mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-25 17:35:52 +03:00
[GH-ISSUE #3324] SSL Internal Error on request a new SSL certificate #2238
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#2238
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @DaYroXy on GitHub (Nov 15, 2023).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3324
Checklist
jc21/nginx-proxy-manager:latestdocker image?Describe the bug
When trying to request a a new SSL Certifcate i get internal error
Nginx Proxy Manager Version
v2.10.4
To Reproduce
Steps to reproduce the behavior:
Screenshots
Operating System
Ubuntu 20.04 - 64bit, running Portainer v2.19.2
Additional context
Cloudflare (NO PROXY):
A => dayroxy.online => ip
CNAMe => * => dayroxy.online
`
2023-11-15 05:51:29,337:DEBUG:acme.client:Storing nonce: GEqhmX18EBYehAoQEeHOv-lemRWL1u8IRLnVc7o6fKR1jTTNhtU
2023-11-15 05:51:29,338:INFO:certbot._internal.auth_handler:Challenge failed for domain portainer.dayroxy.online
2023-11-15 05:51:29,338:INFO:certbot._internal.auth_handler:http-01 challenge for portainer.dayroxy.online
2023-11-15 05:51:29,338:DEBUG:certbot._internal.display.obj:Notifying user:
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: portainer.dayroxy.online
Type: connection
Detail: 87.237.52.121: Fetching http://portainer.dayroxy.online/.well-known/acme-challenge/MS4A57_vkBnqeWLmBgQXIt0bxXNSIi88aYDifAQO7dk: Connection reset by peer
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.
2023-11-15 05:51:29,339:DEBUG:certbot._internal.error_handler:Encountered exception:
Traceback (most recent call last):
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/auth_handler.py", line 108, in handle_authorizations
self._poll_authorizations(authzrs, max_retries, max_time_mins, best_effort)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/auth_handler.py", line 212, in _poll_authorizations
raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.
2023-11-15 05:51:29,339:DEBUG:certbot._internal.error_handler:Calling registered functions
2023-11-15 05:51:29,339:INFO:certbot._internal.auth_handler:Cleaning up challenges
2023-11-15 05:51:29,339:DEBUG:certbot._internal.plugins.webroot:Removing /data/letsencrypt-acme-challenge/.well-known/acme-challenge/MS4A57_vkBnqeWLmBgQXIt0bxXNSIi88aYDifAQO7dk
2023-11-15 05:51:29,339:DEBUG:certbot._internal.plugins.webroot:All challenges cleaned up
2023-11-15 05:51:29,340:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
File "/usr/bin/certbot", line 8, in
sys.exit(main())
File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 19, in main
return internal_main.main(cli_args)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 1864, in main
return config.func(config, plugins)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 1597, in certonly
lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 141, in _get_and_save_cert
lineage = le_client.obtain_and_enroll_certificate(domains, certname)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 516, in obtain_and_enroll_certificate
cert, chain, key, _ = self.obtain_certificate(domains)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 428, in obtain_certificate
orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 496, in _get_order_and_authorizations
authzr = self.auth_handler.handle_authorizations(orderr, self.config, best_effort)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/auth_handler.py", line 108, in handle_authorizations
self._poll_authorizations(authzrs, max_retries, max_time_mins, best_effort)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/auth_handler.py", line 212, in _poll_authorizations
raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.
2023-11-15 05:51:29,341:ERROR:certbot._internal.log:Some challenges have failed.
`
@jucajuca commented on GitHub (Nov 15, 2023):
you can solve this issue by deactivating "Force SSL" OR by adding the following custom location which will catch the letsencrypt requests (basically redirect back to the nginx proxy):
@jc21 this is a common issue with letsencrypt. Could you automatically add the custom location if "Force SSL" is enabled? It seems that a lot of people are bothered by this issue. See for example: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/396
.
@DaYroXy commented on GitHub (Nov 15, 2023):
Hello! thanks for the answer the error happens with or without force SSL i still get the same error,
also tried what you told me
Helo,
@Gh0stExp10it commented on GitHub (Nov 16, 2023):
Same error on my site. Last time I registered a certificate was on the 11. Nov. - now it's not working for a new one anymore..
