[GH-ISSUE #2776] DNS Challenge Azure failing #1906

Closed
opened 2026-02-26 07:33:10 +03:00 by kerem · 18 comments
Owner

Originally created by @kingfisher77 on GitHub (Mar 29, 2023).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2776

Checklist

  • Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
    • Yes
  • Are you sure you're not using someone else's docker image?
    • Yes
  • Have you searched for similar issues (both open and closed)?
    • Yes

Describe the bug

DNS challenge with Azure DNS fails.

warning   Command failed: . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-azure~=1.2.0  && deactivate
nginx-proxy-nginx-proxy-1  | ERROR: Will not install to the user site because it will lack sys.path precedence to cryptography in /opt/certbot/lib/python3.7/site-packages

Nginx Proxy Manager Version

2.10.0 - 2.10.1

In Version 2.9.22 the error is a different one:

AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

To Reproduce
Steps to reproduce the behavior:

  1. Go to SSL Certificates
  2. Click on Add SSL Certificate/Let's Encrypt
  3. Choose DNS Challenge/Azure
  4. Give Domain Name and Credentials for Azure
  5. Press Save

Expected behavior

Procede like usual to generate Certificates

Screenshots

Operating System

Additional context

Originally created by @kingfisher77 on GitHub (Mar 29, 2023). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2776 <!-- Are you in the right place? - If you are looking for support on how to get your upstream server forwarding, please consider asking the community on Reddit. - If you are writing code changes to contribute and need to ask about the internals of the software, Gitter is the best place to ask. - If you think you found a bug with NPM (not Nginx, or your upstream server or MySql) then you are in the *right place.* --> **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes **Describe the bug** <!-- A clear and concise description of what the bug is. --> DNS challenge with Azure DNS fails. ``` warning Command failed: . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-azure~=1.2.0 && deactivate nginx-proxy-nginx-proxy-1 | ERROR: Will not install to the user site because it will lack sys.path precedence to cryptography in /opt/certbot/lib/python3.7/site-packages ``` **Nginx Proxy Manager Version** <!-- What version of Nginx Proxy Manager is reported on the login page? --> 2.10.0 - 2.10.1 In Version 2.9.22 the error is a different one: ``` AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK' ``` **To Reproduce** Steps to reproduce the behavior: 1. Go to SSL Certificates 2. Click on Add SSL Certificate/Let's Encrypt 3. Choose DNS Challenge/Azure 4. Give Domain Name and Credentials for Azure 5. Press Save **Expected behavior** <!-- A clear and concise description of what you expected to happen. --> Procede like usual to generate Certificates **Screenshots** <!-- If applicable, add screenshots to help explain your problem. --> **Operating System** <!-- Please specify if using a Rpi, Mac, orchestration tool or any other setups that might affect the reproduction of this error. --> **Additional context** <!-- Add any other context about the problem here, docker version, browser version, logs if applicable to the problem. Too much info is better than too little. -->
kerem 2026-02-26 07:33:10 +03:00
  • closed this issue
  • added the
    stale
    bug
    labels
Author
Owner

@Schmackos commented on GitHub (Mar 31, 2023):

Experience the same issue on 2.10.1. Resulting in not being able to login and high CPU load (due to the container constantly trying to upgrade).

[Migrate ] › ℹ info Current database version: 20211108145214
[Global ] › ✖ error Command failed: . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-transip~=0.4.3 && deactivate
ERROR: Will not install to the user site because it will lack sys.path precedence to cryptography in /opt/certbot/lib/python3.7/site-packages

<!-- gh-comment-id:1491880216 --> @Schmackos commented on GitHub (Mar 31, 2023): Experience the same issue on 2.10.1. Resulting in not being able to login and high CPU load (due to the container constantly trying to upgrade). [Migrate ] › ℹ info Current database version: 20211108145214 [Global ] › ✖ error Command failed: . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-transip~=0.4.3 && deactivate ERROR: Will not install to the user site because it will lack sys.path precedence to cryptography in /opt/certbot/lib/python3.7/site-packages
Author
Owner

@RafaelSchridi commented on GitHub (Apr 1, 2023):

I get the same thing with transip

[4/1/2023] [10:05:12 PM] [Global   ] › ✖  error     Command failed: . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-transip~=0.4.3  && deactivate
ERROR: Will not install to the user site because it will lack sys.path precedence to cryptography in /opt/certbot/lib/python3.7/site-packages
<!-- gh-comment-id:1493138551 --> @RafaelSchridi commented on GitHub (Apr 1, 2023): I get the same thing with transip ```logs [4/1/2023] [10:05:12 PM] [Global ] › ✖ error Command failed: . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-transip~=0.4.3 && deactivate ERROR: Will not install to the user site because it will lack sys.path precedence to cryptography in /opt/certbot/lib/python3.7/site-packages ```
Author
Owner

@M1chka commented on GitHub (Apr 6, 2023):

I fixed it this way:

# docker exec -it CONTAINERID sh
# apt update
# apt install build-essential libssl-dev libffi-dev python3-dev
# . /opt/certbot/bin/activate
# rm -rf /opt/eff.org/*
# pip install -U certbot
# pip install cryptography==3.4.3

<!-- gh-comment-id:1498955174 --> @M1chka commented on GitHub (Apr 6, 2023): I fixed it this way: ``` # docker exec -it CONTAINERID sh # apt update # apt install build-essential libssl-dev libffi-dev python3-dev # . /opt/certbot/bin/activate # rm -rf /opt/eff.org/* # pip install -U certbot # pip install cryptography==3.4.3 ```
Author
Owner

@kingfisher77 commented on GitHub (Apr 6, 2023):

Next time you refresh the container, its gone

<!-- gh-comment-id:1499021127 --> @kingfisher77 commented on GitHub (Apr 6, 2023): Next time you refresh the container, its gone
Author
Owner

@Schmackos commented on GitHub (Apr 16, 2023):

Agreed, but at least a work around for now, until this gets resolved.

<!-- gh-comment-id:1510473579 --> @Schmackos commented on GitHub (Apr 16, 2023): Agreed, but at least a work around for now, until this gets resolved.
Author
Owner

@kingfisher77 commented on GitHub (May 11, 2023):

Since a proxy is mission critical for us, we took a closer look at traefik. Really nice! The learning curve is a bit higher, but in the end it is transparent and simple. And very flexible! Good by NPM - it was nice but too buggy ;-)

<!-- gh-comment-id:1543423644 --> @kingfisher77 commented on GitHub (May 11, 2023): Since a proxy is mission critical for us, we took a closer look at traefik. Really nice! The learning curve is a bit higher, but in the end it is transparent and simple. And very flexible! Good by NPM - it was nice but too buggy ;-)
Author
Owner

@RafaelSchridi commented on GitHub (May 11, 2023):

Since a proxy is mission critical for us, we took a closer look at traefik. Really nice! The learning curve is a bit higher, but in the end it is transparent and simple. And very flexible! Good by NPM - it was nice but too buggy ;-)

After waiting a full year for the access list to get fixed, and now this, I think it's time for me to look at at Traefik too. I picked NPM for it simplicity but I really need stability now.

<!-- gh-comment-id:1543600262 --> @RafaelSchridi commented on GitHub (May 11, 2023): > Since a proxy is mission critical for us, we took a closer look at traefik. Really nice! The learning curve is a bit higher, but in the end it is transparent and simple. And very flexible! Good by NPM - it was nice but too buggy ;-) After waiting a full year for the access list to get fixed, and now this, I think it's time for me to look at at Traefik too. I picked NPM for it simplicity but I really need stability now.
Author
Owner

@tiny656 commented on GitHub (May 16, 2023):

Since a proxy is mission critical for us, we took a closer look at traefik. Really nice! The learning curve is a bit higher, but in the end it is transparent and simple. And very flexible! Good by NPM - it was nice but too buggy ;-)

After waiting a full year for the access list to get fixed, and now this, I think it's time for me to look at at Traefik too. I picked NPM for it simplicity but I really need stability now.

