starred/nginx-proxy-manager-NginxProxyManager
1
0
Fork 0
mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-26 01:45:54 +03:00
Code Issues 937 Projects Releases 10 Packages Wiki Activity

[GH-ISSUE #967] Unable to auto renew certificate using Cloudflare DNS validation #812

New issue
Closed
opened 2026-02-26 06:34:31 +03:00 by kerem · 17 comments
kerem commented 2026-02-26 06:34:31 +03:00
Owner
Copy link

Originally created by @evolsano on GitHub (Mar 22, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/967

Are you in the right place?

  • If you are looking for support on how to get your upstream server forwarding, please consider asking the community on Reddit.
  • If you are writing code changes to contribute and need to ask about the internals of the software, Gitter is the best place to ask.
  • If you think you found a bug with NPM (not Nginx, or your upstream server or MySql) then you are in the right place.

Checklist

  • Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image? yes.
REPOSITORY                                 TAG        IMAGE ID       CREATED         SIZE
jc21/nginx-proxy-manager                   latest     5d9d277f28f1   4 days ago      810MB
  • Are you sure you're not using someone else's docker image? yes.
  • If having problems with Lets Encrypt, have you made absolutely sure your site is accessible from outside of your network? yes.

Describe the bug

  • I am running NPM in 2 different Ubuntu 18.04 LTS server. I am using Cloudflare DNS validation.

  • Both NPM docker failed to renew Let's Encrypt wildcard certificate with auto renewal. But able to renew it when run it manually in SSL Certificate tab.

  • What version of Nginx Proxy Manager is reported on the login page? 2.8.1

Expected behavior
Expect auto certificate renewal when close to expiry.

Screenshots
If applicable, add screenshots to help explain your problem.

Operating System

  • Ubuntu 18.04 LTS Server.

Additional context

Auto renewal

[3/22/2021] [7:57:36 AM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...,
[3/22/2021] [8:01:05 AM] [SSL      ] › ✖  error     Error: Command failed: /usr/bin/certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation  ,
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.,
Attempting to renew cert (npm-1) from /etc/letsencrypt/renewal/npm-1.conf produced an unexpected error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.. Skipping.,
All renewal attempts failed. The following certs could not be renewed:,
  /etc/letsencrypt/live/npm-1/fullchain.pem (failure),
1 renew failure(s), 0 parse failure(s),
,
    at ChildProcess.exithandler (child_process.js:308:12),
    at ChildProcess.emit (events.js:314:20),
    at maybeClose (internal/child_process.js:1051:16),
    at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5),
Connection Error: Error: read ECONNRESET,
Connection Error: Error: read ECONNRESET,