@PaulNdrei commented on GitHub (Nov 17, 2023):
In my case, I wanted to keep ports 80 and 443 open for my private network only, so then I got the same error, "Internal Error."
Then I opened the ports to be available on 0.0.0.0/0, and I tried again to generate the SSL certificate with a successful result.
@DaYroXy commented on GitHub (Nov 18, 2023):
Hello! Thanks for the replay but sadly i also tried to eve open all available ports but sadly it didnt work
@wkobiela commented on GitHub (Nov 18, 2023):
Same issue - worked some time ago, didn't change anything in any configuration since then, and now getting Internal Error. Cannot renew or create any new certificate.
@DaYroXy commented on GitHub (Nov 19, 2023):
thats so weird what can we do tho?
@Gh0stExp10it commented on GitHub (Nov 19, 2023):
I don't know what causes the problems after all, but a complete cleanup of the npm setup and port forwarding it works again... further investigations are still open from my side. Pretty weird!
@DaYroXy commented on GitHub (Nov 19, 2023):
The weird thing is that i even tried to reinstall the whole os, portainer, older version nothing worked at all which is really weird
@kpleines commented on GitHub (Nov 20, 2023):
Same issue and no of the workarounds worked for me.
any suggestions?
@Gh0stExp10it commented on GitHub (Nov 20, 2023):
Could you check, what reply you get, if you open your public IPv4 with the port 80 (or whatever port you forward to NPM)? At least you should get the "welcome page" or whatever you configured.
@wkobiela commented on GitHub (Nov 20, 2023):
Weird, but you are right. I checked my router settings - port 80 open. Used https://portchecker.co/check-it to verity - closed. Removed settings, setup port forwarding once again and verified -> port open.
NPM worked and renewed all my certificates.
@DaYroXy commented on GitHub (Nov 20, 2023):
Yeah i got the hello page, port 80, 81, 443 are open with a few more but no luck according to the error:
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.
i think its something with certbot command
@jsbrain commented on GitHub (Nov 20, 2023):
Adding
network_mode: hostin thedocker-compose.ymlfixed it for me.@Gh0stExp10it commented on GitHub (Nov 22, 2023):
Did you always try to create a certificate for the exact same service/container? Maybe just try another one, like a portainer instance, which already wants to listen on a secure ssl connection for example.
And another idea: Did you also checked your public domain (or dynDNS address), if also the landing page showed up (regarding the ip updates)?
@DaYroXy commented on GitHub (Nov 23, 2023):
Hi! i tried for multiple domains such as portainer. jelly. nginx. some https some no or even the main domain nothing worked and for my public domain yeah im using DNS only without proxy its taking me to the correct pages as well as loading the webpages for the correct configuration so its working but only the SSL is not for any domain / subdomain
@simowNgithub commented on GitHub (Nov 25, 2023):
Very strange... after reading your comments i reset the ports on my firewall with 80, 443 and 81... Afterwards i was able to create two of four certificates. For the rest then the same error appears 😁 I'm very confused now....
But i think it belongs to my specific proxy host configurations.
I will test, but then the solution was: port 81 must be open on your router/firewall...
@Gh0stExp10it commented on GitHub (Nov 27, 2023):
Glad that a reset helped. However, port 81 does not need to be accessible from outside, as this is only used for the dashboard. The certificate should be validated via port 80.
@Gh0stExp10it commented on GitHub (Nov 27, 2023):
Are you also sure that the DynDNS updates are working correctly? That would be the only explanation I can think of for it not being accessible after all the configurations.
@zemise commented on GitHub (Nov 27, 2023):
thx, this also fixed for me, but when I try, maybe also need ensure port 80, 81, and 443 are belong to NPM
@simowNgithub commented on GitHub (Nov 27, 2023):
Then it is stranger than strange 🤣 Because this was the only change (open port 81). After that it works. Before only port 80 and 443 where opened and i was able to create the certificates x months before.
