mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-25 17:35:52 +03:00
[GH-ISSUE #747] Internal Error creating SSL #631
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#631
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @magicman32 on GitHub (Nov 30, 2020).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/747
Checklist
When creating a proxy host, I get an internal error and ssl is not created, new to docker, learning as I go
This pic is when I try to create host proxy with ssl.............
This pic is when I try to create ssl on its own without creating a host proxy...............
Some of the text is cut out....here is full log......
Error: Command failed: /usr/bin/certbot certonly --non-interactive --config "/etc/letsencrypt.ini" --cert-name "npm-12" --agree-tos --email "magicman32.craig@gmail.com" --preferred-challenges "dns,http" --domains "books.beastunraid.me"
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for books.beastunraid.me
Using the webroot path /data/letsencrypt-acme-challenge for all unmatched domains.
Waiting for verification...
Challenge failed for domain books.beastunraid.me
http-01 challenge for books.beastunraid.me
Cleaning up challenges
Some challenges have failed.
@magicman32 commented on GitHub (Dec 15, 2020):
anyone??
@rmensing commented on GitHub (Dec 15, 2020):
As far as I am aware you must select "Use a DNS challenge" otherwise CertBot tries to use the HTTP-01 challenge which would require NPM to have access to the webroot of the server you are trying to get a cert for and I'm willing to bet that it does not have that access.
Switch on "Use a DNS challenge" then select your DNS provider, if it is on the list, then it will probably need and API token that you will get from your DNS provider. If your DNS provider is not on the list then you may need to switch to one that is. Cloudflare and probably others have free accounts available.
@magicman32 commented on GitHub (Dec 16, 2020):
Im with cloudflare, am I putting in my global api key? sorry noob at this stuff
or do I need to create an api token?
@rmensing commented on GitHub (Dec 16, 2020):
You will need to create an API token. Use the "edit zone DNS" template. Make note of the created token as once you close it you will not be able to view the token again.
The global API key no longer works for this. Funny thing is that this is why I was here and saw your post. I was using the global key in some of mine and was getting a similar error when trying to renew. Switching to a created token resolved my issue.
@magicman32 commented on GitHub (Dec 17, 2020):
Ok got my edit zone dns api token
What do I need to put in Credentials File content section, im not sure what to add or replace or change there?
@chris1668 commented on GitHub (Dec 19, 2020):
I just tried to use Cloudflare DNS Challenge and it seems the Docker Image from JLesage does not have the Cloudflare-DNS module installed, so after running
pip3 install certbot-dns-cloudflare==1.8.0matching the version from the internal error message has now lead me to this Command Failed Error with no obvious reason standing out to me.
`Error: Command failed: /usr/bin/certbot certonly --non-interactive --cert-name "npm-15" --agree-tos --email "" --domains "*.example.com" --authenticator dns-cloudflare --dns-cloudflare-credentials "/etc/letsencrypt/credentials/credentials-15"
Traceback (most recent call last):
File "/usr/bin/certbot", line 11, in
load_entry_point('certbot==1.4.0', 'console_scripts', 'certbot')()
File "/usr/lib/python3.8/site-packages/certbot/main.py", line 15, in main
return internal_main.main(cli_args)
File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1315, in main
log.pre_arg_parse_setup()
File "/usr/lib/python3.8/site-packages/certbot/_internal/log.py", line 55, in pre_arg_parse_setup
temp_handler = TempHandler()
File "/usr/lib/python3.8/site-packages/certbot/_internal/log.py", line 243, in init
stream = util.safe_open(self.path, mode='w', chmod=0o600)
File "/usr/lib/python3.8/site-packages/certbot/util.py", line 197, in safe_open
fd = filesystem.open(path, os.O_CREAT | os.O_EXCL | os.O_RDWR, *open_args)
File "/usr/lib/python3.8/site-packages/certbot/compat/filesystem.py", line 149, in open
return os.open(file_path, flags, mode)
PermissionError: [Errno 13] Permission denied: '/tmp/tmpyp2bcu3c/log'
@magicman32 commented on GitHub (Dec 19, 2020):
Did that, what next?
Ok got my edit zone dns api token
What do I need to put in Credentials File content section, im not sure what to add or replace or change there?
@magicman32 commented on GitHub (Dec 22, 2020):
@rmensing
@rmensing commented on GitHub (Dec 22, 2020):
Sorry for the delay @magicman32 .
Just replace everything after the = sign with the API token. Leave the propagation seconds box empty, the default works fine. Click the I Agree switch and then click save. It should pull a cert without error. I had the NPM log open in a second window so I could watch what it was doing live. I use Portainer which makes watching the log easier.
@rmensing commented on GitHub (Dec 22, 2020):
@chris1668
My first suggestion would be to try using the official Docker container jc21/nginx-proxy-manager because it is already setup to run certbot as well as being more current than the other. The official container right now was updated 8 days ago and the one you are using is a month old.
I am not a dev on this, just another user like you :) but, to me, it looks like there is a problem with permissions in the container so the app is unable to write to a file it needs. This is why I suggest trying the official container.
@magicman32 commented on GitHub (Dec 23, 2020):
Ok, so I was able to create an ssl, but when I goto host address, I get welcome to our sever, confused, not sure if I have missed something
@magicman32 commented on GitHub (Dec 28, 2020):
@rmensing
@rmensing commented on GitHub (Dec 28, 2020):
Not certain but it sounds like you are ending up on the non-ssl (HTTP) page. You should be able to tell by if it has the lock icon before the URL in the address bar.
Why it is doing this is dependent on the server you are proxying and its configuration and possibly other factors.
As a basic example:
I have servers that only server content un-secure on port 80 or some other port so I set the Forward Hostname/IP and Forward Port to those.
I have some that only serve content on a secure port (443) already so I use that port on the Forward Port On some of these I have had the server show the default web server welcome page on port 80 and the actual content on port 443. This is what it seems like it could be to me.