Open ahmedelemamn opened 2 years ago
Renewing an existing SSL cert is not an issue from the SSL tab. Generating new SSL cert for a domain that is correctly pointed to the NGINX Proxy Manager fails. Can you try to generate a new SSL cert for a domain that is pointing to your host, but doesn't have the cert yet?
Hi I just created a new cert for my domain and it works fine. No issues
It works only for a while when you first pull the images and make a completely new and fresh container of npm without any volumes saved. Then after I add like 4 hosts, each with it's own cert, it breaks and refuses to even make a new certificate. No matter if I try to add it when adding a new proxy host or directly through the SSL cert tab.
Not to discount your experience, but my NPM is already running close to ten hosts on different domains. As I mentioned in my comment, that is the state where I added a new cert to a new sub domain and it worked fine.
That is even more confusing to me then. What version of npm are you using? I'm on v2.9.19 - which should be the latest from docker hub. It did it the first time I set up my server (that was like 2.9.18) and then repulled the images and rebuilt the container and it broke again.
Renewing an existing SSL cert is not an issue from the SSL tab. Generating new SSL cert for a domain that is correctly pointed to the NGINX Proxy Manager fails. Can you try to generate a new SSL cert for a domain that is pointing to your host, but doesn't have the cert yet?
Hi I just created a new cert for my domain and it works fine. No issues
It works only for a while when you first pull the images and make a completely new and fresh container of npm without any volumes saved. Then after I add like 4 hosts, each with it's own cert, it breaks and refuses to even make a new certificate. No matter if I try to add it when adding a new proxy host or directly through the SSL cert tab.
Not to discount your experience, but my NPM is already running close to ten hosts on different domains. As I mentioned in my comment, that is the state where I added a new cert to a new sub domain and it worked fine.
That is even more confusing to me then. What version of npm are you using? I'm on v2.9.19 - which should be the latest from docker hub. It did it the first time I set up my server (that was like 2.9.18) and then repulled the images and rebuilt the container and it broke again.
I'm on 2.9.18 just checked
hey guys, i just started my own domain. I tried the button it did not work (test if it works) like the thread indicates. but I am able to create ssl cert fine. I dont know about renew as of yet. so just letting you know that the creation part is working for me.
This morning all my sites are greeting visitors with a red background and "Google Safe Browsing recently detected phishing", it must be related to recent certificate shenanigans... Ohh joy.
Hello, in my case I solved the problem. First I also got this "internal error" or "Communication with the API failed, is NPM running correctly?". Then I removed the certificat and tried to recertify it and got the same, but got the message in the red box "Another instance of Certbot is already running". My solution I found: https://community.letsencrypt.org/t/solved-another-instance-of-certbot-is-already-running/44690
After doing that I registered the certificat by the "edit proxy host" menu! PS: I updated my version to 2.9.19
@kitoming Yes, but that still doesn't solve the problem with getting new certificated under 'SSL Cert' tab. A fresh cert without host pointing at a service.
By way of update, I have installed a new droplet on DO, with a fresh IP, with fresh Docker, with fresh install of NGINX Proxy Manager, and tried to 'Test reachability', still gives me the same error. Not sure if it is even worth typing here, as no contributors or maintainers of this project have replied.
Hi all, In my case the error got resolved by itself. I have tried many of the things above. Initially disabling force SSL and trying to generate the certificate failed. However it worked the next day. From last couple of days all the methods are working as expected. I personally think LetsEncrypt have updated something recently.
Hi all, In my case the error got resolved by itself. I have tried many of the things above. Initially disabling force SSL and trying to generate the certificate failed. However it worked the next day. From last couple of days all the methods are working as expected. I personally think LetsEncrypt have updated something recently.
I can not reproduce that. Still none of the certificate generation methods works for me, even above cloudflare workaround has no effect.
Hi all, In my case the error got resolved by itself. I have tried many of the things above. Initially disabling force SSL and trying to generate the certificate failed. However it worked the next day. From last couple of days all the methods are working as expected. I personally think LetsEncrypt have updated something recently.
I can not reproduce that. Still none of the certificate generation methods works for me, even above cloudflare workaround has no effect.
Try these -> Create Proxy, close -> edit proxy, request SSL without force
Forgot to mention, I had to do the DNS Challenge way couple of times before getting the SSL to work without DNS challenge
My NPM was working fine for months, now I just realized that it does not auto-renew certificates anymore (which it did until a certain point in time, maybe the last update?).
The odd thing is, issuing new certificates works. Also when I manually click on "renew now", it renews without any issues. But when I click on "test server reachability" I get "Communication with the API failed, is NPM running correctly?". So basically I am just missing the automatism to not have to renew my certificates manually every few months.
Test Server Reachability
gives meCommunication with the API failed, is NPM running correctly?
and trying to request the SSL without testing gives me this:Error: Command failed: certbot certonly --config "/etc/letsencrypt.ini" --cert-name "npm-64" --agree-tos --authenticator webroot --email "abc@example.com" --preferred-challenges "dns,http" --domains "test.example.com" Another instance of Certbot is already running. Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/certbot-log-xyz/log or re-run Certbot with -v for more details. at ChildProcess.exithandler (node:child_process:402:12) at ChildProcess.emit (node:events:513:28) at maybeClose (node:internal/child_process:1100:16) at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)
@bigbeka, @ahmedelemamn step 1: The above issue is solved by opening the nginx proxy manager instance or server 80 port to public(check for your server in Digital ocean or others ) step 2:Then try to request new ssl certificate Note: For generate ssl certficates the nginx proxy manager server should be exposed to public then only ssl certificates will generate without errors
@nagalakshmi896 Step 1 does not make sense as anyone using NGINX Proxy Manager need to expose port 80 to public.
@nagalakshmi896 Step 1 does not make sense as anyone using NGINX Proxy Manager need to expose port 80 to public.
@bigbeka I am not telling like NGINX Proxy Manager need to expose port 80 to public.(Where NPM is installed that server should be opened to 80 (to public) please try by open the inbound rules 80 and 443
@nagalakshmi896 Yes, UFW in/out bound traffic for ports 80 & 443 on UDP & TCP is enabled. Still no joy.
I am having the same issue as everything above. I initially thought it may have been a change I made to my firewall policies so I reverted them. The issue persisted.
The only way I was able to get it working again was the following:
Delete SSL Certificate for the host.
Delete & Recreate the host and then request a new certificate
EDIT: Nevermind, It only worked for the first host I tried this with and then I keep getting an internal error
Another Update: During the recreation/deletion process, suddenly all the certificates which were expired renewed themselves
@jc21 is there any new information. No workaround works for me.
Some friendly person on Reddit pointed me to the settings for the host, seemed to do the trick for me.
Try using the SSL request through the host setup, rather than trying to set it up before configuring a new host. Not sure why but my NPM (different setup, stand alone docker host) won’t allow me to request the cert from the SSL section, I have to use the SSL section in the new host setup in order for it to work.
I don't think this solves the problem. The main point of getting SSL before setting up the host is to check if the Domain pointing at the public IP has actually propagated or not, hence the need for SSL tab, and the need for "Test" button.
If the domain is not pointing to the correct IP, and you request SSL from Let's Encrypt, you might get penalised for this and get temporary ban. 🤷♂️
Some friendly person on Reddit pointed me to the settings for the host, seemed to do the trick for me.
Try using the SSL request through the host setup, rather than trying to set it up before configuring a new host. Not sure why but my NPM (different setup, stand alone docker host) won’t allow me to request the cert from the SSL section, I have to use the SSL section in the new host setup in order for it to work. https://imgur.com/a/OW1Jp2o
Crazy thing for me is that I can confirm that I see all the error messages given above, but after "some time" the expiration date of my SSL certs changed and they have been renewed even though an error was shown. Sadly, I do not see any other error messages in addition to those that have been reported here.
I had this issue too, and when i create new cert, output is: "Another instance of Certbot is already running" My solutions: To find the certbot process, try: ps -ef | grep certb The process ID would be the first number after the user, like: root 5555 5100 … To kill the process, try: kill 5555 ((replace 5555 with your actual certbot PID#)) Kill all certbot pid running and retry then i created success new cert. Sources: https://community.letsencrypt.org/t/solved-another-instance-of-certbot-is-already-running/44690/2
Hope to help someone!