@EinToni commented on GitHub (Dec 4, 2023):
I really don't undestand, but I can confirm that exposing port 81 indeed solved the issue....
I normally only have 443 exposed, now I also exposed 80 but that didn't help. After also exposing 81 I was able to renew all certs and create one new cert 😄 All without issues.
Afterwards I quickly closed 80 and 81 again and everything is good 👍🏻 Although I really don't understand why exposing 81 fixed that.
@danny3n1tech commented on GitHub (Jan 22, 2024):
I have tried everything listed above and still having the issue.
@Beat2er commented on GitHub (Jan 27, 2024):
A little bit out of context, but the reason it failed for me was the new software firewall, which had rules based on countries (everything worked from my devices). I didn't notice since renewal is only every 60 days (I guess). Maybe check access from different hosts and packet captures, this is how I got further.
@Silversurfer79 commented on GitHub (Feb 20, 2024):
I have been struggleing with this for weeks now and this fixed it for me.
In Portainer go to Containers -> on the Container -> click Exec Console (looks like this >_ ) -> Connect -> Paste "curl -vvvv -I -L -k --tlsv1.2 https://google.com/" and Enter in the console. If you get a failure your DNS is not resolving and this is your problem, add "network_mode: host`" to your compose file. See a copy of my compose below.
A little side note, my certs now auto renew for the first time ;-)
`version: "3.8"
services:
app:
image: jc21/nginx-proxy-manager:latest
container_name: Nginx_PMA
restart: always
ports:
- '81:80'
- '8443:443'
- '82:81'
volumes:
- /home/pi/nginx/data:/data
- /home/pi/nginx/letsencrypt:/etc/letsencrypt
depends_on:
- db
db:
image: jc21/mariadb-aria:latest
container_name: Nginx_PMDB
restart: always
environment:
MYSQL_ROOT_PASSWORD: 'Password_Here'
MYSQL_DATABASE: 'Nginx_DB'
MYSQL_USER: 'Nginx_Admin_Here'
MYSQL_PASSWORD: 'Admin_Password_Here'
volumes:
- /home/pi/nginx/data/mysql:/var/lib/mysql
@tr1p0p commented on GitHub (Mar 11, 2024):
Still got this issue. Kind of annoying you're just... Stuck... SSL so easy ! (no)
@firefox7518 commented on GitHub (Mar 22, 2024):
I also have this issue and all my certs are running out in some days. Will this be fixed by the devs or is this NPM project dead? Need to know this urgently.
@Silversurfer79 commented on GitHub (Mar 22, 2024):
If you read my reply, simply adding "network_mode: host`" to the bottom of the stack, allows auto renew of the certs in the last 30 days.
@Silversurfer79 commented on GitHub (Mar 22, 2024):
Your issue you have request to many certs for the domain already, you must read the Letrs Encrypt terms, there is a limit of certs you can request per month/day I guess.
Your issue has nothing to do with ssl renewals.
@firefox7518 commented on GitHub (Mar 22, 2024):
Well I tried that and now I cannot login anymore!!!!
Bad Gateway error message. What in the world.... Does no one test this stuff before releasing? Looking up it seems that dozends of other also have the same issue with "bad gateway" when trying to login. So, now I'm stuck and can revert back everything. This is so annoying.....
@Gh0stExp10it commented on GitHub (Mar 22, 2024):
I've got some problems like this back in the days. Try to backup your proxy_host configs (your-local-npm-data/nginx/proxy_host/), for example
1.conf2.conf. After backup/copying your files, delete them and restart your npm container. It will rebuild these configs. Hope that helps.@Silversurfer79 commented on GitHub (Mar 22, 2024):
What do your logs show?
@firefox7518 commented on GitHub (Mar 23, 2024):
I tried your way. Deleted the conf files, restarted the container. It did NOT recreate the files. I had to go into each config and click save and it created a new file. However, this did not solve anything. Still not able to renew certificate. I reverted also back to my last running version so that I can login.