@RafaelSchridi , here is my practice, use https://github.com/acmesh-official/acme.sh to issue and renew cert automatically, and create soft link for cert from acme.sh publish folder into ~/nginx-proxy-manager/data/custom_ssl/npm-2 folder.

basically, custom ssl use delegate way by acme.sh to provide.
for acme.sh example, my case uses Azure DNS, you can check my docker-compose file here.

<!-- gh-comment-id:1549403227 --> @tiny656 commented on GitHub (May 16, 2023): > > Since a proxy is mission critical for us, we took a closer look at traefik. Really nice! The learning curve is a bit higher, but in the end it is transparent and simple. And very flexible! Good by NPM - it was nice but too buggy ;-) > > After waiting a full year for the access list to get fixed, and now this, I think it's time for me to look at at Traefik too. I picked NPM for it simplicity but I really need stability now. @RafaelSchridi , here is my practice, use https://github.com/acmesh-official/acme.sh to issue and renew cert automatically, and create soft link for cert from acme.sh publish folder into ~/nginx-proxy-manager/data/custom_ssl/npm-2 folder. basically, custom ssl use delegate way by acme.sh to provide. for acme.sh example, my case uses Azure DNS, you can check my docker-compose file [here](https://github.com/tiny656/docker-composes/blob/main/acme.sh/docker-compose.yml).
Author
Owner

@KRGT-NL commented on GitHub (Jun 4, 2023):

I fixed it this way:

# docker exec -it CONTAINERID sh
# apt update
# apt install build-essential libssl-dev libffi-dev python3-dev
# . /opt/certbot/bin/activate
# rm -rf /opt/eff.org/*
# pip install -U certbot
# pip install cryptography==3.4.3

With this I have my workaround for DNS challenge with in my case TransIP.

When will this bug be fixed? I really like NPM! @jc21

<!-- gh-comment-id:1575652915 --> @KRGT-NL commented on GitHub (Jun 4, 2023): > I fixed it this way: > > ``` > # docker exec -it CONTAINERID sh > # apt update > # apt install build-essential libssl-dev libffi-dev python3-dev > # . /opt/certbot/bin/activate > # rm -rf /opt/eff.org/* > # pip install -U certbot > # pip install cryptography==3.4.3 > ``` With this I have my workaround for DNS challenge with in my case TransIP. When will this bug be fixed? I really like NPM! @jc21
Author
Owner

@kingfisher77 commented on GitHub (Jun 4, 2023):

Continue to https://doc.traefik.io/traefik/getting-started/install-traefik This is really a much nicer concept and the quality of the software is not comparable - much more stable. The dynamic configuration is tremendous! I have made the move and do not regret it.

<!-- gh-comment-id:1575654438 --> @kingfisher77 commented on GitHub (Jun 4, 2023): Continue to https://doc.traefik.io/traefik/getting-started/install-traefik This is really a much nicer concept and the quality of the software is not comparable - much more stable. The dynamic configuration is tremendous! I have made the move and do not regret it.
Author
Owner

@RafaelSchridi commented on GitHub (Jun 28, 2023):

I fixed it this way:

# docker exec -it CONTAINERID sh
# apt update
# apt install build-essential libssl-dev libffi-dev python3-dev
# . /opt/certbot/bin/activate
# rm -rf /opt/eff.org/*
# pip install -U certbot
# pip install cryptography==3.4.3

This was working fine until I got an email from letsencrypt today saying my domains are expiring in 20 days.