Ok, I believe Cloudflare security (double proxies and other bits) block let's encrypt creating and renewing certs. I've tried disabling bits and bobs on cloudflare with no luck. Issue for me started once I switched to Cloudflare (all was working ok on namecheap but of course namecheap doesn't provide same tools and security as cloudflare).
Switching to Cloudflare cert (free and for 15 years validity) for all my domains and subdomains (8 hosts/subdomains) took less than 5 mins.
Hope this helps you guys:
Log into cloudflare -> SSL/TLS -> Origin Server and create certificate (just one, wildcard certificate will be used for all subdomains) using notepad copy and paste certificate into notepad and save as e,g, certificate.crt copy and paste key into another notepad file and save as key.crt
Log into your NPM:
go to SSL certificates -> add new -> custom give it a name and then browse and choose cert and key files in the 2 fileds available. save the cert - should show 15 years expiry date etc. Go to your domains and subdomains and replace your ssl cert with cloudflare one
All works for me :)
Ok, this steps work for me Docker
re-deploy container Remote in container console Run pip install certbot-dns-cloudflare==$(certbot --version | grep -Eo '0-9+') cloudflare if you get this error, just update pip install --upgrade --force-reinstall acme==2.2.0 (https://freeimage.host/i/HEzf6jj)
Same problem here
Have you tried this? #2011 (comment)
No, I like Lets Encrypt and I do not have a CloudFlare account nor do I manage my Domains through CloudFlare. I add about a Host a Year to NPM and everytime I try to do this NPM is broken. Very anoying. NPM never got certificate renewal automatically working, every 3 Months I have to go into it and update the certificates by hand.
I guess it is time to switch to another proxy.
I'm getting the "Communication with API failed, are you sure NPM is running correctly" error too, I can't request any new certificate nor renew my existing ones. I didn't change anything in my docker compose or anything, this issue just came up by itself which to me does not make sense. I also can't find any solution on this, except switching to traefik - but I just can't get it working, either, so I hope this will get fixed fast
Hi team, I'm experiencing exactly the same error. In my case I have NPM as an AddOn in HASS.IO, but the error is the same. Let'sencrypt reaches the box but is discarded with a connection refused
. All mappings are ok, but missing a "web server" attending the request.
I've seen that the call to certbot is using --authenticator webroot
; so it needs a web server listening on :80 serving the file that lets encrypt is looking for. Which is not the case !!
One solution would be to change to --standalone
but I'm not sure if it's possible to configure, somehow, NPM to use --standalone
instead.
Thanks Luis
It seems like this topic/issue has not been resolved, as I came here with the same problem. The author needs to check and see about duplicating and resolving the issue.
I just got 2 notices from Let's Encrypt about certificates expiring soon. I checked NPM to also find I'm getting the "Communication with the API failed, is NPM running correctly?" error when using the "Test Server Reachability" option, and I'm concerned about auto renewal not working. In the past with a different setup I never got cert expiration notices from Let's Encrypt.
So looking at my logs and I am getting the same error about certbot already running.
So I used the guidance in this comment to remove the lock files and this seemed to resolve the certbot is already running issue. I'm still faced with renewal failures. My logs are like this:
[2/25/2023] [4:12:28 AM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation
Failed to renew certificate npm-5 with error: Some challenges have failed.
The following renewals failed:
/etc/letsencrypt/live/npm-5/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
at ChildProcess.exithandler (node:child_process:402:12)
at ChildProcess.emit (node:events:513:28)
at maybeClose (node:internal/child_process:1100:16)
at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)
[2/25/2023] [4:14:43 AM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates for Cert #5: ***.***.***
[2/25/2023] [4:14:43 AM] [SSL ] › ℹ info Command: certbot renew --force-renewal --config "/etc/letsencrypt.ini" --cert-name "npm-5" --preferred-challenges "dns,http" --no-random-sleep-on-renew --disable-hook-validation
[2/25/2023] [4:15:07 AM] [Express ] › ⚠ warning Command failed: certbot renew --force-renewal --config "/etc/letsencrypt.ini" --cert-name "npm-5" --preferred-challenges "dns,http" --no-random-sleep-on-renew --disable-hook-validation
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Failed to renew certificate npm-5 with error: Some challenges have failed.
