nginx-proxy-manager: SSL/Let's encrypt not working anymore after update or any other version

Hi, it’s still not working for me.

I’m investigating a bit but can’t figure it out, help is appreciated.

I have several certificates running and the existing ones work just fine and follow the same configuration and hardware as the ones that have expired and I can’t renew.

But I can’t manage to request new ones or redo old ones (i did to many request now so i have to wait until tomorrow i think to check again).

At first I thought it might have to do with pi-hole but my server ignores that and when I turn off pi-hole it doesn’t work either. Could it be that the requests are coming through ipv6 and I haven’t configured that? I’m using DISABLE_IPV6: 'true'

I just don’t understand the necessity of -Use a DNS challenge- I use stator as a provider, is this necessary?

I’m a bit stuck. any help is welcome.

Thanks!

Short update, if i press a still working url within NPM is going fine if i do ‘test server reach-ability’ i get

Communication with the API failed, is NPM running correctly?

Yeah thanks but i’m using duckdns and noip, not willing to change DNS provider because of this issue.

I really like nginx proxy manager but this happens way to frequently in my opinion.

Jesus christ… same crap again… I had to renew ssl certificate and voila “internal error”.

yeah, and the resolution is not use proxy manager anymore as discussed

Here is a guide on how to successfully install Lets Encrypt on Nginx Proxy Manager to secure your docker containers.

same issue on Docker 4.18 macOS ventura 13.3.1 nginx 2.9.19 and 2.9.20(21,22) and 2.10.2.

Not sure what is going, been looking into Traefik

Thank you for posting @EDIflyer. I had the exact same issue, Timeout during connect. I had to disable my hosts to get the auto renew to work. It worked smoothly but manually.

I manually tried to access /.well-known/acme-challenge/, and I saw that it was redirecting towards my drone CI container instead of whatever it was supposed to go to (this could be wrong way to test, however, as certbot doesn’t place the files for that long to test I think…).

However, I had another version working on a separate production server and I saw no issues there… I will report back with more data if I have.

Have you guys noticed you’re on github in the issue section and not reddit?

caddy is terrible for newbies. whoss got 4 weeks to read an encyclopedia on how to write a caddyfile

brugh, im a noob, if i could do it so can other noobs. NGINX is no easier, it has more confusing syntax for configuration than caddy. If you need help you can pm me

guys, stop wasting time on nginx, its garbage. Use caddy instead. Ive moved to caddy and i can forget about certs, because caddy does them automagically. No more “your certs are expiring in few days, please renew” bs. Caddy is lw, Easy to use with a single file where you define every service you have, and thats it. The configuration is easy to understand. Yes, caddy does not have fancy UI, but you just need to set up a service once and forget about it.

I was also getting the “import ClientBase” error with namecheap DNS. Strangely it worked 2 hours earlier with namecheap and another provider, several domains. Fresh, latest NPM install. I got it fixed by running (in a container-attached console): pip install certbot pip install acme pip install certbot-dns-namecheap

That was all and then it worked as before/expected.

I agree. I am just lucky at this moment…

I tend to just automatically make the SSL cert when creating the proxy host.

Thats does not work either… So frustrating… all my domains will soon expire…

I may not swear! But FFS, I have this issue.

Error: Command failed: certbot certonly --config “/etc/letsencrypt.ini” --work-dir “/tmp/letsencrypt-lib” --logs-dir “/tmp/letsencrypt-log” --cert-name “npm-39” --agree-tos --authenticator webroot --email “mail@domain.com” --preferred-challenges “dns,http” --domains “mail.domain.com” Saving debug log to /tmp/letsencrypt-log/letsencrypt.log Some challenges have failed. Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details.

at ChildProcess.exithandler (node:child_process:402:12)
at ChildProcess.emit (node:events:513:28)
at maybeClose (node:internal/child_process:1100:16)
at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)

I had this with 2.9.19 and still when I pulled 2.10.2

Now I cannot renew any domain anymore!

HELP is very much appreciated and needed!

I tried normal challenge and (new?) dns challenge (but not sure if I did that right since I use a *.domain.com dyn dns with Joker)

It always worked well and I also managed to create around 30 certs succesfully

HELP

Some more logging:

[4/1/2023] [5:41:06 PM] [SSL      ] › ℹ  info      Testing http challenge for mail.domain.com

Uncaught SyntaxError: Unexpected end of JSON input

FROM

bash: line 1:   146 Trace/breakpoint trap   (core dumped) node --abort_on_uncaught_exception --max_old_space_size=250 index.js

❯ Starting backend ...

[4/1/2023] [5:41:08 PM] [Global   ] › ℹ  info      Using Sqlite: /data/database.sqlite

[4/1/2023] [5:41:09 PM] [Migrate  ] › ℹ  info      Current database version: none

[4/1/2023] [5:41:09 PM] [Setup    ] › ℹ  info      Logrotate Timer initialized

[4/1/2023] [5:41:09 PM] [Setup    ] › ℹ  info      Logrotate completed.