[6/28/2023] [8:01:23 PM] [SSL      ] › ✖  error     Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --preferred-challenges "dns,http" --disable-hook-validation  
Renewal configuration file /etc/letsencrypt/renewal/npm-11.conf (cert: npm-11) produced an unexpected error: 'Namespace' object has no attribute 'dns_transip_propagation_seconds'. Skipping.
Renewal configuration file /etc/letsencrypt/renewal/npm-6.conf (cert: npm-6) produced an unexpected error: 'Namespace' object has no attribute 'dns_transip_credentials'. Skipping.0 renew failure(s), 2 parse failure(s)

    at ChildProcess.exithandler (node:child_process:402:12)
    at ChildProcess.emit (node:events:513:28)
    at maybeClose (node:internal/child_process:1100:16)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)

No idea what changed, guess I've got a deadline on my traefik switch

<!-- gh-comment-id:1612058717 --> @RafaelSchridi commented on GitHub (Jun 28, 2023): > I fixed it this way: > > ``` > # docker exec -it CONTAINERID sh > # apt update > # apt install build-essential libssl-dev libffi-dev python3-dev > # . /opt/certbot/bin/activate > # rm -rf /opt/eff.org/* > # pip install -U certbot > # pip install cryptography==3.4.3 > ``` This was working fine until I got an email from letsencrypt today saying my domains are expiring in 20 days. ```bash [6/28/2023] [8:01:23 PM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --preferred-challenges "dns,http" --disable-hook-validation Renewal configuration file /etc/letsencrypt/renewal/npm-11.conf (cert: npm-11) produced an unexpected error: 'Namespace' object has no attribute 'dns_transip_propagation_seconds'. Skipping. Renewal configuration file /etc/letsencrypt/renewal/npm-6.conf (cert: npm-6) produced an unexpected error: 'Namespace' object has no attribute 'dns_transip_credentials'. Skipping.0 renew failure(s), 2 parse failure(s) at ChildProcess.exithandler (node:child_process:402:12) at ChildProcess.emit (node:events:513:28) at maybeClose (node:internal/child_process:1100:16) at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5) ``` No idea what changed, guess I've got a deadline on my traefik switch
Author
Owner

@kingfisher77 commented on GitHub (Jun 29, 2023):

I am extremely happy with traefik.

<!-- gh-comment-id:1612510768 --> @kingfisher77 commented on GitHub (Jun 29, 2023): I am extremely happy with traefik.
Author
Owner

@JDunnio commented on GitHub (Jul 19, 2023):

Experiencing the same when renewing cert with TransIP DNS challenge. Please fix this.

@RafaelSchridi, tnx for this. This worked. Seams like this is an outdated component?

[7/19/2023] [10:49:03 AM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via TransIP for Cert #7: *.DOMAIN.EXT
[7/19/2023] [10:49:03 AM] [SSL ] › ℹ info Command: certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-7" --disable-hook-validation --no-random-sleep-on-renew
[7/19/2023] [10:49:03 AM] [Express ] › ⚠ warning Command failed: certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-7" --disable-hook-validation --no-random-sleep-on-renew
Traceback (most recent call last):
File "/usr/bin/certbot", line 5, in
from certbot.main import main
File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 6, in
from certbot._internal import main as internal_main
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 21, in
import josepy as jose
File "/opt/certbot/lib/python3.7/site-packages/josepy/init.py", line 40, in
from josepy.json_util import (
File "/opt/certbot/lib/python3.7/site-packages/josepy/json_util.py", line 14, in
from OpenSSL import crypto
File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/init.py", line 8, in
from OpenSSL import crypto, SSL
File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/crypto.py", line 1517, in
class X509StoreFlags(object):
File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/crypto.py", line 1537, in X509StoreFlags
CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

