-
-
Notifications
You must be signed in to change notification settings - Fork 118
SSL cert not updating #400
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
I had the same issue today. I had to login to the Pi via SSH and open "/data/logs/letsencrypt/letsencrypt.log" inside the proxymanager docker container to find the exact issue was:
|
This error I got Some of certs are renewing some are not it is odd
|
Things I tried. Deleting the certificate and asking for it again from the UI worked |
I'm getting the same "Internal Error" simply when trying to create a brand new SSL cert. I was also getting the error "Another instance of Certbot is already running". I just rebooted my system to get it to shut down all processes... as obviously there was a stuck Certbot instance. After a restart, I wasn't getting the same error... Now I am just getting "Some challenges have failed" from Let's Encrypt and it's unable to generate a new certificate for me. I'm at a loss. If I use Let's Encrypt via the DuckDNS add on, it generates the SSL certs for me just fine and I am then able to reference them via NPM by adding them as "Custom" SSL certs. This works, but it's obviously not ideal because I then have to manually renew the certs anytime they come up for renewal. |
Would you mind sharing your process? I have the DuckDNS add on but I don't know where it stores the certs so I can add them as custom. My cert expired and I want to keep it going until it hopefully gets patched. I may be digging myself into a bigger hole tried to add homeassistant.something.duckdns.org I noticed in duckdns documentation the folder \ssl\ is supposed to contain the certificates but they are dated December and I tried to just install those anyways and got an error about using those certificates so I don't think those are the right ones. EDIT |
Also experiencing this issue. Addon Version: 0.12.3 Upon attempting to create or renew a cert:
Following this crash and restart…
After this point all attempted Let's Encrypt operations continue to fail. |
There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues. |
It is still a problem. |
I believe that's more of an upstream issue, cf NginxProxyManager/nginx-proxy-manager#2881 |
There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues. |
Absolutely not stale |
Do you run a firewall? |
Same issue here but deleting, trying to reissue causes more problems. I should have let them expire on their own, lost a month now...
|
There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues. |
Still a problem |
just had the same issue. For me the issue was misconfiguration under router: port 80 was not forwarded/open. Certmanager uses Port 80 to execute the HTTP check. Make sure it is open and forwarding to the correct machine |
this issue talks about problems when enabling forcing on https, the problem is that http verification is also being forced on 443 sending the whole thing into error |
There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues. |
still an issue |
I have the same issue |
I feel kinda dumb coming back to this after all this time having issues... but I think I figured out my problem... I've been using this with a DuckDNS domain and it appears it needs a DNS challenge... the DuckDNS addon for HA handles the challenge with the supplied token, which is why I never saw any issues with that addon getting a valid cert. Basically, the problem boils down to there being poor documentation for both the DuckDNS addon and this NPM addon. It was never clear to me that I NEEDED to do the DNS challenge... but it seems obvious now. Basically, I stopped using the DuckDNS addon... I no longer use a custom cert in NPM. Just have NPM create and manage the certs and use the appropriate DNS challenge for your DDNS provider. This appears to be working fine for me this way. Time will tell if the certs update properly when needed, but they should now that they have the appropriate token. |
I just tried this. Disdabled DuckDNS, NPM began working when forcing a challenge and using my DuckDNS token Thanks for this |
There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues. |
Doesn't seem to be fixed
The best work around i have found is just to delete the ssl certificate and
re created it.
…On Fri, 5 Jan 2024, 08:16 github-actions[bot], ***@***.***> wrote:
There hasn't been any activity on this issue recently, so we clean up some
of the older and inactive issues.
Please make sure to update to the latest version and check if that solves
the issue. Let us know if that works for you by leaving a comment 👍
This issue has now been marked as stale and will be closed if no further
activity occurs. Thanks!