[4/1/2023] [5:41:09 PM] [IP Ranges] › ℹ  info      Fetching IP Ranges from online services...

[4/1/2023] [5:41:09 PM] [IP Ranges] › ℹ  info      Fetching https://ip-ranges.amazonaws.com/ip-ranges.json

[4/1/2023] [5:41:09 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4

[4/1/2023] [5:41:09 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6

[4/1/2023] [5:41:09 PM] [SSL      ] › ℹ  info      Let's Encrypt Renewal Timer initialized

[4/1/2023] [5:41:09 PM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...

[4/1/2023] [5:41:09 PM] [IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized

[4/1/2023] [5:41:09 PM] [Global   ] › ℹ  info      Backend PID 448 listening on port 3000 ...

[4/1/2023] [5:41:09 PM] [SSL      ] › ✖  error     Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --preferred-challenges "dns,http" --disable-hook-validation  

Another instance of Certbot is already running.

    at ChildProcess.exithandler (node:child_process:402:12)

    at ChildProcess.emit (node:events:513:28)

    at maybeClose (node:internal/child_process:1100:16)

    at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)

[4/1/2023] [5:43:54 PM] [SSL      ] › ℹ  info      Revoking Let'sEncrypt certificates for Cert #29: mail.domain.com

[4/1/2023] [5:43:54 PM] [SSL      ] › ℹ  info      Command: certbot revoke --config "/etc/letsencrypt.ini" --cert-path "/etc/letsencrypt/live/npm-29/fullchain.pem" --delete-after-revoke ; rm -f '/etc/letsencrypt/credentials/credentials-29' || true

[4/1/2023] [5:43:55 PM] [SSL      ] › ℹ  info      Deleted all files relating to certificate npm-29.

Congratulations! You have successfully revoked the certificate that was located at /etc/letsencrypt/live/npm-29/fullchain.pem.

[4/1/2023] [5:44:13 PM] [Nginx    ] › ℹ  info      Reloading Nginx

[4/1/2023] [5:44:18 PM] [SSL      ] › ℹ  info      Requesting Let'sEncrypt certificates for Cert #39: mail.domain.com

[4/1/2023] [5:44:18 PM] [SSL      ] › ℹ  info      Command: certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-39" --agree-tos --authenticator webroot --email "nginx@domain.com" --preferred-challenges "dns,http" --domains "mail.domain.com" 

[4/1/2023] [5:44:30 PM] [Nginx    ] › ⬤  debug     Deleting file: /data/nginx/temp/letsencrypt_39.conf

[4/1/2023] [5:44:30 PM] [Nginx    ] › ℹ  info      Reloading Nginx

[4/1/2023] [5:44:30 PM] [Express  ] › ⚠  warning   Command failed: certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-39" --agree-tos --authenticator webroot --email "nginx@domain.com" --preferred-challenges "dns,http" --domains "mail.domain.com" 

Saving debug log to /tmp/letsencrypt-log/letsencrypt.log

Some challenges have failed.

Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details.

[4/1/2023] [5:45:18 PM] [SSL      ] › ℹ  info      Testing http challenge for mail.domain.com

Uncaught SyntaxError: Unexpected end of JSON input

FROM

bash: line 1:   448 Trace/breakpoint trap   (core dumped) node --abort_on_uncaught_exception --max_old_space_size=250 index.js

❯ Starting backend ...

[4/1/2023] [5:45:19 PM] [Global   ] › ℹ  info      Using Sqlite: /data/database.sqlite

[4/1/2023] [5:45:20 PM] [Migrate  ] › ℹ  info      Current database version: none

[4/1/2023] [5:45:20 PM] [Setup    ] › ℹ  info      Logrotate Timer initialized

[4/1/2023] [5:45:20 PM] [Setup    ] › ℹ  info      Logrotate completed.

[4/1/2023] [5:45:20 PM] [IP Ranges] › ℹ  info      Fetching IP Ranges from online services...

[4/1/2023] [5:45:20 PM] [IP Ranges] › ℹ  info      Fetching https://ip-ranges.amazonaws.com/ip-ranges.json

[4/1/2023] [5:45:20 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4

[4/1/2023] [5:45:20 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6

[4/1/2023] [5:45:20 PM] [SSL      ] › ℹ  info      Let's Encrypt Renewal Timer initialized

[4/1/2023] [5:45:20 PM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...

[4/1/2023] [5:45:21 PM] [IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized

[4/1/2023] [5:45:21 PM] [Global   ] › ℹ  info      Backend PID 1242 listening on port 3000 ...