All renewals failed. The following certificates could not be renewed:
/etc/letsencrypt/live/npm-5/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
Duplicate relation "access_list" in a relation expression. You should use "a.[b, c]" instead of "[a.b, a.c]". This will cause an error in objection 2.0
So I used the guidance in this comment to remove the lock files and this seemed to resolve the certbot is already running issue. I'm still faced with renewal failures. My logs are like this:
[2/25/2023] [4:12:28 AM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation Failed to renew certificate npm-5 with error: Some challenges have failed. The following renewals failed: /etc/letsencrypt/live/npm-5/fullchain.pem (failure) 1 renew failure(s), 0 parse failure(s) at ChildProcess.exithandler (node:child_process:402:12) at ChildProcess.emit (node:events:513:28) at maybeClose (node:internal/child_process:1100:16) at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5) [2/25/2023] [4:14:43 AM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates for Cert #5: ***.***.*** [2/25/2023] [4:14:43 AM] [SSL ] › ℹ info Command: certbot renew --force-renewal --config "/etc/letsencrypt.ini" --cert-name "npm-5" --preferred-challenges "dns,http" --no-random-sleep-on-renew --disable-hook-validation [2/25/2023] [4:15:07 AM] [Express ] › ⚠ warning Command failed: certbot renew --force-renewal --config "/etc/letsencrypt.ini" --cert-name "npm-5" --preferred-challenges "dns,http" --no-random-sleep-on-renew --disable-hook-validation Saving debug log to /var/log/letsencrypt/letsencrypt.log Failed to renew certificate npm-5 with error: Some challenges have failed. All renewals failed. The following certificates could not be renewed: /etc/letsencrypt/live/npm-5/fullchain.pem (failure) 1 renew failure(s), 0 parse failure(s) Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. Duplicate relation "access_list" in a relation expression. You should use "a.[b, c]" instead of "[a.b, a.c]". This will cause an error in objection 2.0
Hi did you manage to resolve this problem i am in same state as yu just with slighter difrent error :(
Just updated to 2.9.20 after seeing @jc21 did a push to Docker Hub. Unfortunately no change in the SSL certificate renewal bug...
0:28:54
[3/16/2023] [12:28:54 AM] [SSL ] › ✖ error Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation
0:28:54
Failed to renew certificate npm-4 with error: Some challenges have failed.
0:28:54
Failed to renew certificate npm-6 with error: Some challenges have failed.
0:28:54
All renewals failed. The following certificates could not be renewed:
0:28:54
/etc/letsencrypt/live/npm-4/fullchain.pem (failure)
0:28:54
/etc/letsencrypt/live/npm-6/fullchain.pem (failure)
0:28:54
2 renew failure(s), 0 parse failure(s)
0:28:54
0:28:54
at ChildProcess.exithandler (node:child_process:402:12)
0:28:54
at ChildProcess.emit (node:events:513:28)
0:28:54
at maybeClose (node:internal/child_process:1100:16)
0:28:54
at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)
0:47:38
`QueryBuilder#allowEager` method is deprecated. You should use `allowGraph` instead. `allowEager` method will be removed in 3.0
0:47:38
`QueryBuilder#eager` method is deprecated. You should use the `withGraphFetched` method instead. `eager` method will be removed in 3.0
0:47:38
QueryBuilder#omit is deprecated. This method will be removed in version 3.0
0:47:38
Model#$omit is deprected and will be removed in 3.0.
Have you tried this? #2011 (comment)
hi yes, i've tried this. It didn't work before, but this time it worked .. still, I don't have an explanation for the let's encrypt error in npm .. 🤔 but thanks!!
I use NPM on Home Assistant Core all running on a Windows PC. For me disabling the Windows firewall and also pausing ESET allowed to me renew all certs one by one from the SSL certificates list.
My NPM can issue LE certificate normally (domain hosted in CF) but the GUI showing error when doing reachability test. May be a visual bug
Same issue happened to me. When testing a message that NPM might not be configured correctly and on an actual try to get a certificate an internal error.
I found out that in the let's encrypt logs, there were two ip addresses found to match the domain I wanted to get a certificate for. One ipv4 (A record) and one ipv6 (AAAA record). Certbot used the ipv6 one to perform the http-01 challenge on. However that one was still pointing to some default domain registrar ip. After changing the ipv6 AAAA record to point to my server, all worked as expected.
