mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-25 09:25:55 +03:00
[GH-ISSUE #881] Cannot generate SSL certificate #745
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#745
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @stefanorossiti on GitHub (Feb 9, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/881
I managed to configure NPM as a reverse proxy for 2 internal services, but i don't know why i cant generate the certificate. It gives no real error i could work with...
I'am using the DNS from namecheap that is not in the list, is it necessary to get a certificate?
@henkisdabro commented on GitHub (Feb 11, 2021):
I've also started getting the Internal Error messages when creating new Proxy Hosts. I'm using Cloudflare and follow the same procedure as always when issuing. It might be related to the new 2.8.0 version as I did not have the issues before that.
I tried reverting to 2.7.3 but now experience the same error on this version too. I also tried removing the XX.conf files associated with old entries, but it seems something old is trailing too (database seems empty when checking with adminer?)
@Ducatel commented on GitHub (Feb 11, 2021):
Same issue for me with the 2.8.0 or 2.7.3 version in SQLite mode running into docker container.
I have error when create a new cert or in renewal.
I have this king of log:
@henkisdabro commented on GitHub (Feb 13, 2021):
Update from my end – it seems to be automatically resolved. I went back to use the :latest image (2.8.0) and booted up NPM and now it seems all is working again. Issuing certs and attaching existing SSL certs to new hosts all seem to work. The issues I had removing proxy hosts is also gone. Phew. Hope it works for you guys too/
@Ducatel commented on GitHub (Feb 13, 2021):
Same for me, yesterday I tryed to renew all my certificates and all was done with success...
@talondnb commented on GitHub (Feb 15, 2021):
I'm not having much luck:
and log shows:
Any ideas?
edit: more logs at startup of container:
@ragaimeena commented on GitHub (Feb 15, 2021):
I am having the same issue. I can't even get to the HTTP request at all. I uninstalled and reinstalled many time:
addon on HASSIO
duckdns for the DNS service and subdomain
I get the same internal error please help
@talondnb commented on GitHub (Feb 20, 2021):
Bump? I've temporarily moved to the addon in home assistant which seems to be working fine for me (but now I'm at my limit for renews, so i have to wait a week).
@koshia commented on GitHub (Feb 27, 2021):
I'm having the same issue, kept thinking it's me and how i'm registering via Cloudflare but i'm thinking something' up with Cloudflare.
I'm on Unraid with docker version:
v1.13.0 (2021-02-09)
Namecheap is where i have my DNS hosted and use Cloudflare to proxy. CF uses the zone edit API now instead of global api to do the acme-challenge. The last time I did this, it was with the global api and worked fine. Made sure this time around after I figured it out to use the Zone API.
We can see the acme-challenge with the TXT records being temporarily created and then removed but for some reason, it still failed.
@JesseRedfield commented on GitHub (Mar 9, 2021):
This feels like it is some kind of race condition. So I was messing with this in a rather slow staging VM running in 1 CPU core on a 2014 macbook air, and was unable to generate any SSL certificates UNLESS after every internal server error I just immediately spammed a retry.
I think what is happening is that the web server that hosts the challenge file that letsencrypt is looking for is not coming up fast enough for the challenge. So what the NGINX Proxy Manager is doing in the background is it is taking down whatever it is that you have occupying port 80 at that domain name, replacing the config with a new server that will host the challenge file at port https://domain.com/.well-known/acme-challenge/
Before this host is actually up, running, and reachable, it is telling the certbot to go ahead and continue the challenge request, and then of course since it can't reach that destination the cert process fails.
You can see the residual effect of this when it is done, it takes about a minute after a cert request for the Congratulations! default landing page for nginx proxy to come back online on my test setup. Basically certbot is beating the webservice coming up with the challenge file and winning the race condition to your failure.
Hammering on renew before the webservice comes back to the congratulations page did it for me, it also fills up the letsencrypt folder with tons of garbage certs =/ This happens both with this image and the newest image from here: https://github.com/jlesage/docker-nginx-proxy-manager/compare.
I Don't know if this setup is using the nginx instance to host the challenge file, or using the auto host built into certbot, but either port 80 isn't unbinding fast enough or the switch to the certbot challenge file host isn't happening quick enough.
@JesseRedfield commented on GitHub (Mar 14, 2021):
This is an issue in certbot nginx, see: https://github.com/certbot/certbot/pull/8163
they implemented a feature to wait for nginx to start back up after changing it's configuration, it's a hard timer.
certbot now has a command line parameter --nginx-sleep-seconds for doing it's job on slower machines where nginx may not start up fast enough.
I found this as I was trying to use letsencrypt with a plain nginx system after I could not get a certificate using nginxproxymanager.
@focher commented on GitHub (Jun 29, 2021):
Any idea when this fix will be implemented in Proxy Manager?
@jc21 commented on GitHub (Jun 29, 2021):
From the documentation,
--nginx-sleep-secondsseems only to apply for the certbot nginx plugin. We don't use that as we control nginx reloads manually.From the code path I can't see how the reloading of nginx wouldn't be completed prior to requesting a cert via certbot however an additional check for nginx being up could be added rather easily.
@TWART016 commented on GitHub (Dec 29, 2021):
Hi,
I have the same error:
"Incorrect TXT record \"MYDOMAIN\" found at _acme-challenge.MYDOMAIN"is there a solution in the meantime?
@chaptergy commented on GitHub (Dec 30, 2021):
As failing to create a certificate and the "internal error" is a very generic error, this issue has ended up containing a huge mix off entirely different issues, which are not connected. Hence I will go ahead and close this issue, to prevent it from becoming a graveyard for different problems. You can go ahead an open a new issue with specifics to your issue. https://github.com/jc21/nginx-proxy-manager/issues/1271 Will help you get started.