[GH-ISSUE #5202] NPM api crashes when trying to revoke an expired certificate (eg. when it's deleted) #3140

New issue

Open

opened 2026-02-26 07:37:56 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 07:37:56 +03:00

Owner

Originally created by @FlorianFritz on GitHub (Jan 21, 2026).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5202

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
- Yes
Are you sure you're not using someone else's docker image?
- Yes
Have you searched for similar issues (both open and closed)?
- Yes

Describe the bug
When one deletes a certificate NPM tries to revoke it (that's good), but this failes if the certificate has already expired. And the whole API gets stuck. Any further action on the UI get's a load failure and any reload request to the whole website/server takes very long. After some time the following message appears:

The API is not healthy.
We'll keep checking and hope to be back soon!

After a while the API and UI is back and responsive as usual.

Docker logs:

[1/21/2026] [2:17:17 PM] [SSL      ] › ℹ  info      Revoking LetsEncrypt certificates for Cert #4: [redacted domain name]
[1/21/2026] [2:17:17 PM] [SSL      ] › ℹ  info      Command: certbot revoke --config /etc/letsencrypt.ini --work-dir /tmp/letsencrypt-lib --logs-dir /data/logs --cert-path /etc/letsencrypt/live/npm-4/fullchain.pem --delete-after-revoke
[1/21/2026] [2:17:18 PM] [SSL      ] › ✖  error     Saving debug log to /data/logs/letsencrypt.log
An unexpected error occurred:
Unable to revoke :: Certificate is expired
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /data/logs/letsencrypt.log or re-run Certbot with -v for more details.

/data/logs/letsencrypt.log

026-01-21 14:17:18,507:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/revoke-cert HTTP/1.1" 403 130
2026-01-21 14:17:18,507:DEBUG:acme.client:Received response:
HTTP 403
Server: nginx
Date: Wed, 21 Jan 2026 14:17:18 GMT
Content-Type: application/problem+json
Content-Length: 130
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: [redacted]

{
  "type": "urn:ietf:params:acme:error:unauthorized",
  "detail": "Unable to revoke :: Certificate is expired",
  "status": 403
}
2026-01-21 14:17:18,508:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/opt/certbot/bin/certbot", line 7, in <module>
    sys.exit(main())
             ^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/certbot/main.py", line 18, in main
    return internal_main.main(cli_args)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/main.py", line 1876, in main
    return config.func(config, plugins)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/main.py", line 1374, in revoke
    acme.revoke(cert, config.reason)
  File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 384, in revoke
    self._revoke(cert, rsn, self.directory['revokeCert'])
  File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 577, in _revoke
    response = self._post(url,
               ^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 461, in _post
    return self.net.post(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 812, in post
    return self._post_once(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 827, in _post_once
    response = self._check_response(response, content_type=content_type)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 699, in _check_response
    raise messages.Error.from_json(jobj)
acme.messages.Error: urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Unable to revoke :: Certificate is expired
2026-01-21 14:17:18,509:ERROR:certbot._internal.log:An unexpected error occurred:
2026-01-21 14:17:18,509:ERROR:certbot._internal.log:Unable to revoke :: Certificate is expired

Nginx Proxy Manager Version
v2.13.6

To Reproduce
Steps to reproduce the behavior:

Go to 'Certificates'
Create a Certificate ('Add Certificate / Let's encrypt via HTTP')
Wait until the certificate expires (eg. renew fails because NPM is not accessible via HTTP anymore)
Delete Certificate

Expected behavior

To check if the certificate needs to be revoked (if expired this is not necessary anymore).
Not crash the API if it happens

Maybe this is (also) an upstream bug in certbot.

Screenshots
None, see log excerpt above.

Operating System
docker on alpine linux

Additional context
None

Originally created by @FlorianFritz on GitHub (Jan 21, 2026). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5202 **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes **Describe the bug** When one deletes a certificate NPM tries to revoke it (that's good), but this failes if the certificate has already expired. And the whole API gets stuck. Any further action on the UI get's a load failure and any reload request to the whole website/server takes very long. After some time the following message appears: > The API is not healthy. > We'll keep checking and hope to be back soon! After a while the API and UI is back and responsive as usual. Docker logs: ``` [1/21/2026] [2:17:17 PM] [SSL ] › ℹ info Revoking LetsEncrypt certificates for Cert #4: [redacted domain name] [1/21/2026] [2:17:17 PM] [SSL ] › ℹ info Command: certbot revoke --config /etc/letsencrypt.ini --work-dir /tmp/letsencrypt-lib --logs-dir /data/logs --cert-path /etc/letsencrypt/live/npm-4/fullchain.pem --delete-after-revoke [1/21/2026] [2:17:18 PM] [SSL ] › ✖ error Saving debug log to /data/logs/letsencrypt.log An unexpected error occurred: Unable to revoke :: Certificate is expired Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /data/logs/letsencrypt.log or re-run Certbot with -v for more details. ``` /data/logs/letsencrypt.log ``` 026-01-21 14:17:18,507:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/revoke-cert HTTP/1.1" 403 130 2026-01-21 14:17:18,507:DEBUG:acme.client:Received response: HTTP 403 Server: nginx Date: Wed, 21 Jan 2026 14:17:18 GMT Content-Type: application/problem+json Content-Length: 130 Connection: keep-alive Cache-Control: public, max-age=0, no-cache Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index" Replay-Nonce: [redacted] { "type": "urn:ietf:params:acme:error:unauthorized", "detail": "Unable to revoke :: Certificate is expired", "status": 403 } 2026-01-21 14:17:18,508:DEBUG:certbot._internal.log:Exiting abnormally: Traceback (most recent call last): File "/opt/certbot/bin/certbot", line 7, in <module> sys.exit(main()) ^^^^^^ File "/opt/certbot/lib/python3.11/site-packages/certbot/main.py", line 18, in main return internal_main.main(cli_args) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/main.py", line 1876, in main return config.func(config, plugins) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/certbot/lib/python3.11/site-packages/certbot/_internal/main.py", line 1374, in revoke acme.revoke(cert, config.reason) File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 384, in revoke self._revoke(cert, rsn, self.directory['revokeCert']) File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 577, in _revoke response = self._post(url, ^^^^^^^^^^^^^^^ File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 461, in _post return self.net.post(*args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 812, in post return self._post_once(*args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 827, in _post_once response = self._check_response(response, content_type=content_type) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/certbot/lib/python3.11/site-packages/acme/client.py", line 699, in _check_response raise messages.Error.from_json(jobj) acme.messages.Error: urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Unable to revoke :: Certificate is expired 2026-01-21 14:17:18,509:ERROR:certbot._internal.log:An unexpected error occurred: 2026-01-21 14:17:18,509:ERROR:certbot._internal.log:Unable to revoke :: Certificate is expired ``` **Nginx Proxy Manager Version** v2.13.6 **To Reproduce** Steps to reproduce the behavior: 1. Go to 'Certificates' 2. Create a Certificate ('Add Certificate / Let's encrypt via HTTP') 3. Wait until the certificate expires (eg. renew fails because NPM is not accessible via HTTP anymore) 4. Delete Certificate **Expected behavior** 1. To check if the certificate needs to be revoked (if expired this is not necessary anymore). 2. Not crash the API if it happens Maybe this is (also) an upstream bug in certbot. **Screenshots** None, see log excerpt above. **Operating System** docker on alpine linux **Additional context** None

kerem added the

bug

label

2026-02-26 07:37:56 +03:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#3140

No description provided.

Rows
Columns