mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-25 09:25:55 +03:00
[GH-ISSUE #2713] SSL/Let's encrypt not working anymore after update or any other version #1872
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#1872
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @greenfishgit23222 on GitHub (Mar 19, 2023).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2713
Checklist
jc21/nginx-proxy-manager:latestdocker image?Describe the bug
Recieved an email from let's encrypt I had to update my ssl certiface. Went into nginx proxy manger, cert renewal, got internal error, saw something about cerbot failure. Saw on this forum a lot of users had similar issues. Tried reverting to older versions but still the same error. Have tried to re-install/delete everything from scratch but ssl cert fails everytime. I'm not adapt at all when it comes to ssl/reverse proxy but so far nginx proxy manager was the only solution working for me a few months ago with reverse proxy. Now i'm at a total loss what to do.
Error: Command failed: certbot certonly --config "/etc/letsencrypt.ini" --cert-name "npm-2" --agree-tos --authenticator webroot --email "admindfdfdf@tutanota.com" --preferred-challenges "dns,http" --domains "phofsddd.duckdns.org"
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
Nginx Proxy Manager Version
2.9.21
2.9.20
2.9.19
@riddertommie commented on GitHub (Mar 19, 2023):
Same here.
Let me know if i can do/test/provide something.
Working with docker version v2.9.21
@greenfishgit23222 commented on GitHub (Mar 19, 2023):
After 5 hours of headache I managed to finally get the ssl up and running again!!!
But after 30-60 days when let's encrypt needs renewal i'm afraid this headache will start again because renew ssl doesnt work for me on any of the versions. I have to delete the entire container+config and start from scratch.
What worked for me and it's something I never used before is you go into the category create ssl-certificates, add dns-challenge (new for me) and choose your dns provider and provide your token. Then add your host and point your ssl to your newly created ssl certificate. This only works for me on 2.9.19.
Steps that worked for me
I used this docker-compose-yml
version: '3'
services:
app:
image: 'jc21/nginx-proxy-manager:github-pr-2411'
restart: unless-stopped
ports:
- '80:80'
- '81:81'
- '443:443'
volumes:
- ./data:/data
- ./letsencrypt:/etc/letsencrypt
@jc21 commented on GitHub (Mar 19, 2023):
I can confirm that using 2.9.21 works perfectly fine when requesting a SSL cert using HTTP method just fine, as long as your DNS settings for the domain requesting point directly to NPM.
I can also confirm that manual renewal of this certificate also works fine, as long as that the proxy host for it still exists.
@riddertommie commented on GitHub (Mar 20, 2023):
Hi, it's still not working for me.
I'm investigating a bit but can't figure it out, help is appreciated.
I have several certificates running and the existing ones work just fine and follow the same configuration and hardware as the ones that have expired and I can't renew.
But I can't manage to request new ones or redo old ones (i did to many request now so i have to wait until tomorrow i think to check again).
At first I thought it might have to do with pi-hole but my server ignores that and when I turn off pi-hole it doesn't work either. Could it be that the requests are coming through ipv6 and I haven't configured that? I'm using
DISABLE_IPV6: 'true'I just don't understand the necessity of -Use a DNS challenge- I use stator as a provider, is this necessary?
I'm a bit stuck. any help is welcome.
Thanks!
Short update, if i press a still working url within NPM is going fine if i do 'test server reach-ability' i get
@EDIflyer commented on GitHub (Mar 20, 2023):
Thanks @jc21 - sounds good. Does that mean it should have fixed the issues raised in https://github.com/NginxProxyManager/nginx-proxy-manager/issues/396 too? It's just I'm still seeing those renewal errors on some sites...
@renan-infonacci commented on GitHub (Mar 22, 2023):
I'm having the same problem to revalidate the certificate, I already went back to the version mentioned above and I still couldn't validate it.
What I'm not getting is the DNS + Token to place and generate the certificate, where do I find this within Cloudflare?
@themegabyte commented on GitHub (Mar 25, 2023):
@EDIflyer Worth checking
/var/log/letsencrypt.logby doing:inside the docker container.