I've added so far "network_mode:host" to the container, did not resolve it. I also do not have any issues pinging outside world like google.com or dns servers. 31 Websites with multiple domains and subdomains are running fine and certs were renewing flawlessly for more than a year without an issue. And now suddenly it stopped and shows constantly "internal error". I tried to find anything in the log files but to be honest in all lets encrypt related log files they are 0bytes, emtpy. Where can I activate a more verbose log?
So many people have issues with that, not good, really not good
@istoppedcaringat30 commented on GitHub (Mar 29, 2024):
Just wanted to add that my fix was to allow port 80 to NPM on my router. I must have blocked it at some point.
@smibrandon commented on GitHub (Apr 1, 2024):
I found a fix for my issue: allocating more storage space.
Running NPM in a Proxmox CT (no docker at all), and happened to catch that it was at 96% of its storage. I gave it some extra, and boom. Worked!
@kautsaridris commented on GitHub (Apr 6, 2024):
i have sam issue, than i trace the couse, so i found my provider block my IP for incoming connection from another country to my server, connections allowed only from my country (that because my server IP coming from my Goverment) so when i opening the ticket to allowed incoming connection for All, and the "Internal Error" is fixed,
so mybe this is the one from another thing to fix your problem
@jclsn commented on GitHub (Apr 10, 2024):
Same issue here. I realized that this works with DuckDNS domains, but not with the one configured in my router. I grew tired of DuckDNS not working often, so I bought an official Strato domain, which I configured with DynDNS in my Fritz.Box. I could successfully create a proxy and request a certificate for the main domain, but not for the subdomains.
@TasteOfChaoZ commented on GitHub (Apr 26, 2024):
Same issue. Stupid me. I disabled NAT-Rule for Port 80 farwarding to my nginx, for what evert reason ....
@timursevimli commented on GitHub (Apr 30, 2024):
this resource helped me solve the problem:
https://medium.com/@life-is-short-so-enjoy-it/homelab-nginx-proxy-manager-setup-ssl-certificate-with-domain-name-in-cloudflare-dns-732af64ddc0b
@ryuzaki09 commented on GitHub (May 6, 2024):
i opened the port 80 to my NPM temporarily to request the new certificate, it worked and then I closed the port again.
@TailoredITRob commented on GitHub (May 27, 2024):
This is not an option. Using network_mode set to host will expose all ports to the open world. It also forces you to do the same with any other related containers or they can no longer communicate.
@JoeZUM commented on GitHub (Jul 6, 2024):
I have the same problem. Is there any progress on this issue?
@Silversurfer79 commented on GitHub (Jul 7, 2024):
I have come to realise that 99% of certificate renewal issues are firewall blocking ports. I would check and recheck that ports are open. I did have my ports being blocked.
My working docker compose file, good luck!
I can renew my certs at any point now, though they auto renew 30 days before expiring.
@Wav3y commented on GitHub (Jul 15, 2024):
NPM is not particularly helpful in telling you what the specific issue is other than "Internal Error" which could mean a magnitude of things so everyone should start by inspecting their container logs.
First of all, if you're using Namecheap, make sure your IP is whitelisted.
My issue probably stemmed from a manual move of my container from one host to another (I think) as it related to some broken symlinks.
I use Portainer so used that to inspect my logs but obviously there are other ways to inspect logs.
The logs showed a parse failure
0 renew failure(s), 1 parse failure(s)I SSH'd into the container
docker exec -it <container_id_or_name> /bin/bashDouble checked Certbot logs
Double checked letsencrypt config.
Manually ran the renewal inside the container
Terminal showed this error:
So I went in and repaired the sym links as config files were not pointing to any symlinks as it should've been. Here's what I ran to repair:
Then either run renewal on NPM GUI or directly on terminal:
Stuck? Use ChatGPT. That's how I fixed my problem because I'm not in IT.
@flow96 commented on GitHub (Jul 27, 2024):
It seems that certbot mostly uses IPv6 to verify domains, therefore maybe recheck your DNS settings.
I had the same problem and found the error in my DNS settings.
I originally updated the DNS entries to point to my server on IPv4 but forgot about IPv6.
