Internal Error trying to renew cert #396
Comments
|
I had a similar issue and fixed it by deleting the certificate that was having issues in "SSL Certificates" tab and requested the certificate again. Before you try this you might want to backup the database and configuration files just in case. |
|
I'm having this issue as well, tried restarting the container and clearing out the certificates that keep failing ( I only set this up for the 1st time yesterday). I can't get it to work When I request I get an error Then I see the errors in the log like @AnonJervis If I navigate to SSL Certificates page, I can see an entry still but it wont work |
|
I'm having the same issue as well. Renewing manually times out and deleting then re-adding the cert gives "internal error". |
|
@kizza42 and @CorySanin I believe the "internal error" notifications may be fixed in PR #407 |
|
switched my existing Docker container over to Actually, a couple of them were able to renew. But most don't. But the ones that renewed probably would have worked before switching to the tag for the pr. |
|
Are the ones that are failing linked to hosts that have an applied access list? |
|
I have some with and without access lists, and the ones without are also failing. But looking at the logs I see |
|
My log after I restart the container: Those broken files: So I removed them all and restarted container and tried to create a cert only: And /var/log/letsencrypt/letsencrypt.log |
|
Firstly, the error in the issue at the top says that the challenge has failed. This would be due to you asking for a cert for I doubt any of this has anything to do with access lists. The missing files make me think that maybe the |
|
Thankyou for the help @jc21 |
|
Also experiencing this issue. From the logs: At first thought this was due to a bad install or something, so have a complete clean install and experiencing this. Checked DNS settings, all records are pointing to the correct IP and also checked firewall rules (not that any of these have changed recently). Interestingly this worked fine a week ago. |
|
Also experiencing an My docker-compose.yml The volumes exist, I have files in the folder '2f1011068b45be8e10e11180c968b254' it describes as a permission issue. Latest v2.2.4. Any help is appreciated. |
|
Pretty bummed there's no direction on how to resolve this. Anyone thinking about going the manual certificate renewal route? Sounds like a pain, but this is debilitating for my network communication :( |
|
My certificates are coming up for renewal and it's failing as well. 20 days before they start expiring. Any guidance on how to resolve? |
|
Time-consuming workaround for me is:
Go to your DNS-settings of your Domain and add the following record: wait 5 minutes and press enter in your CLI to verify your domain Exit the container and go to ./letsencrypt/ and retrieve the cert and cert key. Go to the Manager and http://192.168.1.100:81/nginx/certificates and add a custom certificate by uploading those files. |
|
Would love an update on this very crippling bug, or be pointed in the direction of the last Docker tag that didn't have this. |
|
I don't know if it will help, but I ended up giving up. And going to another docker solution that supports dns challenges. Once you configure it is 100% automatic (and also doesn't need you to have your http port open). Perhaps this could be something to explore for the future of NPM. |
|
I also gave up and moved completely away from Nginx Proxy Manager. Had great success for a year or so, but this SSL issue is crippling. It took me 1hr to install Caddy2 and replicate everything I had. |
|
which solution did you go for in the end @Xinil and @Tsunami2056 ? |
I ended up setting up linuxserver's letsencrypt docker, a little more manual, but supports dns challenges with API plugins for alot of providers. And all is also automated. If ever at one point there's dns challenging that's automated in npm, I would probably switch back though, it's still alot easier. |
|
Funnily enough, the non-official docker image of NPM works totally fine - so I just started using that. |
|
It looks like there was a change in the way the certs were written. New certs are written as root vs the uid specified in the docker setup, also the keys that are located in the live directory are now symlinks. I think these issues are the main cause of the errors My fix was to edit each domain, go into the ssl tab and request a new cert. After that I deleted the old certs in the ssl certificates tab. This didn't get rid of the old conf files, so I opened a shell (I'm using portainer) then ran 'certbot renew' this will give you a list of bad conf files. Then I went to '/etc/letsencrypt/renewal' and deleted the conf files that were giving me errors. To see if it worked I reran 'certbot renew'. The messages came back as skipped which is what I should see. |
|
Does anybody know what is the latest image that does not have this issue? All my certs are already expired and none of the workarounds worked for me (or I didn't understand them). The non-official package does not work on ARM, so no RPi support. |
|
Two things: I'm using v2.5.0 and I might have a workaround:
|
|
Installed NPM through docker compose a few days ago and have been able to setup the proxy & to get a LetsEncrypt certificate. Now, a few days later I cannot get any more certificates and I can see exceptions in the logs. When I try to renew a cert I get an internal error. Removed the whole container and the db, reinstalled with new folders for letsencrypt and config, tried with a new subdomain and still the same issue. What I understand from the log is, that there seem to be connection errors. However, the host can access @jc21 can you help narrowing this down? Below the logs from within portainer after I reinstalled the container. my docker-compose: |
|
I have this exact same problem. I keep getting an error. I have two instances: one local and one on a vps. vps has no problems. Which logs should i add for info? |
|
Found the solution. Steps I took:
Hopefully I'm helping someone out there. |
|
I am still facing this error for creating the Certificate too. This is the error I am seeing, can some one help please? |
|
How to resolve this issue? |
|
For me it was a problem with Access Lists. |
|
For those who get an Internal Error while trying to renew certs and have this or a similar error message in their logs: Try this #1816 (comment) |
|
@LeducH I was able to resolve the problem through the UI.