<!-- gh-comment-id:1641869796 --> @JDunnio commented on GitHub (Jul 19, 2023): Experiencing the same when renewing cert with TransIP DNS challenge. Please fix this. @RafaelSchridi, tnx for this. This worked. Seams like this is an outdated component? [7/19/2023] [10:49:03 AM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via TransIP for Cert #7: *.DOMAIN.EXT [7/19/2023] [10:49:03 AM] [SSL ] › ℹ info Command: certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-7" --disable-hook-validation --no-random-sleep-on-renew [7/19/2023] [10:49:03 AM] [Express ] › ⚠ warning Command failed: certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-7" --disable-hook-validation --no-random-sleep-on-renew Traceback (most recent call last): File "/usr/bin/certbot", line 5, in <module> from certbot.main import main File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 6, in <module> from certbot._internal import main as internal_main File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 21, in <module> import josepy as jose File "/opt/certbot/lib/python3.7/site-packages/josepy/__init__.py", line 40, in <module> from josepy.json_util import ( File "/opt/certbot/lib/python3.7/site-packages/josepy/json_util.py", line 14, in <module> from OpenSSL import crypto File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/__init__.py", line 8, in <module> from OpenSSL import crypto, SSL File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/crypto.py", line 1517, in <module> class X509StoreFlags(object): File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/crypto.py", line 1537, in X509StoreFlags CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
Author
Owner

@Schmackos commented on GitHub (Jul 19, 2023):

Still broken on my side and hard to understand why this is not flagged as a priority bug? It has been 2 Months without any confirmation or comms. Dont want to migrate away from NPM, but starting to look at other options as I am losing the trust this will be addressed.

<!-- gh-comment-id:1641940341 --> @Schmackos commented on GitHub (Jul 19, 2023): Still broken on my side and hard to understand why this is not flagged as a priority bug? It has been 2 Months without any confirmation or comms. Dont want to migrate away from NPM, but starting to look at other options as I am losing the trust this will be addressed.
Author
Owner

@kingfisher77 commented on GitHub (Jul 19, 2023):

This is a compelling solution: https://doc.traefik.io/traefik/

<!-- gh-comment-id:1641948122 --> @kingfisher77 commented on GitHub (Jul 19, 2023): This is a compelling solution: https://doc.traefik.io/traefik/
Author
Owner

@JDunnio commented on GitHub (Jul 26, 2023):

Next time you refresh the container, its gone

This fixes the renewal scrip and gives you the ability to renew the certificate for another 3 months. I sincerely hope that this gets fixed in the future.

This is a compelling solution: https://doc.traefik.io/traefik/

I used traefik before NPM. In general it works really wel, but it is nice product in a home setup for which I'm using it. Different versions of traefik, yaml and toml config, ability to override config in the labels

I had quite a few containers in my home setup which i didn't get to work without making a study out of it. NPM config in that way is way easier and easier to troubleshoot.

<!-- gh-comment-id:1651623516 --> @JDunnio commented on GitHub (Jul 26, 2023): > Next time you refresh the container, its gone This fixes the renewal scrip and gives you the ability to renew the certificate for another 3 months. I sincerely hope that this gets fixed in the future. > This is a compelling solution: https://doc.traefik.io/traefik/ I used traefik before NPM. In general it works really wel, but it is nice product in a home setup for which I'm using it. Different versions of traefik, yaml and toml config, ability to override config in the labels I had quite a few containers in my home setup which i didn't get to work without making a study out of it. NPM config in that way is way easier and easier to troubleshoot.
Author
Owner

@github-actions[bot] commented on GitHub (Apr 15, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

<!-- gh-comment-id:2054538186 --> @github-actions[bot] commented on GitHub (Apr 15, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:
Author
Owner

@github-actions[bot] commented on GitHub (Jun 11, 2025):

Issue was closed due to inactivity.

<!-- gh-comment-id:2961023894 --> @github-actions[bot] commented on GitHub (Jun 11, 2025): Issue was closed due to inactivity.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/nginx-proxy-manager-NginxProxyManager#1906
No description provided.