DNS Challenge Azure failing

[kingfisher77]

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes
• Are you sure you're not using someone else's docker image?
  • Yes
• Have you searched for similar issues (both open and closed)?
  • Yes

Describe the bug

DNS challenge with Azure DNS fails.

warning   Command failed: . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-azure~=1.2.0  && deactivate
nginx-proxy-nginx-proxy-1  | ERROR: Will not install to the user site because it will lack sys.path precedence to cryptography in /opt/certbot/lib/python3.7/site-packages

Nginx Proxy Manager Version

2.10.0 - 2.10.1

In Version 2.9.22 the error is a different one:

AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

To Reproduce
Steps to reproduce the behavior:

1. Go to SSL Certificates
2. Click on Add SSL Certificate/Let's Encrypt
3. Choose DNS Challenge/Azure
4. Give Domain Name and Credentials for Azure
5. Press Save

Expected behavior

Procede like usual to generate Certificates

Screenshots

Operating System

Additional context

[Schmackos]

Experience the same issue on 2.10.1. Resulting in not being able to login and high CPU load (due to the container constantly trying to upgrade).

[Migrate ] › ℹ info Current database version: 20211108145214
[Global ] › ✖ error Command failed: . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-transip~=0.4.3 && deactivate
ERROR: Will not install to the user site because it will lack sys.path precedence to cryptography in /opt/certbot/lib/python3.7/site-packages

[RafaelSchridi]

I get the same thing with transip

[4/1/2023] [10:05:12 PM] [Global   ] › ✖  error     Command failed: . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-transip~=0.4.3  && deactivate
ERROR: Will not install to the user site because it will lack sys.path precedence to cryptography in /opt/certbot/lib/python3.7/site-packages

[M1chka]

I fixed it this way:

# docker exec -it CONTAINERID sh
# apt update
# apt install build-essential libssl-dev libffi-dev python3-dev
# . /opt/certbot/bin/activate
# rm -rf /opt/eff.org/*
# pip install -U certbot
# pip install cryptography==3.4.3

[kingfisher77]

Next time you refresh the container, its gone

[Schmackos]

Agreed, but at least a work around for now, until this gets resolved.

[kingfisher77]

Since a proxy is mission critical for us, we took a closer look at traefik. Really nice! The learning curve is a bit higher, but in the end it is transparent and simple. And very flexible! Good by NPM - it was nice but too buggy ;-)

[RafaelSchridi]

Since a proxy is mission critical for us, we took a closer look at traefik. Really nice! The learning curve is a bit higher, but in the end it is transparent and simple. And very flexible! Good by NPM - it was nice but too buggy ;-)

After waiting a full year for the access list to get fixed, and now this, I think it's time for me to look at at Traefik too. I picked NPM for it simplicity but I really need stability now.

[tiny656]

Since a proxy is mission critical for us, we took a closer look at traefik. Really nice! The learning curve is a bit higher, but in the end it is transparent and simple. And very flexible! Good by NPM - it was nice but too buggy ;-)

After waiting a full year for the access list to get fixed, and now this, I think it's time for me to look at at Traefik too. I picked NPM for it simplicity but I really need stability now.

@RafaelSchridi , here is my practice, use https://github.com/acmesh-official/acme.sh to issue and renew cert automatically, and create soft link for cert from acme.sh publish folder into ~/nginx-proxy-manager/data/custom_ssl/npm-2 folder.

basically, custom ssl use delegate way by acme.sh to provide.
for acme.sh example, my case uses Azure DNS, you can check my docker-compose file here.

[KRGT-NL]

I fixed it this way:

# docker exec -it CONTAINERID sh
# apt update
# apt install build-essential libssl-dev libffi-dev python3-dev
# . /opt/certbot/bin/activate
# rm -rf /opt/eff.org/*
# pip install -U certbot
# pip install cryptography==3.4.3

With this I have my workaround for DNS challenge with in my case TransIP.

When will this bug be fixed? I really like NPM! @jc21

[kingfisher77]

Continue to https://doc.traefik.io/traefik/getting-started/install-traefik This is really a much nicer concept and the quality of the software is not comparable - much more stable. The dynamic configuration is tremendous! I have made the move and do not regret it.

[RafaelSchridi]

I fixed it this way:

# docker exec -it CONTAINERID sh
# apt update
# apt install build-essential libssl-dev libffi-dev python3-dev
# . /opt/certbot/bin/activate
# rm -rf /opt/eff.org/*
# pip install -U certbot
# pip install cryptography==3.4.3

This was working fine until I got an email from letsencrypt today saying my domains are expiring in 20 days.

[6/28/2023] [8:01:23 PM] [SSL      ] › ✖  error     Error: Command failed: certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --preferred-challenges "dns,http" --disable-hook-validation  
Renewal configuration file /etc/letsencrypt/renewal/npm-11.conf (cert: npm-11) produced an unexpected error: 'Namespace' object has no attribute 'dns_transip_propagation_seconds'. Skipping.
Renewal configuration file /etc/letsencrypt/renewal/npm-6.conf (cert: npm-6) produced an unexpected error: 'Namespace' object has no attribute 'dns_transip_credentials'. Skipping.0 renew failure(s), 2 parse failure(s)

    at ChildProcess.exithandler (node:child_process:402:12)
    at ChildProcess.emit (node:events:513:28)
    at maybeClose (node:internal/child_process:1100:16)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)

No idea what changed, guess I've got a deadline on my traefik switch

[kingfisher77]

I am extremely happy with traefik.

[JDunnio]

Experiencing the same when renewing cert with TransIP DNS challenge. Please fix this.

@RafaelSchridi, tnx for this. This worked. Seams like this is an outdated component?

[7/19/2023] [10:49:03 AM] [SSL ] › ℹ info Renewing Let'sEncrypt certificates via TransIP for Cert #7: *.DOMAIN.EXT
[7/19/2023] [10:49:03 AM] [SSL ] › ℹ info Command: certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-7" --disable-hook-validation --no-random-sleep-on-renew
[7/19/2023] [10:49:03 AM] [Express ] › ⚠ warning Command failed: certbot renew --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-7" --disable-hook-validation --no-random-sleep-on-renew
Traceback (most recent call last):
File "/usr/bin/certbot", line 5, in
from certbot.main import main
File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 6, in
from certbot._internal import main as internal_main
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 21, in
import josepy as jose
File "/opt/certbot/lib/python3.7/site-packages/josepy/init.py", line 40, in
from josepy.json_util import (
File "/opt/certbot/lib/python3.7/site-packages/josepy/json_util.py", line 14, in
from OpenSSL import crypto
File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/init.py", line 8, in
from OpenSSL import crypto, SSL
File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/crypto.py", line 1517, in
class X509StoreFlags(object):
File "/opt/certbot/lib/python3.7/site-packages/OpenSSL/crypto.py", line 1537, in X509StoreFlags
CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'