Renew manually

[3/22/2021] [8:48:21 AM] [SSL      ] › ℹ  info      Renewing Let'sEncrypt certificates via Cloudflare for Cert #1: *.example.com,
[3/22/2021] [8:54:49 AM] [SSL      ] › ℹ  info      - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -,
Processing /etc/letsencrypt/renewal/npm-1.conf,
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -,
,
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -,
new certificate deployed without reload, fullchain is,
/etc/letsencrypt/live/npm-1/fullchain.pem,
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -,
,
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -,
,
Congratulations, all renewals succeeded. The following certs have been renewed:,
  /etc/letsencrypt/live/npm-1/fullchain.pem (success),
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -,
[3/22/2021] [8:57:36 AM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...,
[3/22/2021] [8:57:37 AM] [Nginx    ] › ℹ  info      Reloading Nginx,
[3/22/2021] [8:57:37 AM] [SSL      ] › ℹ  info      Renew Complete,
Originally created by @evolsano on GitHub (Mar 22, 2021). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/967 **Are you in the right place?** - If you are looking for support on how to get your upstream server forwarding, please consider asking the community on Reddit. - If you are writing code changes to contribute and need to ask about the internals of the software, Gitter is the best place to ask. - If you think you found a bug with NPM (not Nginx, or your upstream server or MySql) then you are in the *right place.* **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? yes. ``` REPOSITORY TAG IMAGE ID CREATED SIZE jc21/nginx-proxy-manager latest 5d9d277f28f1 4 days ago 810MB ``` - Are you sure you're not using someone else's docker image? yes. - If having problems with Lets Encrypt, have you made absolutely sure your site is accessible from outside of your network? yes. **Describe the bug** - I am running NPM in 2 different Ubuntu 18.04 LTS server. I am using Cloudflare DNS validation. - Both NPM docker failed to renew Let's Encrypt wildcard certificate with auto renewal. But able to renew it when run it manually in SSL Certificate tab. - What version of Nginx Proxy Manager is reported on the login page? 2.8.1 **Expected behavior** Expect auto certificate renewal when close to expiry. **Screenshots** If applicable, add screenshots to help explain your problem. **Operating System** - Ubuntu 18.04 LTS Server. **Additional context** Auto renewal ``` [3/22/2021] [7:57:36 AM] [SSL ] › ℹ info Renewing SSL certs close to expiry..., [3/22/2021] [8:01:05 AM] [SSL ] › ✖ error Error: Command failed: /usr/bin/certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation , Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS., Attempting to renew cert (npm-1) from /etc/letsencrypt/renewal/npm-1.conf produced an unexpected error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.. Skipping., All renewal attempts failed. The following certs could not be renewed:, /etc/letsencrypt/live/npm-1/fullchain.pem (failure), 1 renew failure(s), 0 parse failure(s), , at ChildProcess.exithandler (child_process.js:308:12), at ChildProcess.emit (events.js:314:20), at maybeClose (internal/child_process.js:1051:16), at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5), Connection Error: Error: read ECONNRESET, Connection Error: Error: read ECONNRESET, ``` Renew manually ``` [3/22/2021] [8:48:21 AM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via Cloudflare for Cert #1: *.example.com, [3/22/2021] [8:54:49 AM] [SSL ] › ℹ info - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -, Processing /etc/letsencrypt/renewal/npm-1.conf, - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -, , - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -, new certificate deployed without reload, fullchain is, /etc/letsencrypt/live/npm-1/fullchain.pem, - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -, , - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -, , Congratulations, all renewals succeeded. The following certs have been renewed:, /etc/letsencrypt/live/npm-1/fullchain.pem (success), - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -, [3/22/2021] [8:57:36 AM] [SSL ] › ℹ info Renewing SSL certs close to expiry..., [3/22/2021] [8:57:37 AM] [Nginx ] › ℹ info Reloading Nginx, [3/22/2021] [8:57:37 AM] [SSL ] › ℹ info Renew Complete, ```
kerem 2026-02-26 06:34:31 +03:00
  • closed this issue
  • added the
    stale
    bug
         labels
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@fanvyr commented on GitHub (Mar 30, 2021):

Do you use Cloudflare in proxy mode? You can't use wildcard SSL Certs with that.
To obtain a certificate i would recommend turning the proxy mode off, issue the cert, and turn it back on.

Had issues with that too.

<!-- gh-comment-id:810560228 --> @fanvyr commented on GitHub (Mar 30, 2021): Do you use Cloudflare in proxy mode? You can't use wildcard SSL Certs with that. To obtain a certificate i would recommend turning the proxy mode off, issue the cert, and turn it back on. Had issues with that too.
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@evolsano commented on GitHub (Apr 4, 2021):

What is proxy mode? I can renew the certificate manually, but not automatically.

<!-- gh-comment-id:813022375 --> @evolsano commented on GitHub (Apr 4, 2021): What is proxy mode? I can renew the certificate manually, but not automatically.
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@fanvyr commented on GitHub (Apr 4, 2021):

What is proxy mode? I can renew the certificate manually, but not automatically.

When viewing the matching DNS record, is the Cloud Symbol Orange or Grey?
Orange = Proxy mode
Grey = direct exposing

<!-- gh-comment-id:813023355 --> @fanvyr commented on GitHub (Apr 4, 2021): > What is proxy mode? I can renew the certificate manually, but not automatically. When viewing the matching DNS record, is the Cloud Symbol Orange or Grey? Orange = Proxy mode Grey = direct exposing
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@ikomhoog commented on GitHub (Apr 4, 2021):

I have the same issue, I have all my records without Cloudflare proxy, just the grey cloud symbol.
But when I try it manually I get a timeout error.

