermethod will be removed in 3.0QueryBuilder#eagermethod is deprecated. You should use thewithGraphFetchedmethod instead.eagermethod will be removed in 3.0QueryBuilder#omit is deprecated. This method will be removed in version 3.0
Model#$omit is deprected and will be removed in 3.0.
[3/16/2023] [1:16:31 PM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via TransIP for Cert #1: *.mydomain.com, mydomain.com
[3/16/2023] [1:16:31 PM] [SSL ] › ℹ info Command: certbot renew --config "/etc/letsencrypt.ini" --cert-name "npm-1" --disable-hook-validation --no-random-sleep-on-renew
[3/16/2023] [1:16:32 PM] [Express ] › ⚠ warning Command failed: certbot renew --config "/etc/letsencrypt.ini" --cert-name "npm-1" --disable-hook-validation --no-random-sleep-on-renew
Traceback (most recent call last):
File "/usr/bin/certbot", line 5, in
from certbot.main import main
File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 6, in
from certbot._internal import main as internal_main
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 21, in
import josepy as jose
File "/opt/certbot/lib/python3.7/site-packages/josepy/init.py", line 40, in
from josepy.json_util import (
File "/opt/certbot/lib/python3.7/site-packages/josepy/json_util.py", line 14, in
from OpenSSL import crypto
File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/init.py", line 8, in
from OpenSSL import crypto, SSL
File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/crypto.py", line 1517, in
class X509StoreFlags(object):
File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/crypto.py", line 1537, in X509StoreFlags
CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
/edit:
Reverted back to version 2.19.9 and it seems to be working again.
@instantdreams commented on GitHub (Mar 16, 2023):
I am attempting a DNS challenge with the following settings:
On selecting
Savethe application processes for a while then returns the following error message:I will revert to previous version and test again.
ETA: Reverted to v2.9.19. Generation of certificate worked.
@sebasdt commented on GitHub (Mar 17, 2023):
Sad to see, there must be a version out there that works.
In the meantime I have mirgated to the normal nginx rporxy, someday I will go back to using npm. Sometimes the simplest solution will just works.
@greenfishgit23222 commented on GitHub (Mar 19, 2023):
I have the same problem. Downgrading to other versions doens't work either. A few weeks ago this app worked great now it doesnt anymore.
@kingfisher77 commented on GitHub (Mar 27, 2023):
In a fresh installation, we see this error message by initially setup ACME with Azure dns-challenge:
What could be the cause?
@kingfisher77 commented on GitHub (Mar 27, 2023):
The error appears when i call this part of the pipelline create dns-challenge
from here:
. /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-azure~=1.2.0 && deactivate && certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-0" --agree-tos --email "admin@shift.agency" --domains "*.shift.agency,shift.agency" --authenticator dns-azure --dns-azure-credentials "/etc/letsencrypt/credentials/test.ini"The used Azure credentials works in other environment (pfSense). But by then the process won't even get there.
@github-actions[bot] commented on GitHub (Jan 27, 2024):
Issue is now considered stale. If you want to keep it open, please comment 👍
@ckoeber83 commented on GitHub (Jan 27, 2024):
Glad,
Can confirm that SSL renewing ist back working 👍🏻
Thanks in advance 👍🏻
@github-actions[bot] commented on GitHub (Nov 14, 2024):
Issue is now considered stale. If you want to keep it open, please comment 👍
@github-actions[bot] commented on GitHub (Dec 1, 2025):
Issue was closed due to inactivity.