SSL Certificate Issuance Failure

[eroc1990]

Hi all,

I'm running into an issue with NPM in where new certificate requests are resulting in an Internal Error message popping up, and no valid LE cert being issued for my subdomain. I'm currently running ver. 2.7.1 of NPM with a MariaDB as a database backend. Both of these are inside Docker containers within my QNAP Container Station, running in Bridge mode so each application has its own host IP address. For any new certificate requests, my requests are failing with an "Internal Error" when attempting to acquire a cert while adding a host. I'm using a standard HTTP challenge to complete this.

I haven't had this kind of issue in the past so I'm not entirely sure what's causing it. My primary DNS is my pi-hole hosted in a separate container on the same host, but I've requested certs before through it without issue, and my domain isn't being blocked on the outbound or inbound route as far as I can tell. I've got other requests to other subdomains operating without issue and the domain's whitelisted. I also had a handful of certs successfully renew recently, so it seems that for existing certificates the function is working correctly. Nothing's changed on my Cloudflare DNS beyond adding the appropriate CNAMEs to accommodate the

Any insight on what might be causing this would be greatly appreciated.

Also, this might be related to #741 but I'm not sure, so feel free to merge this into that if you think they're similar enough.

The relevant excerpt from my logs is pasted below:

[11/28/2020] [2:31:39 AM] [Nginx    ] › ℹ  info      Reloading Nginx                                                               
[11/28/2020] [2:31:40 AM] [Express  ] › ⚠  warning   Command failed: /usr/bin/certbot certonly --non-interactive --config "/etc/letsencrypt.ini" --cert-name "npm-96" --agree-tos --email "REDACTED@outlook.com" --preferred-challenges "dns,http" --domains "REDACTED.REDACTED.tk"                                                                                                                    
Saving debug log to /var/log/letsencrypt/letsencrypt.log                                                                           
Plugins selected: Authenticator webroot, Installer None                                                                            
Obtaining a new certificate                                                                                                        
Performing the following challenges:                                                                                               
http-01 challenge for REDACTED.REDACTED.tk                                                                                       
Using the webroot path /data/letsencrypt-acme-challenge for all unmatched domains.                                                 
Waiting for verification...                                                                                                        
Challenge failed for domain REDACTED.REDACTED.tk                                                                                 
http-01 challenge for REDACTED.REDACTED.tk                                                                                       
Cleaning up challenges                                                                                                             
Some challenges have failed.

[sandroshu]

I am having the same issue with Let's Encrypt certificates.
I have tried to update packages inside the container.

Error: Command failed: /usr/bin/certbot certonly --non-interactive --config "/etc/letsencrypt.ini" --cert-name "npm-11" --agree-tos --email "x@xxx.hu" --preferred-challenges "dns,http" --domains "xxx.eu" 
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for xxx.eu
Using the webroot path /data/letsencrypt-acme-challenge for all unmatched domains.
Waiting for verification...
Challenge failed for domain xxx.eu
http-01 challenge for xxx.eu
Cleaning up challenges
Some challenges have failed.

    at ChildProcess.exithandler (child_process.js:308:12)
    at ChildProcess.emit (events.js:314:20)
    at maybeClose (internal/child_process.js:1051:16)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5

Using DNS verification with Cloudflare created the TXT record successfully and now I have a working cert.

[dtc-tech]

I'm having the same issue when attempting to create SSL certs.

Error: Command failed: /usr/bin/certbot certonly --non-interactive --config "/etc/letsencrypt.ini" --cert-name "npm-43" --agree-tos --email "email@mydomain.com" --preferred-challenges "dns,http" --domains "sub.mydomain.com" 
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for sub.mydomain.com
Using the webroot path /config/letsencrypt-acme-challenge for all unmatched domains.
Waiting for verification...
Challenge failed for domain sub.mydomain.com
http-01 challenge for sub.mydomain.com
Cleaning up challenges
Some challenges have failed.

    at ChildProcess.exithandler (child_process.js:303:12)
    at ChildProcess.emit (events.js:315:20)
    at maybeClose (internal/child_process.js:1021:16)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:286:5)

[anselal]

Same here

[koshia]

I'm having the same issue with this and stemming from a failed renewal. Unraid Server w/ NGINXProxyManager Docker Container

Setting up new cert produces:

Error: Command failed: /usr/bin/certbot certonly --non-interactive --cert-name "npm-20" --agree-tos --email "ZZZZ@gmail.com" --domains "*.XXXX.me" --authenticator dns-cloudflare --dns-cloudflare-credentials "/etc/letsencrypt/credentials/credentials-20"
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator dns-cloudflare, Installer None
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for XXXX.me
Waiting 10 seconds for DNS changes to propagate
Waiting for verification...
Challenge failed for domain XXXX.me
dns-01 challenge for XXXX.me
Cleaning up challenges
Some challenges have failed.

    at ChildProcess.exithandler (child_process.js:308:12)
    at ChildProcess.emit (events.js:314:20)
    at maybeClose (internal/child_process.js:1022:16)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5)

Made sure my API key with Cloudflare was set up correctly with this other issue: #680

[Stephen988]

I am having the same issue with Let's Encrypt certificates.
I have tried to update packages inside the container.

Error: Command failed: /usr/bin/certbot certonly --non-interactive --config "/etc/letsencrypt.ini" --cert-name "npm-11" --agree-tos --email "x@xxx.hu" --preferred-challenges "dns,http" --domains "xxx.eu" 
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for xxx.eu
Using the webroot path /data/letsencrypt-acme-challenge for all unmatched domains.
Waiting for verification...
Challenge failed for domain xxx.eu
http-01 challenge for xxx.eu
Cleaning up challenges
Some challenges have failed.

    at ChildProcess.exithandler (child_process.js:308:12)
    at ChildProcess.emit (events.js:314:20)
    at maybeClose (internal/child_process.js:1051:16)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5

Using DNS verification with Cloudflare created the TXT record successfully and now I have a working cert.

Can you explain more detailed? how you have resolved? thanks

[github-actions]

Issue is now considered stale. If you want to keep it open, please comment 👍

[github-actions]

Issue was closed due to inactivity.