@EDIflyer commented on GitHub (Mar 25, 2023):
Thanks @themegabyte - had a look and it seems to have a few attempts that show as pending before it returns an invalid:
The weird thing is if I delete and recreate it then it seems to work OK, at least until it is due for renewal. I can provide more log file info if helpful (not sure if there are any other more relevant bits I've missed).
UPDATE: From searching open issues I see lots of others with similar problems: https://github.com/NginxProxyManager/nginx-proxy-manager/issues?q=%22The+Certificate+Authority+failed+to+download+the+temporary+challenge+files+created+by+Certbot%22+
In particular #2258 #1625 #2565 seem to confirm an issue with 'force SSL' not letting the LetsEncrypt SSL renewal through on port 80. PR #2038 seems to be a fix but hasn't been merged - @jc21 not sure if you would be able to consider that?
I've now manually gone through each of the 8 proxy hosts (thankfully not as many on this server!) and switched off 'force SSL'. When I tried to renew I got the 'another instance of certbot is already running' error (see #918), despite nothing obviously being in progress. I then ran
find / -type f -name ".certbot.lock" -exec rm {} \;and then finally managed to manually renew each certificate via the SSL page on the NPM frontend. So it's great that it has worked for another 3 months, but clearly quite a hassle to have to keep doing it this way and I'd prefer to be able to leave 'force SSL' set to on.@themegabyte commented on GitHub (Mar 25, 2023):
Thank you for posting @EDIflyer. I had the exact same issue,
Timeout during connect. I had to disable my hosts to get the auto renew to work. It worked smoothly but manually.I manually tried to access
/.well-known/acme-challenge/, and I saw that it was redirecting towards my drone CI container instead of whatever it was supposed to go to (this could be wrong way to test, however, as certbot doesn't place the files for that long to test I think...).However, I had another version working on a separate production server and I saw no issues there... I will report back with more data if I have.
@sanderlv commented on GitHub (Apr 1, 2023):
I may not swear! But FFS, I have this issue.
Error: Command failed: certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-39" --agree-tos --authenticator webroot --email "mail@domain.com" --preferred-challenges "dns,http" --domains "mail.domain.com"
Saving debug log to /tmp/letsencrypt-log/letsencrypt.log
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details.
I had this with 2.9.19 and still when I pulled 2.10.2
Now I cannot renew any domain anymore!
HELP is very much appreciated and needed!
I tried normal challenge and (new?) dns challenge (but not sure if I did that right since I use a *.domain.com dyn dns with Joker)
It always worked well and I also managed to create around 30 certs succesfully
HELP
Some more logging:
EDIT:
Any renewal gives me:
Any creation gives me above error...
This is a major issue
@EDIflyer commented on GitHub (Apr 1, 2023):
@sanderlv see my post above - the workaround that did the trick for me was running the command within the container to kill off duplicate certbot instances/locks and then switching off force SSL before trying to renew the certificate. I see @jc21 has made quite a few commits recently so I'm hoping this SSL cert renewal might get fixed soon 🤞
@sanderlv commented on GitHub (Apr 1, 2023):
I have the certificate not connected to a proxy host, just trying to create it...?
Is it also fine to reboot the container or is it still having duplicate instances?
@sanderlv commented on GitHub (Apr 1, 2023):
I tried your command:
But no luck either...
But what's even more weird is that the console gives:
And the interface gives:
What's not ok here?
@EDIflyer commented on GitHub (Apr 1, 2023):
Hmm, getting outside what I understand now I'm afraid! I'd have thought definitely worth a container reboot attempt given that difference in version info. I tend to just automatically make the SSL cert when creating the proxy host.
@sanderlv commented on GitHub (Apr 1, 2023):
Rebooting does not help in getting the right version "in the container"...
@sanderlv commented on GitHub (Apr 1, 2023):
Thats does not work either... So frustrating... all my domains will soon expire...
@sanderlv commented on GitHub (Apr 1, 2023):
Created a wildcard DNS via joker, that works ....
@andzejsp commented on GitHub (Apr 5, 2023):
fresh install, 0 domains, add one, tried to add cert, fails as above...
Good thing i still havent updated my stack from 2022 last year, it works there but now on fresh install..
And i thought i messed up something.
Somebody has to look into this. Im not the only one.
If anyone has any solution please @ me.
@greenfishgit22 commented on GitHub (Apr 7, 2023):
Jesus christ.... same crap again... I had to renew ssl certificate and voila "internal error".
