search

jlesage / docker-nginx-proxy-manager

Docker container for Nginx Proxy Manager
MIT License
770 stars 173 forks source link

Can't create SSL certificate #212

Open orthl opened 2 years ago

orthl commented 2 years ago

Hello all, unfortunately I am not able to create a SSL certificate through the Nginx Proxy Manager interface.I try to create it on my main domain.com, but without success. It doesn't matter if I create it via the tab Proxy Hosts (internal error) or SSL Certificate.

Error:

Error: Command failed: certbot certonly --non-interactive --config "/etc/letsencrypt.ini" --cert-name "npm-5" --agree-tos --authenticator webroot --email "mail@xxxxx.de" --preferred-challenges "dns,http" --domains "maindomain.de" Saving debug log to /var/log/letsencrypt/letsencrypt.log Some challenges have failed. Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. at ChildProcess.exithandler (child_process.js:308:12) at ChildProcess.emit (events.js:314:20) at maybeClose (internal/child_process.js:1022:16) at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5)

The data of my server -fresh installed Ubuntu 18.04 -open ports: 443, 80, 81, 4443, 8080, 8181 -Docker in the latest version -my maindomain.de points directly to the IP of the server

Thanks and many greetings, Lucas

goni05 commented 2 years ago

I am having this same problem. I went to renew my certificates with Let's Encrypt when I added a new subdomain (I have the firewall and DNS configured properly) using SWAG, and it failed, and now I cannot get it back up. I switched to NPM hoping it would resolve my problem, but it just flat out doesn't work either. Nobody seems to have the answer when using HTTP authentication. I know my DNS and firewall are configured properly because when I have the proxy hosts configured, they proxy appropriately. The root of my domain also returns the Congratulations page (when nothing is configured).

I got the same error as @orthl, and the log file shows (which is the same in SWAG):

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
  Domain: mydomain.com
  Type:   connection
  Detail: Fetching http://mydomain.com/.well-known/acme-challenge/OssSOiCsawenBZZ29gfC5GqimXiqrdDNx4olXWt5Y-s: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

The problem I am having with all certbot users is that the default is to clean up all the files when it's done, even on error and I don't know how to get ahead of that to "test" the connection to confirm access from Let's Encrypt. I have tried adding a test.html file in the /data/letsencrypt-acme-challenge/ directory to see when I request a certificate if I can reach it, but I get a 404 error. From what I can tell, the Nginx server remains running the entire time it's requesting a certificate, which means my firewall is likely not directing traffic appropriately for the certificate process because certbot is using a different port (80?) and it's not exposed on the docker, or you are redirecting traffic in Nginx temporarily. Not really sure what is going on and I am at my wits end on how to troubleshoot.

I am really hoping someone figures out this Let's Encrypt issue using HTTP authentication as I don't have the DNS option (I'm on Google Domains - Not Google Cloud).

By the way, I am running the docker container in Unraid. I am more than willing to help troubleshoot more, but I don't know what additional things I might need to do.

goni05 commented 2 years ago

Well, I found out that my ISP (Cox Communications) suddenly started blocking port 80 for some reason after years of it being open (despite web searches indicating its blocked). That was the reason it was working before but suddenly stopped. I am now working down the path of converting over to Cloudflare DNS, and so far, this is working as expected. Thankfully, they aren't blocking 443. Sure would be nice if they could develop an alternative port to use other than 80.

@orthl you might want to confirm your ISP has port 80 open, as testing from within my network (hairpin NAT is enabled) always showed it working. Check from outside sources to confirm.