So after replacing the AAAA entry with the IPv6 of my server it works again 🎉
@pablomujica commented on GitHub (Aug 6, 2024):
In my case using Cloudflare, updating the package in the server fixed it:
@sarequl commented on GitHub (Aug 29, 2024):
It worked for me. thanks
@andsim commented on GitHub (Sep 3, 2024):
h ere my issues
@andsim commented on GitHub (Sep 3, 2024):
i think is web address issues
acme-v02.api.letsencrypt.org
when i try in browser and get
ERR_ADDRESS_INVALID
@andsim commented on GitHub (Sep 4, 2024):
look at last line
@andsim commented on GitHub (Sep 4, 2024):
i bet everyone have this same issues
@andsim commented on GitHub (Sep 4, 2024):
ok what npm ip use?
"hostname": "andsimgaming.ca",
"port": "80",
"addressesResolved": [
"192.124.249.15"
],
"addressUsed": "192.124.249.15"
not property resolve
@rulatir commented on GitHub (Sep 11, 2024):
How can this possibly work for anyone? It causes
Published ports are discared when using host network mode, and unsurprisingly, the the nginx-proxy-manager app is no longer even reachable from the internet. Instead of fixing the issue, it makes nginx-proxy-manager stop working completely.@andsim commented on GitHub (Sep 17, 2024):
all my domain is link to x.x.137.119
@andsim commented on GitHub (Sep 17, 2024):
some of my domain is working but some is broken due of bug
@jimclark commented on GitHub (Dec 1, 2024):
In case someone else stumbles on this issue later (as I did), my problem and cure was similar. In my case, I was migrating NPM from one computer to another, and while I had edited and saved the entries in my router's port forwarding settings, I had to then "apply settings" at the top of the page. Then I could request the certificate, and it all worked happily ever after!
@rogercreagh commented on GitHub (Jan 3, 2025):
Yay. Thank you. Exactly the same problem here - tried a few earlier suggestions to no avail before getting down to this one (should have started reading from the end!)
@Emelix123 commented on GitHub (Jan 6, 2025):
Hey Guys,
I think I found a solution.
The problem is that normally you forward port 443 because you want to use HTTPS. However, Let's Encrypt cannot find a website that way. The solution is to temporarily open port 80 for a few minutes to create a new certificate. After the certificate is created, you can close port 80, and everything should work fine.
Here are the steps:
Let me know if this works for you!
@Silversurfer79 commented on GitHub (Jan 6, 2025):
Hey, that's the default requirement for all let's encrypt cert issuing and
renewal.
On Mon, 06 Jan 2025, 11:09 Emelix123, @.***> wrote:
@groths89 commented on GitHub (Jan 14, 2025):
Internal Error can also be caused by incorrect DNS setup. Check that the subdomain you want to add into Nginx Proxy Manager is pointing to the Nginx Proxy Manager Server's IP address. Then point the Destination in NPM to the IP address of the application's server. If the application is on a different server of course. That was my issue anyway. This comment might solve the issue for some, not all.
@xlyralycanx commented on GitHub (Feb 10, 2025):
I solved this by changing Settings ⟩ Default Site. I had custom HTML set to display, when reverting the setting to another, in my case '404 page', the certification completed immediately after.
@thezepter commented on GitHub (Feb 28, 2025):
Thats works. Thanks !
@konies commented on GitHub (Mar 15, 2025):
I also had this error. I entered the shell and saw that it was missing the six module, so I just had to install it with: pip install six.
@theking2 commented on GitHub (Mar 30, 2025):
But if I would open or NAT port 80 and 443 on my router I would not be able to connect to the router webgui anymore would I?
No it would't only the WAN side of the router is affected, you'll still be able to logon from the LAN side.
@ryuzaki09 commented on GitHub (Mar 31, 2025):
this is the same method I use and it works for me too.
@Silversurfer79 commented on GitHub (Mar 31, 2025):
The issue is then you have to open port 80 every 2 months so the certs can
renew. I leave the ports 80 and 443 open and just have a IPS/IDS firewall
and make the backend is a different vlan, is not on the same network as
your home.
