Certificate expiry date mismatch/no auto-renewal of certs #3434

Matthias-vdE · 2026-06-06T15:15:01Z

Matthias-vdE
Jun 6, 2026

Recently I noticed that my certificates are not automatically being renewed anymore. Looking at the Web UI, all my certificates are expiring in less than 2 days:

While troubleshooting, I ran the command

certbot --config /etc/certbot.ini renew --server https://acme-v02.api.letsencrypt.org/directory

And this was the output

debian-server:/app# certbot --config /etc/certbot.ini renew --server https://acme-v02.api.letsencrypt.org/directory
Saving debug log to /tmp/certbot-log/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-64.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-65.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-66.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certificates are not due for renewal yet:
  /data/tls/certbot/live/npm-64/fullchain.pem expires on 2026-06-12 (skipped)
  /data/tls/certbot/live/npm-65/fullchain.pem expires on 2026-06-12 (skipped)
  /data/tls/certbot/live/npm-66/fullchain.pem expires on 2026-06-12 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
debian-server:/app#

So the IDs match, but according to the certbot command, they expire on June 12 while according to the web UI they expire on June 8?

Filtering my docker logs of the past few days on "certbot", there are no messages except the one generated just now

2026-06-06 04:01:15.047 [Global        ] › ⬤  debug     CMD: certbot --config /etc/certbot.ini renew --server https://acme-v02.api.letsencrypt.org/directory --quiet 
2026-06-06 04:01:06.776 [Global        ] › ⬤  debug     CMD: pip install --upgrade --no-cache-dir certbot-dns-hetzner-cloud

Renewing manually works fine, and when rebooting the entire stack they seem to renew as well. But since these are short-lived, I often run into expired certificates.

Compose file:

  npmplus:
    container_name: npmplus
    image: zoeyvid/npmplus:develop
    restart: always
    network_mode: host
    ipc: service:openappsec-agent 
    volumes:
      - "/opt/npm:/data"
      - "shm-volume:/dev/shm/check-point"
    environment:
      - "TZ=Europe/Brussels" 
      - "ACME_EMAIL=${ACME_EMAIL}"
      - "ACME_MUST_STAPLE=false"
      - "ACME_OCSP_STAPLING=false"
      - "DISABLE_IPV6=true"
      - "TRUST_CLOUDFLARE=false"
      - "NGINX_LOG_NOT_FOUND=true" 
      - "LOGROTATE=true" 
      - "LOGROTATIONS=7" 
      - "GOA=true" 
      - "GOACLA=--agent-list --real-os --no-strict-status --double-decode --keep-last=30 --with-output-resolver --no-query-string --unknowns-as-crawlers --real-time-html --exclude-ip 127.0.0.1"
      - "NGINX_LOAD_GEOIP2_MODULE=true"
      - "DISABLE_GRAVATAR=true"
      - "NGINX_LOAD_OPENAPPSEC_ATTACHMENT_MODULE=true" 
      - "CERTBOT_RUN_INTERVAL=3"
      - "AUTH_REQUEST_ANUBIS_UPSTREAM=${AUTH_REQUEST_ANUBIS_UPSTREAM}"
      - "AUTH_REQUEST_AUTHENTIK_UPSTREAM=${AUTH_REQUEST_AUTHENTIK_UPSTREAM}"

What else can I check in troubleshooting the issue? Using Hetzner-Cloud DNS for my certificates, as they are wildcards. *.mydomain.com.

Answered by Zoey2936

Jun 7, 2026

yes please report back once this happens again

View full answer

Zoey2936 · 2026-06-06T15:17:42Z

Zoey2936
Jun 6, 2026
Maintainer

so the ui missmatches the state on disk?

2 replies

Matthias-vdE Jun 6, 2026
Author

Seems like it. These are my logs when rebooting the npmplus container:

1780759231787	2026-06-06T15:20:31.787Z	[Global        ] › ⬤  debug     CMD: certbot --config /etc/certbot.ini renew --server https://acme-v02.api.letsencrypt.org/directory --quiet
1780759231787	2026-06-06T15:20:31.787Z	[TLS           ] › ℹ  info      Renewing Certbot TLS certs close to expiry...
1780759230440	2026-06-06T15:20:30.440Z	[Global        ] › ⬤  debug     CMD: pip install --upgrade --no-cache-dir certbot-dns-hetzner-cloud
1780759228721	2026-06-06T15:20:28.721Z	no DEFAULT_CERT_ID set, using dummycerts.
1780759045232	2026-06-06T15:17:25.232Z	[Global        ] › ⬤  debug     CMD: certbot --config /etc/certbot.ini renew --server https://acme-v02.api.letsencrypt.org/directory --quiet
1780759045232	2026-06-06T15:17:25.232Z	[TLS           ] › ℹ  info      Renewing Certbot TLS certs close to expiry...
1780759035474	2026-06-06T15:17:15.474Z	[Global        ] › ⬤  debug     CMD: pip install --upgrade --no-cache-dir certbot-dns-hetzner-cloud
1780759033618	2026-06-06T15:17:13.618Z	no DEFAULT_CERT_ID set, using dummycerts.
1780759033576	2026-06-06T15:17:13.576Z	removed '/data/tls/certbot/archive/npm-66/fullchain8.pem'
1780759033570	2026-06-06T15:17:13.570Z	removed '/data/tls/certbot/archive/npm-66/chain8.pem'
1780759033566	2026-06-06T15:17:13.566Z	removed '/data/tls/certbot/archive/npm-66/cert8.pem'
1780759033562	2026-06-06T15:17:13.562Z	removed '/data/tls/certbot/archive/npm-66/privkey8.pem'
1780759033553	2026-06-06T15:17:13.553Z	removed '/data/tls/certbot/archive/npm-65/fullchain8.pem'
1780759033546	2026-06-06T15:17:13.546Z	removed '/data/tls/certbot/archive/npm-65/chain8.pem'
1780759033542	2026-06-06T15:17:13.542Z	removed '/data/tls/certbot/archive/npm-65/cert8.pem'
1780759033537	2026-06-06T15:17:13.537Z	removed '/data/tls/certbot/archive/npm-65/privkey8.pem'
1780759033526	2026-06-06T15:17:13.526Z	removed '/data/tls/certbot/archive/npm-64/fullchain8.pem'
1780759033519	2026-06-06T15:17:13.519Z	removed '/data/tls/certbot/archive/npm-64/chain8.pem'
1780759033515	2026-06-06T15:17:13.515Z	removed '/data/tls/certbot/archive/npm-64/cert8.pem'
1780759033509	2026-06-06T15:17:13.509Z	removed '/data/tls/certbot/archive/npm-64/privkey8.pem'

Rebooted at 15:17, ran the certbot manually at 15:20 with the same result as before:

debian-server:/app# certbot --config /etc/certbot.ini renew --server https://acme-v02.api.letsencrypt.org/directory
Saving debug log to /tmp/certbot-log/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-64.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-65.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-66.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certificates are not due for renewal yet:
  /data/tls/certbot/live/npm-64/fullchain.pem expires on 2026-06-12 (skipped)
  /data/tls/certbot/live/npm-65/fullchain.pem expires on 2026-06-12 (skipped)
  /data/tls/certbot/live/npm-66/fullchain.pem expires on 2026-06-12 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
debian-server:/app#

No renewals attempted, as certbot seems to believe the certificates expire on 2026-06-12 whereas the NPMPlus web UI is showing an expiry date of Jun 8, 2026.

Here's what happens when I renew one of them manually from the web UI:

Docker logs:

1780759599713	2026-06-06T15:26:39.713Z	Saving debug log to /tmp/certbot-log/letsencrypt.log
1780759599713	2026-06-06T15:26:39.713Z	  /data/tls/certbot/live/npm-66/fullchain.pem (success)
1780759599713	2026-06-06T15:26:39.713Z	Renewing an existing certificate for *.mydomain.com
1780759599713	2026-06-06T15:26:39.713Z	Processing /data/tls/certbot/renewal/npm-66.conf
1780759558910	2026-06-06T15:25:58.910Z	[Global        ] › ⬤  debug     CMD: certbot --config /etc/certbot.ini renew --server https://acme-v02.api.letsencrypt.org/directory --cert-name npm-66 --new-key --force-renewal
1780759558910	2026-06-06T15:25:58.910Z	Saving debug log to /tmp/certbot-log/letsencrypt.log
1780759558910	2026-06-06T15:25:58.910Z	[TLS           ] › ℹ  info      Congratulations! You have successfully revoked the certificate that was located at /data/tls/certbot/live/npm-66/cert.pem.
1780759555957	2026-06-06T15:25:55.957Z	[Global        ] › ⬤  debug     CMD: certbot --config /etc/certbot.ini revoke --cert-name npm-66 --reason superseded --no-delete-after-revoke
1780759555957	2026-06-06T15:25:55.957Z	[TLS           ] › ℹ  info      Renewing Certbot certificates via Hetzner Cloud for Cert #66: *.mydomain.com

Running certbot within the container again:

debian-server:/app# certbot --config /etc/certbot.ini renew --server https://acme-v02.api.letsencrypt.org/directory
Saving debug log to /tmp/certbot-log/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-64.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-65.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-66.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certificates are not due for renewal yet:
  /data/tls/certbot/live/npm-64/fullchain.pem expires on 2026-06-12 (skipped)
  /data/tls/certbot/live/npm-65/fullchain.pem expires on 2026-06-12 (skipped)
  /data/tls/certbot/live/npm-66/fullchain.pem expires on 2026-06-13 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
debian-server:/app#

Cert 66 is now showing an expiry date of 2026-06-13. Same for the web UI

So for now, after a manual renewal it seems fixed again... I will monitor for the next expiry and see if I can keep my docker logs around for troubleshooting.

Zoey2936 Jun 7, 2026
Maintainer

yes please report back once this happens again

Answer selected by Zoey2936

Matthias-vdE · 2026-06-10T19:34:17Z

Matthias-vdE
Jun 10, 2026
Author

I can confirm that automatic certificate renewal is not working. I have checked my docker logs for "cert" but there were 0 entries since the last container reboot 3 days ago:

After running

certbot --config /etc/certbot.ini renew --server https://acme-v02.api.letsencrypt.org/directory manually in the npmplus container, all my certificates got renewed. So they were up for renewal, but the npmplus container didn´t seem to initiate this despite the - "CERTBOT_RUN_INTERVAL=3" environment variable.

debian-server:/app# certbot --config /etc/certbot.ini renew --server https://acme-v02.api.letsencrypt.org/directory
Saving debug log to /tmp/certbot-log/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-64.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Renewing an existing certificate for *.mydomain.com
Waiting 30 seconds for DNS changes to propagate

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-65.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Renewing an existing certificate for mydomain.com
Waiting 30 seconds for DNS changes to propagate

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-66.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Renewing an existing certificate for *.myotherdomain.com
Waiting 30 seconds for DNS changes to propagate

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all renewals succeeded: 
  /data/tls/certbot/live/npm-64/fullchain.pem (success)
  /data/tls/certbot/live/npm-65/fullchain.pem (success)
  /data/tls/certbot/live/npm-66/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
debian-server:/app# certbot --config /etc/certbot.ini renew --server https://acme-v02.api.letsencrypt.org/directory
Saving debug log to /tmp/certbot-log/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-64.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-65.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /data/tls/certbot/renewal/npm-66.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certificates are not due for renewal yet:
  /data/tls/certbot/live/npm-64/fullchain.pem expires on 2026-06-17 (skipped)
  /data/tls/certbot/live/npm-65/fullchain.pem expires on 2026-06-17 (skipped)
  /data/tls/certbot/live/npm-66/fullchain.pem expires on 2026-06-17 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
debian-server:/app#

After logging off and logging back on, even in an Incognito window, the certificate dates in the web UI are mismatching again:

vs the certbot log entries:

  /data/tls/certbot/live/npm-64/fullchain.pem expires on 2026-06-17 (skipped)
  /data/tls/certbot/live/npm-65/fullchain.pem expires on 2026-06-17 (skipped)
  /data/tls/certbot/live/npm-66/fullchain.pem expires on 2026-06-17 (skipped)

2 replies

Zoey2936 Jun 10, 2026
Maintainer

I think this might be again the same openappsec bug as #3424, can you try to disable openappsec attachment please?

Matthias-vdE Jun 10, 2026
Author

Sure, I'll disable it and monitor again for a few days.

Matthias-vdE · 2026-06-16T12:49:12Z

Matthias-vdE
Jun 16, 2026
Author

Disabling Openappsec does indeed make the certification renewal process trigger correctly:

1 reply

Zoey2936 Jun 16, 2026
Maintainer

ok then see openappsec/attachment#69

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Certificate expiry date mismatch/no auto-renewal of certs #3434

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments 5 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Certificate expiry date mismatch/no auto-renewal of certs #3434

Uh oh!

Matthias-vdE Jun 6, 2026

Replies: 3 comments · 5 replies

Uh oh!

Zoey2936 Jun 6, 2026 Maintainer

Uh oh!

Matthias-vdE Jun 6, 2026 Author

Uh oh!

Zoey2936 Jun 7, 2026 Maintainer

Uh oh!

Matthias-vdE Jun 10, 2026 Author

Uh oh!

Zoey2936 Jun 10, 2026 Maintainer

Uh oh!

Matthias-vdE Jun 10, 2026 Author

Uh oh!

Matthias-vdE Jun 16, 2026 Author

Uh oh!

Zoey2936 Jun 16, 2026 Maintainer

Matthias-vdE
Jun 6, 2026

Replies: 3 comments 5 replies

Zoey2936
Jun 6, 2026
Maintainer

Matthias-vdE Jun 6, 2026
Author

Zoey2936 Jun 7, 2026
Maintainer

Matthias-vdE
Jun 10, 2026
Author

Zoey2936 Jun 10, 2026
Maintainer

Matthias-vdE Jun 10, 2026
Author

Matthias-vdE
Jun 16, 2026
Author

Zoey2936 Jun 16, 2026
Maintainer