I got this log 2x repeated:

Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.
Attempting to renew cert (npm-1) from /etc/letsencrypt/renewal/npm-1.conf produced an unexpected error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.. Skipping.

All renewal attempts failed. The following certs could not be renewed:

/etc/letsencrypt/live/npm-1/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)

at ChildProcess.exithandler (child_process.js:308:12)
at ChildProcess.emit (events.js:314:20)
at maybeClose (internal/child_process.js:1051:16)
at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5)

While writing this I saw this log popup, I don't know if this is automatic or induced by me trying to manually renew it after boot:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Cert is due for renewal, auto-renewing...
Non-interactive renewal: random delay of 191.0528635024342 seconds
Plugins selected: Authenticator dns-cloudflare, Installer None
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for mydomain.com
dns-01 challenge for mydomain.com
Unsafe permissions on credentials configuration file: /etc/letsencrypt/credentials/credentials-1
Encountered CloudFlareAPIError adding TXT record: 81057 Record already exists.
Cleaning up challenges
Attempting to renew cert (npm-1) from /etc/letsencrypt/renewal/npm-1.conf produced an unexpected error: Error communicating with the Cloudflare API: Record already exists.. Skipping.

All renewal attempts failed. The following certs could not be renewed:

/etc/letsencrypt/live/npm-1/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)

After another Manual try with timeout error it did actually work:

[4/4/2021] [10:10:15 PM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via Cloudflare for Cert #1: *.mydomain.com, mydomain.com
[4/4/2021] [10:13:51 PM] [SSL ] › ℹ info - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/npm-1.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/npm-1/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/npm-1/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

So my certs have now renewed but I would like it to also work automatically/more reliably.
Is there anything I can do to try and help find a solution to this?

<!-- gh-comment-id:813091334 --> @ikomhoog commented on GitHub (Apr 4, 2021): I have the same issue, I have all my records without Cloudflare proxy, just the grey cloud symbol. But when I try it manually I get a timeout error. I got this log 2x repeated: ``` Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS. Attempting to renew cert (npm-1) from /etc/letsencrypt/renewal/npm-1.conf produced an unexpected error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.. Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/npm-1/fullchain.pem (failure) 1 renew failure(s), 0 parse failure(s) at ChildProcess.exithandler (child_process.js:308:12) at ChildProcess.emit (events.js:314:20) at maybeClose (internal/child_process.js:1051:16) at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5) ``` While writing this I saw this log popup, I don't know if this is automatic or induced by me trying to manually renew it after boot: ``` Saving debug log to /var/log/letsencrypt/letsencrypt.log Cert is due for renewal, auto-renewing... Non-interactive renewal: random delay of 191.0528635024342 seconds Plugins selected: Authenticator dns-cloudflare, Installer None Renewing an existing certificate Performing the following challenges: dns-01 challenge for mydomain.com dns-01 challenge for mydomain.com Unsafe permissions on credentials configuration file: /etc/letsencrypt/credentials/credentials-1 Encountered CloudFlareAPIError adding TXT record: 81057 Record already exists. Cleaning up challenges Attempting to renew cert (npm-1) from /etc/letsencrypt/renewal/npm-1.conf produced an unexpected error: Error communicating with the Cloudflare API: Record already exists.. Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/npm-1/fullchain.pem (failure) 1 renew failure(s), 0 parse failure(s) ``` After another Manual try with timeout error it did actually work: ``` [4/4/2021] [10:10:15 PM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via Cloudflare for Cert #1: *.mydomain.com, mydomain.com [4/4/2021] [10:13:51 PM] [SSL ] › ℹ info - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/npm-1.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - new certificate deployed without reload, fullchain is /etc/letsencrypt/live/npm-1/fullchain.pem - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations, all renewals succeeded. The following certs have been renewed: /etc/letsencrypt/live/npm-1/fullchain.pem (success) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ``` So my certs have now renewed but I would like it to also work automatically/more reliably. Is there anything I can do to try and help find a solution to this?
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@ArtisanByteCrafter commented on GitHub (Apr 6, 2021):

Exact same issue here, fails auto-renew, but manual works, even though GUI returns blank error screen. happy to help if I can provide any additional info.