On Mon, 31 Mar 2025, 10:40 ryuzaki09, @.***> wrote:
@rindev0901 commented on GitHub (May 3, 2025):
sudo ufw default allow routed
worked for me
@max866-elephant commented on GitHub (May 6, 2025):
I encountered the same issue. When trying to reissue the SSL Certificate in the SSL tab, I faced an Internal Error. My solution was to delete the /data and /etc/letsencrypt folders and then reconfigure the settings.
Please make sure to back up the folders before deleting them.
@daliborsojic commented on GitHub (Jul 2, 2025):
I got "Internal Error" (very strange). After restarting the npm, nginx doesn't work.
n```
ginx-proxy-manager | nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-9/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-9/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx-proxy-manager | ❯ Starting nginx ...
nginx-proxy-manager | nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-9/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-9/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx-proxy-manager | ❯ Starting nginx ...
nginx-proxy-manager | nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-9/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-9/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx-proxy-manager | ❯ Starting nginx ...
nginx-proxy-manager | nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-9/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-9/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx-proxy-manager | ❯ Starting nginx ...
nginx-proxy-manager | nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-9/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-9/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx-proxy-manager | ❯ Starting nginx ...
nginx-proxy-manager | nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-9/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-9/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx-proxy-manager | ❯ Starting nginx ...
nginx-proxy-manager | nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-9/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-9/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx-proxy-manager | ❯ Starting nginx ...
nginx-proxy-manager | nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-9/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-9/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx-proxy-manager | ❯ Starting nginx ...
nginx-proxy-manager | nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-9/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-9/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx-proxy-manager | ❯ Starting nginx ...
nginx-proxy-manager | nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-9/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-9/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx-proxy-manager | ❯ Starting nginx ...
nginx-proxy-manager | nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-9/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-9/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx-proxy-manager | ❯ Starting nginx ...
@github-actions[bot] commented on GitHub (Jan 22, 2026):
Issue is now considered stale. If you want to keep it open, please comment 👍
@prik73 commented on GitHub (Jan 24, 2026):
was facing the same issue "Internal error" in npm .
context: Npm entered a broken state after a LetsEncrypt cert was revoked/deleted.
NPM continued referencing the old cert (npm-4) from its internal SQLite DB, causing nginx to fail: nginx:
errors : [emerg] cannot load certificate \n /etc/letsencrypt/live/npm-4/fullchain.pem
Because of this, deleting /etc/letsencrypt, restarting containers, removing proxy_host configs, or reissuing certs did not resolve the issue, the stale cert reference persisted in /data/database.sqlite
what solved was:
1.stop the docker container of npm
2. Wipe NPM’s bind-mounted state -> "sudo rm -rf /home/ubuntu/npm/data/*"
3. start the container
NPM stores critical state in /data/database.sqlite, so deleting cert files alone is insufficient.
And I learn that, Bind mounts survive container restarts. When NPM references a deleted cert, only a full /data reset fixes it.
ps: after reset, custom Docker networks must be recreated and containers reattached
@rtorchia commented on GitHub (Jan 30, 2026):
So I started getting the internal error also with attempting renew my certificates for DuckDNS, and nothing, absolutely nothing, that I found as a solution worked for me. Eventually from piecing together what I read online and reviewing log files I found a solution to my problem.
To renew my wildcard domain name (*.mydomain.duckduns.org), I created a proxy for mydomain.duckdns.org with IP address pointing to NPM port 80. This solved all my problems. If anyone continues to have problems, you may want to see if this works for you.
@jzuhone commented on GitHub (Feb 7, 2026):
This is definitely not resolved, and none of the above methods are working. At the very least there should be a page that describes some common reasons for this issue, wading through all of the above is kind of a mess.
@ReenigneArcher commented on GitHub (Feb 8, 2026):
I don't know if anyone has the same cause as me, but I'll share in case it helps someone.
None of the above solutions worked for me, but what did work was restarting my router. At the time there was no other weirdness on my network and this was the only thing that wasn't working properly.