[4/1/2023] [5:46:54 PM] [Nginx    ] › ℹ  info      Reloading Nginx

[4/1/2023] [5:46:54 PM] [SSL      ] › ℹ  info      Requesting Let'sEncrypt certificates via Joker for Cert #40: mail.domain.com

[4/1/2023] [5:46:54 PM] [SSL      ] › ℹ  info      Command: mkdir -p /etc/letsencrypt/credentials 2> /dev/null; echo 'dns_joker_username = no

dns_joker_password = no

dns_joker_domain = domain.com' > '/etc/letsencrypt/credentials/credentials-40' && chmod 600 '/etc/letsencrypt/credentials/credentials-40' && . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-joker~=1.1.0  && deactivate && certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-40" --agree-tos --email "nginx@domain.com" --domains "mail.domain.com" --authenticator dns-joker --dns-joker-credentials "/etc/letsencrypt/credentials/credentials-40"

[4/1/2023] [5:46:56 PM] [Nginx    ] › ℹ  info      Reloading Nginx

[4/1/2023] [5:46:56 PM] [Express  ] › ⚠  warning   Command failed: certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-40" --agree-tos --email "nginx@domain.com" --domains "mail.domain.com" --authenticator dns-joker --dns-joker-credentials "/etc/letsencrypt/credentials/credentials-40"

Another instance of Certbot is already running.

Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/certbot-log-i26wbiq9/log or re-run Certbot with -v for more details.

[4/1/2023] [5:47:07 PM] [Nginx    ] › ℹ  info      Reloading Nginx

[4/1/2023] [5:47:07 PM] [SSL      ] › ℹ  info      Requesting Let'sEncrypt certificates via Joker for Cert #41: mail.domain.com

[4/1/2023] [5:47:07 PM] [SSL      ] › ℹ  info      Command: mkdir -p /etc/letsencrypt/credentials 2> /dev/null; echo 'dns_joker_username = no

dns_joker_password = no

dns_joker_domain = *.domain.com' > '/etc/letsencrypt/credentials/credentials-41' && chmod 600 '/etc/letsencrypt/credentials/credentials-41' && . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-joker~=1.1.0  && deactivate && certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-41" --agree-tos --email "nginx@domain.com" --domains "mail.domain.com" --authenticator dns-joker --dns-joker-credentials "/etc/letsencrypt/credentials/credentials-41"

[4/1/2023] [5:47:08 PM] [Nginx    ] › ℹ  info      Reloading Nginx

[4/1/2023] [5:47:08 PM] [Express  ] › ⚠  warning   Command failed: certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-41" --agree-tos --email "nginx@domain.com" --domains "mail.domain.com" --authenticator dns-joker --dns-joker-credentials "/etc/letsencrypt/credentials/credentials-41"

Another instance of Certbot is already running.

Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/certbot-log-5s6n3w19/log or re-run Certbot with -v for more details.

[4/1/2023] [5:49:19 PM] [SSL      ] › ✖  error     Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --preferred-challenges "dns,http" --disable-hook-validation  

Failed to renew certificate npm-30 with error: Some challenges have failed.

Failed to renew certificate npm-31 with error: Some challenges have failed.

All renewals failed. The following certificates could not be renewed:

  /etc/letsencrypt/live/npm-30/fullchain.pem (failure)

  /etc/letsencrypt/live/npm-31/fullchain.pem (failure)

2 renew failure(s), 0 parse failure(s)

    at ChildProcess.exithandler (node:child_process:402:12)

    at ChildProcess.emit (node:events:513:28)

    at maybeClose (node:internal/child_process:1100:16)

    at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)

[4/1/2023] [5:52:45 PM] [Nginx    ] › ℹ  info      Reloading Nginx

[4/1/2023] [5:52:50 PM] [SSL      ] › ℹ  info      Requesting Let'sEncrypt certificates for Cert #42: mail.domain.com

[4/1/2023] [5:52:50 PM] [SSL      ] › ℹ  info      Command: certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-42" --agree-tos --authenticator webroot --email "mail@domain.nl" --preferred-challenges "dns,http" --domains "mail.domain.com" 

[4/1/2023] [5:53:05 PM] [Nginx    ] › ⬤  debug     Deleting file: /data/nginx/temp/letsencrypt_42.conf

[4/1/2023] [5:53:05 PM] [Nginx    ] › ℹ  info      Reloading Nginx

[4/1/2023] [5:53:05 PM] [Express  ] › ⚠  warning   Command failed: certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-42" --agree-tos --authenticator webroot --email "mail@domain.nl" --preferred-challenges "dns,http" --domains "mail.domain.com" 

Saving debug log to /tmp/letsencrypt-log/letsencrypt.log

Some challenges have failed.

Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details.

EDIT: Any renewal gives me:

Any creation gives me above error…

This is a major issue