<!-- gh-comment-id:814367013 --> @ArtisanByteCrafter commented on GitHub (Apr 6, 2021): Exact same issue here, fails auto-renew, but manual works, even though GUI returns blank error screen. happy to help if I can provide any additional info.
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@WalterPinkman commented on GitHub (Apr 8, 2021):

I'm experiencing the same issue. I use Cloudflare DNS challenge for several LE certificates. Auto renewing fails. Manual renewing via the web GUI is very slow, but works.

Auto Renewing

[4/8/2021] [8:37:37 AM] [SSL ] › ✖ error Error: Command failed: /usr/bin/certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation

Challenge failed for domain REDACTED
Attempting to renew cert (npm-10) from /etc/letsencrypt/renewal/npm-10.conf produced an unexpected error: Some challenges have failed.. Skipping.
Challenge failed for domain REDACTED
Attempting to renew cert (npm-11) from /etc/letsencrypt/renewal/npm-11.conf produced an unexpected error: Some challenges have failed.. Skipping.
Challenge failed for domain REDACTED
Attempting to renew cert (npm-12) from /etc/letsencrypt/renewal/npm-12.conf produced an unexpected error: Some challenges have failed.. Skipping.

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/npm-10/fullchain.pem (failure)
/etc/letsencrypt/live/npm-11/fullchain.pem (failure)
/etc/letsencrypt/live/npm-12/fullchain.pem (failure)
3 renew failure(s), 0 parse failure(s)
at ChildProcess.exithandler (child_process.js:308:12)
at ChildProcess.emit (events.js:314:20)
at maybeClose (internal/child_process.js:1051:16)
at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5)

Manual Renewing via web GUI

[4/8/2021] [9:42:21 AM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via Cloudflare for Cert #10: REDACTED
[4/8/2021] [9:47:43 AM] [SSL ] › ℹ info - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/npm-10.conf

new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/npm-10/fullchain.pem

Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/npm-10/fullchain.pem (success)

<!-- gh-comment-id:815644617 --> @WalterPinkman commented on GitHub (Apr 8, 2021): I'm experiencing the same issue. I use Cloudflare DNS challenge for several LE certificates. Auto renewing fails. Manual renewing via the web GUI is very slow, but works. Auto Renewing >[4/8/2021] [8:37:37 AM] [SSL ] › ✖ error Error: Command failed: /usr/bin/certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation > >Challenge failed for domain REDACTED >Attempting to renew cert (npm-10) from /etc/letsencrypt/renewal/npm-10.conf produced an unexpected error: Some challenges have failed.. Skipping. >Challenge failed for domain REDACTED >Attempting to renew cert (npm-11) from /etc/letsencrypt/renewal/npm-11.conf produced an unexpected error: Some challenges have failed.. Skipping. >Challenge failed for domain REDACTED >Attempting to renew cert (npm-12) from /etc/letsencrypt/renewal/npm-12.conf produced an unexpected error: Some challenges have failed.. Skipping. > >All renewal attempts failed. The following certs could not be renewed: > /etc/letsencrypt/live/npm-10/fullchain.pem (failure) > /etc/letsencrypt/live/npm-11/fullchain.pem (failure) > /etc/letsencrypt/live/npm-12/fullchain.pem (failure) >3 renew failure(s), 0 parse failure(s) > at ChildProcess.exithandler (child_process.js:308:12) > at ChildProcess.emit (events.js:314:20) > at maybeClose (internal/child_process.js:1051:16) > at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5) Manual Renewing via web GUI >[4/8/2021] [9:42:21 AM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via Cloudflare for Cert #10: REDACTED >[4/8/2021] [9:47:43 AM] [SSL ] › ℹ info - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >Processing /etc/letsencrypt/renewal/npm-10.conf >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >new certificate deployed without reload, fullchain is >/etc/letsencrypt/live/npm-10/fullchain.pem >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > >Congratulations, all renewals succeeded. The following certs have been renewed: > /etc/letsencrypt/live/npm-10/fullchain.pem (success)
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@ikomhoog commented on GitHub (Apr 12, 2021):

I have just discovered that i have 733 "csr-certbot.pem" and "key-certbot.pem" files.
These we all from the 30 days up to my cert expiry date, which is when NPM starts trying to renew them if I'm not mistaken.
Maybe the others that have the same issue also have these files?
It could be something to finding out what is going wrong.
image

<!-- gh-comment-id:817875251 --> @ikomhoog commented on GitHub (Apr 12, 2021): I have just discovered that i have 733 "csr-certbot.pem" and "key-certbot.pem" files. These we all from the 30 days up to my cert expiry date, which is when NPM starts trying to renew them if I'm not mistaken. Maybe the others that have the same issue also have these files? It could be something to finding out what is going wrong. ![image](https://user-images.githubusercontent.com/9083045/114413747-8bfa8d00-9bae-11eb-99db-91c55b23bf92.png)
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@ArtisanByteCrafter commented on GitHub (Apr 12, 2021):

I appear to have the same.
image

I only had 146 files, but I believe I manually renewed within a few days of discovering it wasn't auto-renewing, so I may have less due to this.

<!-- gh-comment-id:817878984 --> @ArtisanByteCrafter commented on GitHub (Apr 12, 2021): I appear to have the same. ![image](https://user-images.githubusercontent.com/2523522/114414951-e2e37080-9b74-11eb-8dcb-506980323a10.png) I only had 146 files, but I believe I manually renewed within a few days of discovering it wasn't auto-renewing, so I may have less due to this.
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@trenetics commented on GitHub (Apr 14, 2021):

I'm experiencing the same issue. I use Cloudflare DNS challenge for several LE certificates. Auto renewing fails. Manual renewing via the web GUI is very slow, but works.

Auto Renewing

[4/8/2021] [8:37:37 AM] [SSL ] › ✖ error Error: Command failed: /usr/bin/certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation
Challenge failed for domain REDACTED
Attempting to renew cert (npm-10) from /etc/letsencrypt/renewal/npm-10.conf produced an unexpected error: Some challenges have failed.. Skipping.
Challenge failed for domain REDACTED
Attempting to renew cert (npm-11) from /etc/letsencrypt/renewal/npm-11.conf produced an unexpected error: Some challenges have failed.. Skipping.
Challenge failed for domain REDACTED
Attempting to renew cert (npm-12) from /etc/letsencrypt/renewal/npm-12.conf produced an unexpected error: Some challenges have failed.. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/npm-10/fullchain.pem (failure)
/etc/letsencrypt/live/npm-11/fullchain.pem (failure)
/etc/letsencrypt/live/npm-12/fullchain.pem (failure)
3 renew failure(s), 0 parse failure(s)
at ChildProcess.exithandler (child_process.js:308:12)
at ChildProcess.emit (events.js:314:20)
at maybeClose (internal/child_process.js:1051:16)
at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5)

Manual Renewing via web GUI

[4/8/2021] [9:42:21 AM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via Cloudflare for Cert #10: REDACTED
[4/8/2021] [9:47:43 AM] [SSL ] › ℹ info - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/npm-10.conf

new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/npm-10/fullchain.pem

Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/npm-10/fullchain.pem (success)

Experiencing same problems here as well, auto renewal fails, manual works but takes like 5 minutes pr renawal.

<!-- gh-comment-id:819797995 --> @trenetics commented on GitHub (Apr 14, 2021): > I'm experiencing the same issue. I use Cloudflare DNS challenge for several LE certificates. Auto renewing fails. Manual renewing via the web GUI is very slow, but works. > > Auto Renewing > > > [4/8/2021] [8:37:37 AM] [SSL ] › ✖ error Error: Command failed: /usr/bin/certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation > > Challenge failed for domain REDACTED > > Attempting to renew cert (npm-10) from /etc/letsencrypt/renewal/npm-10.conf produced an unexpected error: Some challenges have failed.. Skipping. > > Challenge failed for domain REDACTED > > Attempting to renew cert (npm-11) from /etc/letsencrypt/renewal/npm-11.conf produced an unexpected error: Some challenges have failed.. Skipping. > > Challenge failed for domain REDACTED > > Attempting to renew cert (npm-12) from /etc/letsencrypt/renewal/npm-12.conf produced an unexpected error: Some challenges have failed.. Skipping. > > All renewal attempts failed. The following certs could not be renewed: > > /etc/letsencrypt/live/npm-10/fullchain.pem (failure) > > /etc/letsencrypt/live/npm-11/fullchain.pem (failure) > > /etc/letsencrypt/live/npm-12/fullchain.pem (failure) > > 3 renew failure(s), 0 parse failure(s) > > at ChildProcess.exithandler (child_process.js:308:12) > > at ChildProcess.emit (events.js:314:20) > > at maybeClose (internal/child_process.js:1051:16) > > at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5) > > Manual Renewing via web GUI > > > [4/8/2021] [9:42:21 AM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via Cloudflare for Cert #10: REDACTED > > [4/8/2021] [9:47:43 AM] [SSL ] › ℹ info - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - > > Processing /etc/letsencrypt/renewal/npm-10.conf > > > > > > new certificate deployed without reload, fullchain is > > /etc/letsencrypt/live/npm-10/fullchain.pem > > > > > > Congratulations, all renewals succeeded. The following certs have been renewed: > > /etc/letsencrypt/live/npm-10/fullchain.pem (success) Experiencing same problems here as well, auto renewal fails, manual works but takes like 5 minutes pr renawal.
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@caphm commented on GitHub (Apr 14, 2021):

Having exactly the same issues. Same log output. Same result when trying to manually renew (GUI shows an error, but renewal works). I've had over 2100 *.pem files in my "keys" directory...

<!-- gh-comment-id:819841312 --> @caphm commented on GitHub (Apr 14, 2021): Having exactly the same issues. Same log output. Same result when trying to manually renew (GUI shows an error, but renewal works). I've had over 2100 *.pem files in my "keys" directory...
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@trenetics commented on GitHub (Apr 15, 2021):

Having exactly the same issues. Same log output. Same result when trying to manually renew (GUI shows an error, but renewal works). I've had over 2100 *.pem files in my "keys" directory...

I have like 4000... Can i delete them without breaking anything?

<!-- gh-comment-id:820563057 --> @trenetics commented on GitHub (Apr 15, 2021): > Having exactly the same issues. Same log output. Same result when trying to manually renew (GUI shows an error, but renewal works). I've had over 2100 *.pem files in my "keys" directory... I have like 4000... Can i delete them without breaking anything?
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@caphm commented on GitHub (Apr 16, 2021):

I have like 4000... Can i delete them without breaking anything?

All except the newest one, I guess. I did so an it didn't break anything.

<!-- gh-comment-id:820987195 --> @caphm commented on GitHub (Apr 16, 2021): > I have like 4000... Can i delete them without breaking anything? All except the newest one, I guess. I did so an it didn't break anything.
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@fabiandev commented on GitHub (Jun 7, 2021):

I had the exact same issue, and this is what seems to solve the problem for me, as the default letsencrypt.ini explicitly defines webroot as authenticator:

  • Create custom letsencrypt.ini and cloudflare.ini files
  • Overwrite default letsencrypt.ini and mount cloudflare.ini
  • Add DNS_CLOUDFLARE_CREDENTIALS to environment

Note: a few configs may be redundant (like dns-cloudflare = True in letsencrypt.ini, and DNS_CLOUDFLARE_CREDENTIALS in docker-compose.yml), but I have just tested with this exact setup and not confirmed the minimal required configuration options.

letsencrypt.ini

dns-cloudflare = True
non-interactive = True
authenticator = dns-cloudflare
dns-cloudflare-credentials = /cloudflare.ini

cloudflare.ini

dns_cloudflare_api_token = secret

docker-compose.yml

volumes:
      - ./letsencrypt.ini:/etc/letsencrypt.ini:rw
      - ./cloudflare.ini:/cloudflare.ini:ro

environment:
      - DNS_CLOUDFLARE_CREDENTIALS=/cloudflare.ini

After recreating the container, the certificates renewed automatically and the expiry date is also correct in the UI.

Before:

Screen Shot 2021-06-07 at 15 40 40

After:

Screen Shot 2021-06-07 at 15 40 24
<!-- gh-comment-id:855945506 --> @fabiandev commented on GitHub (Jun 7, 2021): I had the exact same issue, and this is what seems to solve the problem for me, as the [default `letsencrypt.ini`](https://github.com/jc21/nginx-proxy-manager/blob/717105f243655d8b5e85958f16c4cc9f213a21ef/docker/rootfs/etc/letsencrypt.ini) explicitly defines `webroot` as `authenticator`: - Create custom `letsencrypt.ini` and `cloudflare.ini` files - Overwrite default `letsencrypt.ini` and mount `cloudflare.ini` - Add `DNS_CLOUDFLARE_CREDENTIALS` to environment > Note: a few configs may be redundant (like `dns-cloudflare = True` in `letsencrypt.ini`, and `DNS_CLOUDFLARE_CREDENTIALS` in `docker-compose.yml`), but I have just tested with this exact setup and not confirmed the minimal required configuration options. `letsencrypt.ini` ``` dns-cloudflare = True non-interactive = True authenticator = dns-cloudflare dns-cloudflare-credentials = /cloudflare.ini ``` `cloudflare.ini` ``` dns_cloudflare_api_token = secret ``` `docker-compose.yml` ``` volumes: - ./letsencrypt.ini:/etc/letsencrypt.ini:rw - ./cloudflare.ini:/cloudflare.ini:ro environment: - DNS_CLOUDFLARE_CREDENTIALS=/cloudflare.ini ``` After recreating the container, the certificates renewed automatically and the expiry date is also correct in the UI. **Before:** <img width="1259" alt="Screen Shot 2021-06-07 at 15 40 40" src="https://user-images.githubusercontent.com/480710/121026845-c5aed500-c7a6-11eb-9358-65b488dad984.png"> **After:** <img width="772" alt="Screen Shot 2021-06-07 at 15 40 24" src="https://user-images.githubusercontent.com/480710/121026870-ca738900-c7a6-11eb-88b0-8256a09e660f.png">
kerem commented 2026-02-26 06:34:31 +03:00
Author
Owner
Copy link

@WalterPinkman commented on GitHub (Jun 7, 2021):

I had the exact same issue, and this is what seems to solve the problem for me, as the default letsencrypt.ini explicitly defines webroot as authenticator:

Thank you very much for sharing your solution. I can happily share that it worked for me as well.

<!-- gh-comment-id:856132639 --> @WalterPinkman commented on GitHub (Jun 7, 2021): > > > I had the exact same issue, and this is what seems to solve the problem for me, as the [default `letsencrypt.ini`](https://github.com/jc21/nginx-proxy-manager/blob/717105f243655d8b5e85958f16c4cc9f213a21ef/docker/rootfs/etc/letsencrypt.ini) explicitly defines `webroot` as `authenticator`: Thank you very much for sharing your solution. I can happily share that it worked for me as well.
kerem commented 2026-02-26 06:34:32 +03:00
Author
Owner
Copy link

@ikomhoog commented on GitHub (Jun 12, 2021):

@fabiandev thanks for the fix.

I just used the letsencrypt.ini with

dns-cloudflare = True
non-interactive = True
authenticator = dns-cloudflare

And that was enough for it to work.

<!-- gh-comment-id:860039211 --> @ikomhoog commented on GitHub (Jun 12, 2021): @fabiandev thanks for the fix. I just used the letsencrypt.ini with ``` dns-cloudflare = True non-interactive = True authenticator = dns-cloudflare ``` And that was enough for it to work.
kerem commented 2026-02-26 06:34:32 +03:00
Author
Owner
Copy link

@github-actions[bot] commented on GitHub (Mar 16, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

<!-- gh-comment-id:2001056892 --> @github-actions[bot] commented on GitHub (Mar 16, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:
kerem commented 2026-02-26 06:34:32 +03:00
Author
Owner
Copy link

@github-actions[bot] commented on GitHub (Apr 27, 2025):

Issue was closed due to inactivity.

<!-- gh-comment-id:2832901731 --> @github-actions[bot] commented on GitHub (Apr 27, 2025): Issue was closed due to inactivity.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
develop
dependabot/npm_and_yarn/backend/liquidjs-10.25.7
dependabot/npm_and_yarn/frontend/prod-minor-updates-2a16bf3987
dependabot/npm_and_yarn/frontend/dev-patch-updates-754666cf41
dependabot/npm_and_yarn/backend/basic-ftp-5.3.0
dependabot/npm_and_yarn/test/follow-redirects-1.16.0
dependabot/npm_and_yarn/test/axios-1.15.0
dependabot/npm_and_yarn/frontend/lodash-4.18.1
dependabot/npm_and_yarn/backend/lodash-4.18.1
dependabot/npm_and_yarn/test/lodash-4.18.1
dependabot/npm_and_yarn/frontend/vite-7.3.2
dependabot/npm_and_yarn/backend/prod-minor-updates-5ec19a7f21
dependabot/npm_and_yarn/frontend/lodash-es-4.18.1
dependabot/npm_and_yarn/frontend/happy-dom-20.8.9
dependabot/npm_and_yarn/backend/path-to-regexp-8.4.0
dependabot/npm_and_yarn/frontend/picomatch-4.0.4
dependabot/npm_and_yarn/backend/picomatch-2.3.2
dependabot/npm_and_yarn/frontend/yaml-1.10.3
dependabot/npm_and_yarn/test/flatted-3.4.2
dependabot/npm_and_yarn/test/tar-7.5.11
dependabot/npm_and_yarn/frontend/immutable-5.1.5
master
dependabot/npm_and_yarn/test/glob-10.5.0
dependabot/npm_and_yarn/frontend/mdast-util-to-hast-13.2.1
dependabot/npm_and_yarn/test/form-data-4.0.4
v3-abandoned
bump-freedns
openidc
ssl-passthrough-hosts
static-content
v2.14.0
v2.13.7
v2.13.6
v2.13.5
v2.13.4
v2.13.3
v2.13.2
v2.13.1
v2.13.0
v2.12.6
v2.12.5
v2.12.4
v2.12.3
v2.12.2
v2.12.1
v2.12.0
v2.11.3
v2.11.2
v2.11.1
v2.11.0
v2.10.4
v2.10.3
v2.10.2
v2.10.1
v2.10.0
v2.9.22
v2.9.21
v2.9.20
v2.9.19
v2.9.18
v2.9.17
v2.9.16
v2.9.15
v2.9.14
v2.9.13
v2.9.12
v2.9.11
v2.9.10
v2.9.9
v2.9.8
v2.9.7
v2.9.6
v2.9.5
v2.9.4
v2.9.3
v2.9.2
v2.9.1
v2.9.0
v2.8.1
v2.8.0
v2.7.3
v2.7.2
v2.7.1
v2.7.0
v2.6.2
v2.6.1
v2.6.0
v2.5.0
v2.4.0
v2.3.1
v2.3.0
v2.2.4
v2.2.3
v2.2.2
v2.2.1
v2.2.0
v2.1.2
v2.1.1
v2.1.0
2.0.14
2.0.13
2.0.12
2.0.11
2.0.10
2.0.9
2.0.8
2.0.7
2.0.6
2.0.5
2.0.4
2.0.3
2.0.2
2.0.0
v2.0.0
1.1.2
1.1.1
1.0.1
Labels
Clear labels   
awaiting feedback

   
bug

   
cannot reproduce

   
dns provider request

   
duplicate

   
enhancement

   
enhancement

   
enhancement

   
good first issue

   
help wanted

   
invalid

   
need more info

   
no certbot plugin available

   
product-support

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
stale

   
troll

   
upstream issue

   
v2

   
v2

   
v2

   
v3

   
wontfix
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/nginx-proxy-manager-NginxProxyManager#812
No description provided.