@sanderlv commented on GitHub (Apr 7, 2023):
I know, it s@cks. But luckily the dns one via joker does work.
@EDIflyer commented on GitHub (Apr 7, 2023):
Do you mean via DNS challenge? - AIUI that's only an option if your DNS provider is one of the ones listed though? (mine isn't)
@sanderlv commented on GitHub (Apr 7, 2023):
Yes and yes and that's a pity...
@greenfishgit22 commented on GitHub (Apr 7, 2023):
Yeah thanks but i'm using duckdns and noip, not willing to change DNS provider because of this issue.
I really like nginx proxy manager but this happens way to frequently in my opinion.
@sanderlv commented on GitHub (Apr 7, 2023):
I agree. I am just lucky at this moment...
@smailpouri commented on GitHub (Apr 28, 2023):
same issue on Docker 4.18 macOS ventura 13.3.1 nginx 2.9.19 and 2.9.20(21,22) and 2.10.2.
Not sure what is going, been looking into Traefik
@plexecutor commented on GitHub (May 2, 2023):
I was having the same issue where 'Test Server Reachability' was saying 'Communication with the API failed, is NPM running correctly?'. I use DuckDNS and verified that I had everything configured correctly. What I ended up doing was just using DNS Challenge and choosing DuckDNS and providing my token. No issues requesting/renewing certs now.
@andzejsp commented on GitHub (May 2, 2023):
But this don't help people who don't have ducks.
@plexecutor commented on GitHub (May 2, 2023):
True, but there is a very large list of DNS provider plugins support by NPM. If yours is supported, I would try that method.
@erzwo commented on GitHub (May 10, 2023):
same problem for me. I can't renew or create a new certificate. probably related to this
@rafalohaki commented on GitHub (May 10, 2023):
same
@f2ka07 commented on GitHub (May 28, 2023):
Here is a guide on how to successfully install Lets Encrypt on Nginx Proxy Manager to secure your docker containers.
@ajy2 commented on GitHub (May 31, 2023):
still same here
@f2ka07 in your video, it has no errors like above
@greenfishgit22 commented on GitHub (May 31, 2023):
This app is dead. So many ssl issues that comes out of nowhere. I went with caddy april 7th and never had any issues.
@andzejsp commented on GitHub (May 31, 2023):
Can you pm me the caddy solution? I need auto renewval
@MikeTraceur commented on GitHub (Jul 18, 2023):
Is there any update to this bug? I am facing the same problem with the latest release? Any downgraded Version where this bug does not appear?
@EDIflyer commented on GitHub (Jul 18, 2023):
Sadly not that I've found, I just use the workaround of switching off SSL, renewing then re-enabling. It does get a bit annoying having to do it for 16 sites every few months though!
@MikeTraceur commented on GitHub (Jul 19, 2023):
I was currently trying the workaround because my certificates should expire july 25. But I decided to look them up before. Surprisingly it renewed them. So what is different to the state I had until yesterday? I moved from latest to 2.9.21 and under volumes I added
Since the docker container was in a different timezone than the docker host. Maybe this helps finding a solution.
@andzejsp commented on GitHub (Jul 19, 2023):
does it work on latest tho?
@rightsaidfred99 commented on GitHub (Jul 23, 2023):
I gave up on this bug. best to freeze nginx at 2.9.14 and have been doing this for a year and auto ssl renewal works perfectly. cons, but it's unpatched and a security risk so keep it away from the internet.
@Watever44 commented on GitHub (Aug 8, 2023):
I am having the same issue. I didn't realise the problem a few weeks ago when I had to renew manually. After unraid update to 6.12.
Now I am trying to get a new certificate and I can't make it work. No idea how to fix it.
Does I really need to go back ? in the docker container or unraid os ?
@rightsaidfred99 commented on GitHub (Aug 8, 2023):
Yes, it just works perfectly if you go back.
@Watever44 commented on GitHub (Aug 9, 2023):
I will try to go back. I didn't fix the certificate creation or renew, but it's weird that my reverse proxy is "working" today, without changing anything since yesterday, without the proper SSL, using the wildcard certificate probably.
May be cause when I tried yesterday, cloudflare didn't publish it and it took longer than usually ? many hours ?
Also, I taught the wildcard certificate would only work locally... ?
Theses are the only certificate I have. As you can see, the wildcard use cloudflare, not the others but all are working.
@Matze177 commented on GitHub (Sep 5, 2023):
Thanks for the tip, that worked for me too. But why?
@EDIflyer commented on GitHub (Sep 5, 2023):
See my PR - https://github.com/NginxProxyManager/nginx-proxy-manager/pull/3121 - it's to do with how the Let's Encrypt ACME check is being dealt with.
@Collin7 commented on GitHub (Sep 20, 2023):
Also having an issue with renew on latest and older versions
Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --preferred-challenges "dns,http" --disable-hook-validation
Traceback (most recent call last):
File "/usr/bin/certbot", line 5, in
from certbot.main import main
File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 6, in
from certbot._internal import main as internal_main
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 28, in
from certbot import crypto_util
File "/opt/certbot/lib/python3.7/site-packages/certbot/crypto_util.py", line 42, in
from certbot import interfaces
File "/opt/certbot/lib/python3.7/site-packages/certbot/interfaces.py", line 21, in
from acme.client import ClientBase
ImportError: cannot import name 'ClientBase' from 'acme.client' (/opt/certbot/lib/python3.7/site-packages/acme/client.py)
at ChildProcess.exithandler (node:child_process:402:12)
at ChildProcess.emit (node:events:513:28)
at maybeClose (node:internal/child_process:1100:16)
at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)
@oswaldo-be commented on GitHub (Oct 8, 2023):
I also got the same problem and deactivating Force SSL and renewing works.
Then I just activate force SSL again.
But this cannot stay unrepaired
at ChildProcess.exithandler (node:child_process:402:12)
at ChildProcess.emit (node:events:513:28)
at maybeClose (node:internal/child_process:1100:16)
at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)
[10/8/2023] [2:01:59 AM] [SSL ] › ℹ info Renewing SSL certs close to expiry...
[10/8/2023] [2:06:37 AM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --preferred-challenges "dns,http" --disable-hook-validation
Failed to renew certificate npm-1 with error: Some challenges have failed.
All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/npm-1/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
v2.10.4
@EDIflyer commented on GitHub (Oct 8, 2023):
@oswaldo-be did my PR above work for you? It still seems to be doing the trick on my system.
@oswaldo-be commented on GitHub (Oct 8, 2023):
jupp, deactivating, renewing und activating works.
But this here won't
with "docker exec "Containername" find / -type f -name ".certbot.lock""
I get
find: '/proc/tty/driver': Permission denied
find: '/sys/kernel/debug': Permission denied
@EDIflyer commented on GitHub (Oct 8, 2023):
Interesting, I've normally run it as commands directly within the container on Portainer and it worked OK, I'm guessing it must be giving higher permissions.
There's a link above to my PR that fixes the underlying issue that seems to work so might be worth a shot too?
@jdelgadocr commented on GitHub (Oct 9, 2023):
I was also getting the "import ClientBase" error with namecheap DNS. Strangely it worked 2 hours earlier with namecheap and another provider, several domains. Fresh, latest NPM install. I got it fixed by running (in a container-attached console):
pip install certbot
pip install acme
pip install certbot-dns-namecheap
That was all and then it worked as before/expected.
@dezza commented on GitHub (Dec 29, 2023):
I just deleted the SSL certificate entry and redid it, seems like its sticking to an old format.
@andzejsp commented on GitHub (Dec 29, 2023):
guys, stop wasting time on nginx, its garbage. Use caddy instead. Ive moved to caddy and i can forget about certs, because caddy does them automagically. No more "your certs are expiring in few days, please renew" bs. Caddy is lw, Easy to use with a single file where you define every service you have, and thats it. The configuration is easy to understand. Yes, caddy does not have fancy UI, but you just need to set up a service once and forget about it.
@sanderlv commented on GitHub (Dec 29, 2023):
"Caddy" gives me a lot of options on google... what are you referring to? A docker container? Other? Is it free, paid, maintained?
Questions...
@rightsaidfred99 commented on GitHub (Dec 29, 2023):
caddy is terrible for newbies. whoss got 4 weeks to read an encyclopedia on how to write a caddyfile
@andzejsp commented on GitHub (Dec 29, 2023):
https://github.com/caddyserver/caddy free, open source, maintained. I run it in docker container
@andzejsp commented on GitHub (Dec 29, 2023):
brugh, im a noob, if i could do it so can other noobs. NGINX is no easier, it has more confusing syntax for configuration than caddy. If you need help you can pm me
@rightsaidfred99 commented on GitHub (Dec 29, 2023):
Fair enough, I'll give it a go. nginx proxy manager is likely to be insecure nowadays anyway as there are so many issues open and slow updates to resolve issues for the plague of ssl issues.
you're right, it might be worth it.
@dezza commented on GitHub (Dec 29, 2023):
Have you guys noticed you're on github in the issue section and not reddit?
@rightsaidfred99 commented on GitHub (Dec 29, 2023):
yeah, and the resolution is not use proxy manager anymore as discussed
@dezza commented on GitHub (Dec 29, 2023):
No maybe the solution is to go buy some webhosting at godaddy.com if you can't appreciate the time others use to concern themselves with your issues and provide support and just resort to flinging shit like you're on reddit.
@Heggeg commented on GitHub (Apr 18, 2024):
I now seem to have the same problem. How do I fix it?
@dezza commented on GitHub (Apr 18, 2024):
I figured out that you need to disable "Force SSL" from the webui if you want the automatic renewal to work as it seems to request over http.
Try that if you have it.
@EDIflyer commented on GitHub (Apr 18, 2024):
@Heggeg feel free to try my PR at https://github.com/NginxProxyManager/nginx-proxy-manager/pull/3121 - it amends the https redirect to allow the Acme check through on http as @dezza says.
@mikkel75 commented on GitHub (Aug 16, 2024):
Where exactly did you do the "Force-SSL" trick/workaround?
Thanks
@dezza commented on GitHub (Aug 16, 2024):
@mikkel75 inverse, you need to keep Force SSL off for it to work this is the issue..
I hope @EDIflyer 's PR gets merged soon, fingers crossed..
@mikkel75 commented on GitHub (Aug 16, 2024):
Hi,
The certbot command fails for me - any suggestions?
I'm guessing the /tmp/letsencrypt-log/letsencrypt.log is inside a container or something - I can't see it from normal terminal.
Thanks.
@cnsxxx09 commented on GitHub (Nov 24, 2024):
For those asking how to remove the Force SSL off, it also took me a while to find it.
Under Add-Ons --> Nginx Proxy Manager
there is a link to the right 'Open Web UI' which you need to click.
Then click on Hosts-->Proxy Hosts ... then the 3 dots and Edit ... then SSL Tab
Then go back to the Dashboard, SSL Certificates, the 3 dots and then Renew Now.
Thanks to all the previous posts here - I iust did this indeed and it worked.
:-)
@EDIflyer commented on GitHub (Nov 24, 2024):
Glad that worked for you @cnsxxx09 - if you don't want the hassle of switching force SSL off and just letting it autorenew then you can use the docker version from my PR at https://github.com/NginxProxyManager/nginx-proxy-manager/pull/3121
@hulkhaugen commented on GitHub (Nov 26, 2024):
You're obviously using the HA add-on, same as me. Did it work for you? I just stumbled into this issue myself after not having it before. I currently have 12 proxy hosts and 1 redirection host. I disabled all but the main one, and disabled force SSL for that one. Still no joy.
EDIT: I only use one certificate for all the proxy hosts, and always have.
FINAL EDIT: Yay, i finally figured it out after spending a whole day on this, just about to give up. I had to log into Cloudflare as I use that for DNS Records. Had to change the Proxy status for my A-record from
ProxiedtoDNS only, manually renew, then change it back toProxied.@github-actions[bot] commented on GitHub (Jun 12, 2025):
Issue is now considered stale. If you want to keep it open, please comment 👍
@EDIflyer commented on GitHub (Jun 12, 2025):
Not stale, still awaiting #3121 to be merged in.
@github-actions[bot] commented on GitHub (Jan 25, 2026):
Issue is now considered stale. If you want to keep it open, please comment 👍
@EDIflyer commented on GitHub (Jan 25, 2026):
Not stale, still awaiting #3121 to be merged in.