[GH-ISSUE #2999] Internel Server Error in process renew certificate Let's Encrypt, Wildcard Namecheap #2048

New issue

Closed

opened 2026-02-26 07:33:49 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 07:33:49 +03:00

Owner

Originally created by @vsc55 on GitHub (Jun 14, 2023).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2999

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
- Yes
Are you sure you're not using someone else's docker image?
- Yes
Have you searched for similar issues (both open and closed)?
- Yes

Describe the bug
When you click to renew the certificate, an internal error occurs.
Certificate is Wildcard in Namecheap.

Nginx Proxy Manager Version
v2.10.3

To Reproduce
Steps to reproduce the behavior:

Go to 'SSL Certificates'
Click on the three points of the certificate that we want to renew and click on the opicon renew now.
See error "Internal Error"

Screenshots
Log error:

[6/14/2023] [7:06:50 PM] [SSL      ] › ℹ  info      Command: certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-39" --disable-hook-validation --no-random-sleep-on-renew 
[6/14/2023] [7:06:56 PM] [Express  ] › ⬤  debug     Error: Command failed: certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-39" --disable-hook-validation --no-random-sleep-on-renew 
Saving debug log to /tmp/letsencrypt-log/letsencrypt.log
Failed to renew certificate npm-39 with error: Unable to determine zone identifier for domain.net using zone names: ['domain.net', 'net']
All renewals failed. The following certificates could not be renewed:
  /etc/letsencrypt/live/npm-39/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details.
    at ChildProcess.exithandler (node:child_process:402:12)
    at ChildProcess.emit (node:events:513:28)
    at maybeClose (node:internal/child_process:1100:16)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)

Run command in verbose mode:

# certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-39" --disable-hook-validatio
Saving debug log to /tmp/letsencrypt-log/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/npm-39.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate is due for renewal, auto-renewing...
Plugins selected: Authenticator dns-namecheap, Installer None
Renewing an existing certificate for *.domain.net
Performing the following challenges:
dns-01 challenge for domain.net
Cleaning up challenges
Failed to renew certificate npm-39 with error: Unable to determine zone identifier for domain.net using zone names: ['domain.net', 'net']

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
All renewals failed. The following certificates could not be renewed:
  /etc/letsencrypt/live/npm-39/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details.

Operating System
Docker in Debian.

Originally created by @vsc55 on GitHub (Jun 14, 2023). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2999 **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes **Describe the bug** When you click to renew the certificate, an internal error occurs. Certificate is Wildcard in Namecheap. **Nginx Proxy Manager Version** v2.10.3 **To Reproduce** Steps to reproduce the behavior: 1. Go to 'SSL Certificates' 2. Click on the three points of the certificate that we want to renew and click on the opicon renew now. 3. See error "Internal Error" **Screenshots** Log error: ``` [6/14/2023] [7:06:50 PM] [SSL ] › ℹ info Command: certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-39" --disable-hook-validation --no-random-sleep-on-renew [6/14/2023] [7:06:56 PM] [Express ] › ⬤ debug Error: Command failed: certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-39" --disable-hook-validation --no-random-sleep-on-renew Saving debug log to /tmp/letsencrypt-log/letsencrypt.log Failed to renew certificate npm-39 with error: Unable to determine zone identifier for domain.net using zone names: ['domain.net', 'net'] All renewals failed. The following certificates could not be renewed: /etc/letsencrypt/live/npm-39/fullchain.pem (failure) 1 renew failure(s), 0 parse failure(s) Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details. at ChildProcess.exithandler (node:child_process:402:12) at ChildProcess.emit (node:events:513:28) at maybeClose (node:internal/child_process:1100:16) at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5) ``` Run command in verbose mode: ``` # certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-39" --disable-hook-validatio Saving debug log to /tmp/letsencrypt-log/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/npm-39.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Certificate is due for renewal, auto-renewing... Plugins selected: Authenticator dns-namecheap, Installer None Renewing an existing certificate for *.domain.net Performing the following challenges: dns-01 challenge for domain.net Cleaning up challenges Failed to renew certificate npm-39 with error: Unable to determine zone identifier for domain.net using zone names: ['domain.net', 'net'] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - All renewals failed. The following certificates could not be renewed: /etc/letsencrypt/live/npm-39/fullchain.pem (failure) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 renew failure(s), 0 parse failure(s) Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details. ``` **Operating System** Docker in Debian.

kerem

2026-02-26 07:33:49 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@vsc55 commented on GitHub (Jun 14, 2023):

Hi, it was a false alarm.
I leave here the reason for the problem and solve it in case it happens to someone else (probably to me in a few months when I don't remember). hehehehe
It turns out that the error is caused by a security filter that namechepa has when using the API since they control the IPs of the clients that connect.
It turns out that I was connecting to another ip that was not on the whitelist and that is why the error occurs.
Add the new ip to the whitelist and everything has been fixed.

@vsc55 commented on GitHub (Jun 14, 2023): Hi, it was a false alarm. I leave here the reason for the problem and solve it in case it happens to someone else (probably to me in a few months when I don't remember). hehehehe It turns out that the error is caused by a security filter that namechepa has when using the API since they control the IPs of the clients that connect. It turns out that I was connecting to another ip that was not on the whitelist and that is why the error occurs. Add the new ip to the whitelist and everything has been fixed.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#2048

No description provided.

Rows
Columns