After doing the above steps for each of my Proxy Hosts, they can be renewed from the GUI. I'm not sure if Auto-renew will work but I guess I'll find out in a couple months. |
|
I found a solution to get a renewal. ) mayby a reboot of the nginx service helps to push the new cert I hope this will help you guys too. |
|
For me this was happening to one specific proxy so I knew it must be down to something special about this host. Checked myself several times, protocol correct, ip correct, port correct. Anyway it was my bad. Although I had DNS setup correctly to point the domain to NGinxPM, I also had a left over NAT rule on my firewall that was forwarding incoming directly to the original machine, not NPM. So could be worth checking your firewall to make sure you've not done something as dumb as I did. |
I wish it were that simple. I have a half dozen domains on a single IP going to multiple servers. If I had a NAT rule wrong then only one of those servers would be remotely accessible. |
|
I don't know if it's the same error, but I can't renew some certs (not sure why some are affected and some are not) unless I turn off all the SSL settings in the proxy host. Turn off force SSL, turn off HTTP/2, turn off HSTS. Go to certs and renew works, then I have to go back and turn all that back on. Not a great solution. |
I have the same issue. Can't renew specific certs unless I've turned all the SSL settings off. I could provide my logs later that day. Tested it on just one host that was failing, still plenty of hosts to test it. :D |
Tested it now on a few hosts, I have to disable the "Force SSL" under SSL-Settings to renew my certs. When I don't disable it I'll get the "internal error" with the following logs on version 2.9.19: `2023-01-23 14:59:03,971:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/197593605707 HTTP/1.1" 200 805 { { Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet. 2023-01-23 14:59:07,129:DEBUG:certbot._internal.error_handler:Encountered exception: 2023-01-23 14:59:07,129:DEBUG:certbot._internal.error_handler:Calling registered functions 2023-01-23 14:59:07,131:DEBUG:certbot._internal.display.obj:Notifying user: 2023-01-23 14:59:07,131:ERROR:certbot._internal.renewal:All renewals failed. The following certificates could not be renewed: |
|
+1 as someone else experiencing this error - I've been flooded with renewal emails from LetsEncrypt, and it seems the certs don't auto renew... Fortunately, it was only 2 or 3 certs so I manually deleted them and re-requested them without issues. Is there any workaround identified? The logs I get are the below, and seem to be continuous: |
|
Same issue here - just had 10 renewal notices this morning - it had been working fine and now none have renewed. @jc21 or anyone else, any word on a fix for this? It's getting to be a fairly major issue and is quite frustrating to have to keep recreating all the certs every month! |
|
Yes, indeed. The issue is still present in the latest version. The only option is to delete and request a new certificate. Hope for a fix. THANK YOU. |
|
In my case, this issue was solved by deleting the IPv6 address from the DNS record. |
|
I had the same issue and solved it by adding a DNS CAA record for the HOST.MYDOMAIN.TLD and setting letsencrypt.org as an authorized certificate provider (I use EasyDNS). |
|
Sadly I don't think that's an option for my DNS provider. The thing is it used to work fine and the issue seems to be around https being enforced even for the LetsEncrypt check so I'm hoping it's sortable in the code... |
I do not know if it helps, but I had the "Force SSL" option selected in npm, and it worked. I do not know either if all DNS providers are enforcing the CAA requirement. I wish you good luck. |
Yep it seems intermittent - when it stopped working I found if I switch that off it seems to work again obtaining certs, but at present both servers have SSL certs far enough away it's not trying to renew them yet |
|
"Force SSL" option was the problem on my site. Get this fixe from this site: https://community.alarmiator.de/t/lets-encrypt-zertifikat-wird-von-nginx-proxy-manager-nicht-aktualisiert/380/3 |
This works for me. I was already thinking about an alternative for npm. Thank you. P.S. vielen Dank für die Lösung, die Kaffeepause haben Sie sich definitiv verdient. ;) |
Yep - see the PR I did a few weeks ago - #3121 - has been fine for me since then too. |
This worked for me too! Just replaced the original file with the one from the link (of course after making a backup ;-) ) Vielen Dank und immer frischen, guten Kaffee! |
|
Yep - for any not comfortable with making changes themselves, see the PR above I did that made those changes ;) |
|
For me, the problem was different. I've executed the certbot directly in the nginxproxymanager docker container and the problem was more explicit: So I've simply copied the files in ../../archive/npm-3 (actually it was not necessary because the files were already there with the name cert3.pem, chain3.pem, ...) of course, replace the "3" by the number matching your situation (the biggest one in the archive directory) and it works. I've renewed the certificates successfully from the user interface. I hope it will help. |
|
I use nginx proxy manager and now it simply does not update the certificates in any way. I would like to know what the problem is, where exactly do I see the error occurring 500 internal error, I want to know what internal error this is, what is the real error message, where can I find it? I cannot renew this certificate manually in some way, I need to renew the certificate and I do not know how to solve it, apparently there are millions of people looking for a solution to the problem and cannot solve it...., in my case both port 80 and 443 are being redirected. Normally I have some hosts running on 80 and others on 443 and others with an expired certificate and I need to renew some solution?, is the problem in letsencrypt or in nginx proxy manager? |
Hey, you can check the logs of the Docker container with "docker logs %container%" replace %container% with your npm-container-name i.e. npm-app-1. |
and others
I was trying to renew my cert running version 2.2.1 and the following error popped up:
I tried restarting the container to renew again and the log shows:
I decided to update to latest and the problem persists, so I completely deleted my npm container and it's data and start a whole new instance. However, I still cannot renew and now my SSL cert expired the moment I tried registering. This is not my only webserver trying to renew SSL and its happening to my other ones as well. I've tried creating with sub.subdomain.duckdns.org and it registered fine. Here is my log after starting everything fresh:
Could this be possible bug in the latest update? Could it be my domain has already been registered with let's encrypted before, I cannot re-register a new one when I start a new container?
The text was updated successfully, but these errors were encountered: