starred/nginx-ui

Fork 0

mirror of https://github.com/0xJacky/nginx-ui.git synced 2026-04-25 08:45:58 +03:00

[GH-ISSUE #1372] [BUG] Certificate Renewal Error in Nginx UI (JWS verification error) #6536

New issue

Closed

opened 2026-03-01 17:12:53 +03:00 by kerem · 7 comments

kerem commented

2026-03-01 17:12:53 +03:00

Owner

Originally created by @zdv1g on GitHub (Oct 4, 2025).
Original GitHub issue: https://github.com/0xJacky/nginx-ui/issues/1372

Describe the bug
When trying to renew an SSL certificate via Nginx UI, the renewal process fails with a JWS verification error.
The currently active certificate remains valid, but auto-renewal does not work.

To Reproduce
Steps to reproduce the behavior:

Go to Nginx UI → SSL
Click on Renew certificate
Wait for the process to start
See the error in logs

Expected behavior
The certificate should be successfully renewed through ACME (Let’s Encrypt) without JWS validation errors.

Screenshots
N/A

Info (please complete the following information):

Server OS: Debian 13 (bare metal, no Docker)
Server Arch: x86_64
Nginx UI Version: v2.1.17 (876213ad)
Your Browser: Chrome (latest)

Additional context
Error log:
[Error] renew cert error: acme: error: 400 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn:ietf:params:acme:error:malformed :: Unable to validate JWS :: JWS verification error

The ACME account is associated with more than 6 domains.
Current certificate is still valid, but renewal fails.
ACME challenge method in use: DNS Method 1.
Possible cause: invalid JWS signing, expired/corrupted ACME account registration, or time sync issues.

Originally created by @zdv1g on GitHub (Oct 4, 2025). Original GitHub issue: https://github.com/0xJacky/nginx-ui/issues/1372 **Describe the bug** When trying to renew an SSL certificate via Nginx UI, the renewal process fails with a JWS verification error. The currently active certificate remains valid, but auto-renewal does not work. **To Reproduce** Steps to reproduce the behavior: 1. Go to `Nginx UI → SSL` 2. Click on `Renew certificate` 3. Wait for the process to start 4. See the error in logs **Expected behavior** The certificate should be successfully renewed through ACME (Let’s Encrypt) without JWS validation errors. **Screenshots** N/A **Info (please complete the following information):** - Server OS: Debian 13 (bare metal, no Docker) - Server Arch: x86_64 - Nginx UI Version: v2.1.17 (876213ad) - Your Browser: Chrome (latest) **Additional context** Error log: [Error] renew cert error: acme: error: 400 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn:ietf:params:acme:error:malformed :: Unable to validate JWS :: JWS verification error - The ACME account is associated with **more than 6 domains**. - Current certificate is still valid, but renewal fails. - ACME challenge method in use: **DNS Method 1**. - Possible cause: invalid JWS signing, expired/corrupted ACME account registration, or time sync issues.

kerem

2026-03-01 17:12:53 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-01 17:12:54 +03:00

Author

Owner

@0xJacky commented on GitHub (Oct 4, 2025):

The ACME account is associated with more than 6 domains?

@0xJacky commented on GitHub (Oct 4, 2025): The ACME account is associated with more than 6 domains?

kerem commented

2026-03-01 17:12:54 +03:00

Author

Owner

@zdv1g commented on GitHub (Oct 4, 2025):

/certificates/acme_users (1 user) -> more 6 domains (cert renew)
Yes, correct.
The ACME account in use is a single account under "ACME User" in Nginx UI, and it manages renewal for more than 6 domains.
All renewals are attempted from this one account.

@zdv1g commented on GitHub (Oct 4, 2025): /certificates/acme_users (1 user) -> more 6 domains (cert renew) Yes, correct. The ACME account in use is a single account under **"ACME User"** in Nginx UI, and it manages renewal for more than 6 domains. All renewals are attempted from this one account.

kerem commented

2026-03-01 17:12:54 +03:00

Author

Owner

@zdv1g commented on GitHub (Oct 4, 2025):

Oct 04 13:38:41 NginxUI nginx-ui[130]: 2025-10-04 13:38:41 INFO cert/auto_cert.go:23 AutoCert Worker Started
Oct 04 13:38:41 NginxUI nginx-ui[130]: 2025-10-04 13:38:41 INFO cert/logger.go:72 AutoCert [Nginx UI] Preparing lego configurations
Oct 04 13:38:41 NginxUI nginx-ui[130]: 2025-10-04 13:38:41 INFO cert/logger.go:72 AutoCert [Nginx UI] ACME User: xxxxxx@xxxxxx, Email: xxxxxx@xxxx, CA Dir: https://acme-v02.api.letsencrypt.org/direct>
Oct 04 13:38:41 NginxUI nginx-ui[130]: 2025-10-04 13:38:41 INFO cert/logger.go:72 AutoCert [Nginx UI] Creating client facilitates communication with the CA server
Oct 04 13:38:42 NginxUI nginx-ui[130]: 2025-10-04 13:38:42 INFO cert/logger.go:72 AutoCert [Nginx UI] Setting DNS01 challenge provider
Oct 04 13:38:42 NginxUI nginx-ui[130]: 2025-10-04 13:38:42 INFO cert/logger.go:72 AutoCert [Nginx UI] Setting environment variables
Oct 04 13:38:42 NginxUI nginx-ui[130]: 2025-10-04 13:38:42 INFO cert/logger.go:72 AutoCert 2025/10/04 13:38:42 [INFO] [.xxx.ru] acme: Trying renewal with 1758 hours remaining
Oct 04 13:38:42 NginxUI nginx-ui[130]: 2025-10-04 13:38:42 INFO cert/logger.go:72 AutoCert 2025/10/04 13:38:42 [INFO] [.xxx.ru, xxx.ru] acme: Obtaining bundled SAN certificate
Oct 04 13:38:43 NginxUI nginx-ui[130]: 2025-10-04 13:38:43 INFO cert/logger.go:72 AutoCert [Nginx UI] Environment variables cleaned
Oct 04 13:38:43 NginxUI nginx-ui[130]: 2025-10-04 13:38:43 ERROR cert/logger.go:85 AutoCert renew cert error: acme: error: 400 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn:ietf:params:>
Oct 04 13:38:43 NginxUI nginx-ui[130]: 2025-10-04 13:38:43 INFO cert/logger.go:72 AutoCert [Nginx UI] Preparing lego configurations

@zdv1g commented on GitHub (Oct 4, 2025): Oct 04 13:38:41 NginxUI nginx-ui[130]: 2025-10-04 13:38:41 INFO cert/auto_cert.go:23 AutoCert Worker Started Oct 04 13:38:41 NginxUI nginx-ui[130]: 2025-10-04 13:38:41 INFO cert/logger.go:72 AutoCert [Nginx UI] Preparing lego configurations Oct 04 13:38:41 NginxUI nginx-ui[130]: 2025-10-04 13:38:41 INFO cert/logger.go:72 AutoCert [Nginx UI] ACME User: xxxxxx@xxxxxx, Email: xxxxxx@xxxx, CA Dir: https://acme-v02.api.letsencrypt.org/direct> Oct 04 13:38:41 NginxUI nginx-ui[130]: 2025-10-04 13:38:41 INFO cert/logger.go:72 AutoCert [Nginx UI] Creating client facilitates communication with the CA server Oct 04 13:38:42 NginxUI nginx-ui[130]: 2025-10-04 13:38:42 INFO cert/logger.go:72 AutoCert [Nginx UI] Setting DNS01 challenge provider Oct 04 13:38:42 NginxUI nginx-ui[130]: 2025-10-04 13:38:42 INFO cert/logger.go:72 AutoCert [Nginx UI] Setting environment variables Oct 04 13:38:42 NginxUI nginx-ui[130]: 2025-10-04 13:38:42 INFO cert/logger.go:72 AutoCert 2025/10/04 13:38:42 [INFO] [*.xxx.ru] acme: Trying renewal with 1758 hours remaining Oct 04 13:38:42 NginxUI nginx-ui[130]: 2025-10-04 13:38:42 INFO cert/logger.go:72 AutoCert 2025/10/04 13:38:42 [INFO] [*.xxx.ru, xxx.ru] acme: Obtaining bundled SAN certificate Oct 04 13:38:43 NginxUI nginx-ui[130]: 2025-10-04 13:38:43 INFO cert/logger.go:72 AutoCert [Nginx UI] Environment variables cleaned Oct 04 13:38:43 NginxUI nginx-ui[130]: 2025-10-04 13:38:43 ERROR cert/logger.go:85 AutoCert renew cert error: acme: error: 400 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn:ietf:params:> Oct 04 13:38:43 NginxUI nginx-ui[130]: 2025-10-04 13:38:43 INFO cert/logger.go:72 AutoCert [Nginx UI] Preparing lego configurations

kerem commented

2026-03-01 17:12:54 +03:00

Author

Owner

@0xJacky commented on GitHub (Oct 5, 2025):

I'm not quite sure if this is a new policy by Let's Encrypt. Could you try creating a new ACME account with a different email address and then use it to reapply for the certificate?

@0xJacky commented on GitHub (Oct 5, 2025): I'm not quite sure if this is a new policy by Let's Encrypt. Could you try creating a new ACME account with a different email address and then use it to reapply for the certificate?

kerem commented

2026-03-01 17:12:54 +03:00

Author

Owner

@zdv1g commented on GitHub (Oct 5, 2025):

The certificate was created if I created a new user. Now look what a problem, when updating in automatic mode, it uses the old data (of the old Acme user)

however, the certificate renewal is successful

@zdv1g commented on GitHub (Oct 5, 2025): The certificate was created if I created a new user. Now look what a problem, when updating in automatic mode, it uses the old data (of the old Acme user) <img width="495" height="578" alt="Image" src="https://github.com/user-attachments/assets/672f92ca-dfc7-4cc5-bd3e-0e426f1d68a7" /> however, the certificate renewal is successful <img width="929" height="578" alt="Image" src="https://github.com/user-attachments/assets/a4224d25-40e7-46bd-ac64-4d1319f5e9b7" />

kerem commented

2026-03-01 17:12:54 +03:00

Author

Owner

@0xJacky commented on GitHub (Oct 5, 2025):

Fixed in 3930aaf, you can try to upgrade nginx-ui to the latest dev version to test. Thank you.

@0xJacky commented on GitHub (Oct 5, 2025): Fixed in 3930aaf, you can try to upgrade nginx-ui to the latest dev version to test. Thank you.

kerem commented

2026-03-01 17:12:54 +03:00

Author

Owner

@zdv1g commented on GitHub (Oct 5, 2025):

Okay, I'm waiting for a new release for automatic updates. I've reopened it if anything happens.

@zdv1g commented on GitHub (Oct 5, 2025): Okay, I'm waiting for a new release for automatic updates. I've reopened it if anything happens.