I did set the environment var to disable ipv6, however apparently the certbot script does not disable ipv6 for the challenge, which one might expect.
So even when disabling ipv6 one should set the AAAA record to your server (and forward it to NPM) or removing the AAAA record completely to make it possible for certbot to create certificates.
That gave me hope for a minute, @tomvanswam - unfortunately when I double-checked the AAAA record correctly points to the same server as the A one in my case 😞
That gave me hope for a minute, @tomvanswam - unfortunately when I double-checked the AAAA record correctly points to the same server as the A one in my case 😞
Make sure (when hosting at home) your router is also forwarding ipv6 traffic to your server. This isn't done by default when forwarding ipv4 traffic.
Check your firewalls that rules are also in place to allow ipv6 traffic to your server.
Request a certificate even though the test fails and check the letsencrypt.log file somewhere in the /tmp folder (I'm on mobile so can't check what folder precisely) in the container and try to find the reason why it's not working. This helped me finding out what I did.
Thanks @tomvanswam - I'm on a VPS so no issues re firewalls, etc. If I delete and recreate them fresh it tends to work, it's the auto-renewal that isn't working. I'll look at the logs again later but have posted in a few other ones re this issue, really hoping there'll be a fix soon.
I did do a first regustration indeed, not a renewal, maybe my luck runs out in 60 days 🙄
I can confirm: I can generate new certificates but cannot renew certificates.
Removing certificates leaves the cert files in place and when running certbot renew in the console it still finds them and tries to renew them.
certbot renew --cert-name npm-42 --force-renewal
gives the following error:
Renewal configuration file /etc/letsencrypt/renewal/npm-42.conf is broken. The error was: expected /etc/letsencrypt/live/npm-42/cert.pem to be a symlink Skipping.
What works is to remove the certificate manually in the SSL Certificates tab and generating a new one.
Force renewing the certs I created just now does seem to work.
Thanks for confirming, @KoenVanduffel - interesting finding re cert files being left in place after removal from the UI, that was my suspicion too. Quite a hassle to do if lots of subdomains!
I deleted the SSL certificate, yet I can't request a complete new ssl certificate..
It's now even getting more weird. I just tried a refresh on my other domain, this wasn't working at first. Now it has refreshed it. I now requested a new ssl for the 2nd (sub) domain, it's not working again.
I deleted the SSL certificate, yet I can't request a complete new ssl certificate..
It's now even getting more weird. I just tried a refresh on my other domain, this wasn't working at first. Now it has refreshed it. I now requested a new ssl for the 2nd (sub) domain, it's not working again.
it might be worth trying the steps I put in #2881 and see if they work for you at all for renewing. For the removals did you do it via UI or command line? As @KoenVanduffel mentions the UI version doesn't seem to properly remove. In that situation I copied a known 'good' certificate from another site on that domain then refreshed it using the steps mentioned in that linked issue.
I've done this now: Part 2 - turn off Force SSL and then renew
Then it created a new ssl certificate... I'm using this through a HA plugin, not sure on how I would need to do the shell commands, but for now it seemed to be ok again for a couple months.
Turning 'Force SSL' off was the quick fix for me.
Been almost a year and nothing on this issue. To be such a popular application that does see updates, it would be nice to see this fixed.
Theres many forks to this repo, I would recommend tracking one of them and seeing if someone has picked up maintaining the app.
Theres many forks to this repo, I would recommend tracking one of them and seeing if someone has picked up maintaining the app.
Any you would recommend? Because honestly I don't know what to look for when choosing a forked repo
Checklist
jc21/nginx-proxy-manager:latest
docker image?Describe the bug i have a fresh NPM image running and tried to generate SSL certificate for my domain i tried both http/dns challenges for http challenge i get this error:
or this one:
for the second error i made sure my DNS record is configured as DNS only and not proxied on cloudflare and i have both port 80 and 443 forwarded on my WAN router
if i opted for DNS challenge i get this error
although the API key is working fine
Nginx Proxy Manager Version v2.9.14 i tried the latest as well but i had the same issue and i saw a post here recommending downgrading helped but unfortunately it didn't help me ref. https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1862
To Reproduce Steps to reproduce the behavior:
Expected behavior wildcard SSL certificate to be created
Operating System ubuntu server 21.10