—
Reply to this email directly, view it on GitHub
<#400 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAGBUHPMBUINLT2OIXBY3JLYM6ZEZAVCNFSM6AAAAAAUU4EQB2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQNZYGI4DMMBZGU>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
Yeah, my certs failed to renew this month. Not sure why, I'm hoping to dig into it more today. Hitting the button to manually renew worked on 2 of them, but not on my 3rd. |
Do you use the "Force SSL" option in the ssl settings? |
I have faced with same issue: can create a certificate, but it fails to renew after 2 months, with error like: |
This is interesting. This seems to have been related to my issue, but I'm not 100% sure how to fix it properly. My DNS rewrite only handles The more interesting thing is that my cert for When I test a ping to |
Here a lot of things to check:
Try to monitor |
There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues. |
mope |
For anyone else using AdGuard Home alongside their NPM and having issues with renewing their SSL certs, it might be that your AdGuard Home is doing a DNS rewrite of your TXT requests. You may be able to see this within your AdGuard logs. For me, I didn't see the To solve this, I needed to remove the DNS rewrite from the
I didn't want to rewrite all subdomains, so the single pipe at the beginning Since I just upgraded my NPM add-on and applied these rules, I don't know yet if I'll have issues when my certs try to auto-renew in a couple months. Hopefully the combination of the add-on update and fixing my local DNS finally resolves this for me. |
There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues. |
This is still an issues with latest release.
I think the next step is get in the docker imagine an try it myself. To see
the exact error
…On Sun, 14 Apr 2024, 12:35 github-actions[bot], ***@***.***> wrote:
There hasn't been any activity on this issue recently, so we clean up some
of the older and inactive issues.
Please make sure to update to the latest version and check if that solves
the issue. Let us know if that works for you by leaving a comment 👍
This issue has now been marked as stale and will be closed if no further
activity occurs. Thanks!
—
Reply to this email directly, view it on GitHub
<#400 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAGBUHILDEYKASF5Y7EWHLDY5JLY7AVCNFSM6AAAAAAUU4EQB2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANJUGAYDEMJUGA>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
Yes, it is. The reason is that the "Force SSL" option will redirect the HTTP challenges to HTTPS, which the integrated certbot doesnt support apparently. A pull request is open at NginxProxyManager/nginx-proxy-manager#3121, but the fix hasn't been merged yet despite being available for ~8 months. In the meantime, you can disable "Force SSL" for each proxy host you need to renew. |
Hello,
Yes interesting, i think it block the process trying. So I had several
proxies. One had force ssl on, one not. The one that didn't have it on.
Also didn't work.
All my proxies not have force off and now they all work.
Ed Watson
Tel: +46 702053827
…On Sun, 14 Apr 2024 at 18:33, Blogshot ***@***.***> wrote:
I believe that's more of an upstream issue, cf
NginxProxyManager/nginx-proxy-manager#2881
<NginxProxyManager/nginx-proxy-manager#2881>
Yes, it is. The reason is that the "Force SSL" option will redirect the
HTTP challenges to HTTPS, which the integrated certbot doesnt support
apparently. A pull request is open at
NginxProxyManager/nginx-proxy-manager#3121
<NginxProxyManager/nginx-proxy-manager#3121>, but
the issue hasn't been merged yet despite being available for ~8 months.
In the meantime, you can disable "Force SSL" for each proxy host you need
to renew.
—
Reply to this email directly, view it on GitHub
<#400 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAGBUHMXEL37OV3RPXY66F3Y5KVUHAVCNFSM6AAAAAAUU4EQB2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANJUGEYTKMJRGM>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues. |
Unstale :-) |
Still a problem. But for me, only auto-update. Manual works fine even with Force SSL. |
There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues. |
Problem/Motivation
SSL Certs not getting update from lets encrypt
Expected behavior
Lets encrypt ssl cert being automatically updated
Actual behavior
ssl certs not being updated. Is you press renew get this error

Steps to reproduce
Proposed changes
The text was updated successfully, but these errors were encountered: