[GH-ISSUE #1174] DNS Challenge with LuaDNS failing

kerem commented

2026-02-26 06:35:13 +03:00

Owner

Originally created by @ParadingLunatic on GitHub (Jun 14, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1174

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
- Yes
Are you sure you're not using someone else's docker image?
- Yes
Have you searched for similar issues (both open and closed)?
- Yes (There was a similar error recently about "invalid argument 'type'" but this appears different.)

Describe the bug
When trying to issue a new or even renew certificates with LuaDNS DNS challenge it's failing

While trying to issue a new SSL cert with DNS challenge receive the following error (email address and domain omitted...was not wildcard)
Error: Command failed: /opt/certbot/bin/certbot certonly --non-interactive --cert-name "npm-18" --agree-tos --email "emailaddres@omitted" --domains "domain.omitted" --authenticator dns-luadns --dns-luadns-credentials "/etc/letsencrypt/credentials/credentials-18"
usage:
certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

Certbot can obtain and install HTTPS/TLS/SSL certificates. By default,
it will attempt to use a webserver both for obtaining and installing the
certificate.
certbot: error: unrecognized arguments: --dns-luadns-credentials /etc/letsencrypt/credentials/credentials-18

at ChildProcess.exithandler (node:child_process:326:12)
at ChildProcess.emit (node:events:369:20)
at maybeClose (node:internal/child_process:1067:16)
at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5)

During Renewal I'm seeing the following error:

[6/14/2021] [11:08:32 AM] [SSL ] › ✖ error Error: Command failed: /opt/certbot/bin/certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation

Renewal configuration file /etc/letsencrypt/renewal/npm-15.conf (cert: npm-15) produced an unexpected error: 'Namespace' object has no attribute 'dns_luadns_credentials'. Skipping.

Nginx Proxy Manager Version
Version 2.9.3

To Reproduce
Steps to reproduce the behavior for new SSL cert:

Go to SSL Certificates
Click on Add SSL Certificate
Click on LetsEncrypt
Fill out form
Select Use a DNS Challenge
Choose LuaDNS for the provider
Fill out the rest of the info
Error above received

Steps to reproduce the behavior for renewal happen automatically. Restarted the docker container.

Expected behavior
After a minute or two, an SSL cert should be issued

Operating System
Docker container on debian

Additional context
I'm not entirely sure when this started to be a problem. I only recently started using DNS challenge and have only had to renew once so whatever broke it, it has been within the last 6 to 9 months.

Originally created by @ParadingLunatic on GitHub (Jun 14, 2021). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1174 **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes (There was a similar error recently about "invalid argument 'type'" but this appears different.) **Describe the bug** When trying to issue a new or even renew certificates with LuaDNS DNS challenge it's failing While trying to issue a new SSL cert with DNS challenge receive the following error (email address and domain omitted...was not wildcard) Error: Command failed: /opt/certbot/bin/certbot certonly --non-interactive --cert-name "npm-18" --agree-tos --email "emailaddres@omitted" --domains "domain.omitted" --authenticator dns-luadns --dns-luadns-credentials "/etc/letsencrypt/credentials/credentials-18" usage: certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ... Certbot can obtain and install HTTPS/TLS/SSL certificates. By default, it will attempt to use a webserver both for obtaining and installing the certificate. certbot: error: unrecognized arguments: --dns-luadns-credentials /etc/letsencrypt/credentials/credentials-18 at ChildProcess.exithandler (node:child_process:326:12) at ChildProcess.emit (node:events:369:20) at maybeClose (node:internal/child_process:1067:16) at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5) During Renewal I'm seeing the following error: [6/14/2021] [11:08:32 AM] [SSL ] › ✖ error Error: Command failed: /opt/certbot/bin/certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation Renewal configuration file /etc/letsencrypt/renewal/npm-15.conf (cert: npm-15) produced an unexpected error: 'Namespace' object has no attribute 'dns_luadns_credentials'. Skipping. **Nginx Proxy Manager Version** Version 2.9.3 **To Reproduce** Steps to reproduce the behavior for new SSL cert: 1. Go to SSL Certificates 2. Click on Add SSL Certificate 3. Click on LetsEncrypt 4. Fill out form 5. Select Use a DNS Challenge 6. Choose LuaDNS for the provider 7. Fill out the rest of the info 8. Error above received Steps to reproduce the behavior for renewal happen automatically. Restarted the docker container. **Expected behavior** After a minute or two, an SSL cert should be issued **Operating System** Docker container on debian **Additional context** I'm not entirely sure when this started to be a problem. I only recently started using DNS challenge and have only had to renew once so whatever broke it, it has been within the last 6 to 9 months.

kerem

2026-02-26 06:35:13 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-26 06:35:14 +03:00

Author

Owner

@jbonet commented on GitHub (Jun 15, 2021):

It's the certbot / certbot dns plugin version, there is a bug. Manually update certbot and the plugin and it should be good to go.

They should push an updated image with updated certbot...

@jbonet commented on GitHub (Jun 15, 2021): It's the certbot / certbot dns plugin version, there is a bug. Manually update certbot and the plugin and it should be good to go. They should push an updated image with updated certbot...

kerem commented

2026-02-26 06:35:14 +03:00

Author

Owner

@chaptergy commented on GitHub (Jun 15, 2021):

@jbonet Could you link the bug if there is any thing available? Just to know what to update to which version. If you are talking about the unexpected keyword issue, the current npm version was updated to include the new certbot version. See https://github.com/jc21/nginx-proxy-manager/issues/1119#issuecomment-846843724 on how to update. But this issue does not seem related to that, however you could wait and check, whether the issue still persists with the new version.

@chaptergy commented on GitHub (Jun 15, 2021): @jbonet Could you link the bug if there is any thing available? Just to know what to update to which version. If you are talking about the [unexpected keyword](https://github.com/jc21/nginx-proxy-manager/issues/1119) issue, the current npm version was updated to include the new certbot version. See https://github.com/jc21/nginx-proxy-manager/issues/1119#issuecomment-846843724 on how to update. But this issue does not seem related to that, however you could wait and check, whether the issue still persists with the new version.

kerem commented

2026-02-26 06:35:14 +03:00

Author

Owner

@ParadingLunatic commented on GitHub (Jun 15, 2021):

@jbonet from a shell inside the docker container I ran pip install certbot --upgrade. Didn't seem to make any difference. Is there something else I should be doing?

@ParadingLunatic commented on GitHub (Jun 15, 2021): @jbonet from a shell inside the docker container I ran pip install certbot --upgrade. Didn't seem to make any difference. Is there something else I should be doing?

kerem commented

2026-02-26 06:35:14 +03:00

Author

Owner

@chaptergy commented on GitHub (Jun 17, 2021):

Please check with pip show certbot-dns-luadns whether the luaDNS addon is installed at all, and with certbot plugins whether certbot recognizes the plugin.

@chaptergy commented on GitHub (Jun 17, 2021): Please check with `pip show certbot-dns-luadns` whether the luaDNS addon is installed at all, and with `certbot plugins` whether certbot recognizes the plugin.

kerem commented

2026-02-26 06:35:14 +03:00

Author

Owner

@ParadingLunatic commented on GitHub (Jun 17, 2021):

certbot plugins:

dns-luadns
Description: Obtain certificates using a DNS TXT record (if you are using LuaDNS
for DNS).
Interfaces: IAuthenticator, IPlugin
Entry point: dns-luadns = certbot_dns_luadns._internal.dns_luadns:Authenticator
standalone
Description: Spin up a temporary webserver
Interfaces: IAuthenticator, IPlugin
Entry point: standalone = certbot._internal.plugins.standalone:Authenticator
webroot
Description: Place files in webroot directory
Interfaces: IAuthenticator, IPlugin
Entry point: webroot = certbot._internal.plugins.webroot:Authenticator

pip show certbot-dns-luadns
Name: certbot-dns-luadns
Version: 1.8.0
Summary: LuaDNS Authenticator plugin for Certbot
Home-page: https://github.com/certbot/certbot
Author: Certbot Project
Author-email: client-dev@letsencrypt.org
License: Apache License 2.0
Location: /usr/local/lib/python3.7/dist-packages
Requires: acme, zope.interface, certbot, dns-lexicon, setuptools
Required-by:

@ParadingLunatic commented on GitHub (Jun 17, 2021): certbot plugins: * dns-luadns Description: Obtain certificates using a DNS TXT record (if you are using LuaDNS for DNS). Interfaces: IAuthenticator, IPlugin Entry point: dns-luadns = certbot_dns_luadns._internal.dns_luadns:Authenticator * standalone Description: Spin up a temporary webserver Interfaces: IAuthenticator, IPlugin Entry point: standalone = certbot._internal.plugins.standalone:Authenticator * webroot Description: Place files in webroot directory Interfaces: IAuthenticator, IPlugin Entry point: webroot = certbot._internal.plugins.webroot:Authenticator pip show certbot-dns-luadns Name: certbot-dns-luadns Version: 1.8.0 Summary: LuaDNS Authenticator plugin for Certbot Home-page: https://github.com/certbot/certbot Author: Certbot Project Author-email: client-dev@letsencrypt.org License: Apache License 2.0 Location: /usr/local/lib/python3.7/dist-packages Requires: acme, zope.interface, certbot, dns-lexicon, setuptools Required-by:

kerem commented

2026-02-26 06:35:14 +03:00

Author

Owner

@chaptergy commented on GitHub (Jun 17, 2021):

Maybe similar issue as https://github.com/jc21/nginx-proxy-manager/issues/1109?

@chaptergy commented on GitHub (Jun 17, 2021): Maybe similar issue as https://github.com/jc21/nginx-proxy-manager/issues/1109?

kerem commented

2026-02-26 06:35:14 +03:00

Author

Owner

@ParadingLunatic commented on GitHub (Jun 17, 2021):

It's possible. Just typed which certbot and it returned /usr/local/bin/certbot

If I cd to /opt/certbot/bin and do ./certbot plugins I only get the following

standalone
Description: Spin up a temporary webserver
Interfaces: IAuthenticator, IPlugin
Entry point: standalone = certbot._internal.plugins.standalone:Authenticator
webroot
Description: Place files in webroot directory
Interfaces: IAuthenticator, IPlugin
Entry point: webroot = certbot._internal.plugins.webroot:Authenticator

Il tried renaming the certbot under /opt/..... and copy the one from /usr/local/... in its place. It seemed a little better. It at least tried, but timed out. Can't run it again as the initial attempt is apparently still running in the background.

Ok...it took a little extra time but it finally succeeded. So I was at least able to renew my existing cert that was about to expire. I'll try and issue a new cert later.

@ParadingLunatic commented on GitHub (Jun 17, 2021): It's possible. Just typed `which certbot` and it returned /usr/local/bin/certbot If I cd to /opt/certbot/bin and do ./certbot plugins I only get the following * standalone Description: Spin up a temporary webserver Interfaces: IAuthenticator, IPlugin Entry point: standalone = certbot._internal.plugins.standalone:Authenticator * webroot Description: Place files in webroot directory Interfaces: IAuthenticator, IPlugin Entry point: webroot = certbot._internal.plugins.webroot:Authenticator Il tried renaming the certbot under /opt/..... and copy the one from /usr/local/... in its place. It seemed a little better. It at least tried, but timed out. Can't run it again as the initial attempt is apparently still running in the background. Ok...it took a little extra time but it finally succeeded. So I was at least able to renew my existing cert that was about to expire. I'll try and issue a new cert later.

kerem commented

2026-02-26 06:35:14 +03:00

Author

Owner

@ParadingLunatic commented on GitHub (Jun 22, 2021):

I noticed 2.9.4 was released. Updated my docker container and tried creating a new SSL cert with the LuaDNS DNS challenge. Initially it failed because certbot was already running. Noticed eventually in my logs I had two old certs that failed to renew. Not sure why the certs still exist for renewal even though they were deleted. Anyway, after doing some manual cleanup of the leftover certs I was able to successfully issue a new cert. I'm going to go ahead and close this as I'm pretty confident the fixes in 2.9.4 also fixed the renewal issue.

@ParadingLunatic commented on GitHub (Jun 22, 2021): I noticed 2.9.4 was released. Updated my docker container and tried creating a new SSL cert with the LuaDNS DNS challenge. Initially it failed because certbot was already running. Noticed eventually in my logs I had two old certs that failed to renew. Not sure why the certs still exist for renewal even though they were deleted. Anyway, after doing some manual cleanup of the leftover certs I was able to successfully issue a new cert. I'm going to go ahead and close this as I'm pretty confident the fixes in 2.9.4 also fixed the renewal issue.

Rows
Columns

[GH-ISSUE #1174] DNS Challenge with LuaDNS failing #961