Internal error on SSL certificates #180
Comments
|
I founded this is docker inspect looks like something is blocking curl wich should not be the case [
{
"Id": "5396c4e1207e3486ccb714d7cf9f2027f8be83c35fcbc5c0393d7cb3120a4609",
"Created": "2019-07-26T12:05:10.838857676Z",
"Path": "/init",
"Args": [],
"State": {
"Status": "running",
"Running": true,
"Paused": false,
"Restarting": false,
"OOMKilled": false,
"Dead": false,
"Pid": 15761,
"ExitCode": 0,
"Error": "",
"StartedAt": "2019-07-29T07:06:18.91961627Z",
"FinishedAt": "2019-07-29T07:05:44.533099275Z",
"Health": {
"Status": "unhealthy",
"FailingStreak": 23,
"Log": [
{
"Start": "2019-07-29T07:11:08.475218801Z",
"End": "2019-07-29T07:11:08.698302026Z",
"ExitCode": 1,
"Output": " % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 9876: Connection refused\n"
},
{
"Start": "2019-07-29T07:11:23.708785289Z",
"End": "2019-07-29T07:11:23.931405635Z",
"ExitCode": 1,
"Output": " % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 9876: Connection refused\n"
},
{
"Start": "2019-07-29T07:11:38.941957592Z",
"End": "2019-07-29T07:11:39.161505674Z",
"ExitCode": 1,
"Output": " % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 9876: Connection refused\n"
},
{
"Start": "2019-07-29T07:11:54.171975308Z",
"End": "2019-07-29T07:11:54.424361521Z",
"ExitCode": 1,
"Output": " % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 9876: Connection refused\n"
}, |
IIPoliII
changed the title
|
When trying to ping my own ip on port 9876 (docker proxy i get this)
|
|
I finnaly went back to another snapshot i think the issue was that i auto run the container but if i am right it already does it ? |
|
Okay i said nothing it did it again and i founded what is the issue. So basiclly create a new proxy host "Request a new SSL certificate". Then confirm, once you have done it remodify the host and add some more domaine, subdomain and go back in ssl certificates and "Request a new SSL certificate" save it and there it is the internal error. |
|
After that it's impossible to use let's encrypt ever again in an ways |
IIPoliII
changed the title
|
I ran into this issue just today. I proceeded under the assumption that it was a bug. While reviewing the docker logs I noticed it was looking for "npm-4" and "npm-5", but it couldn't find them. Eventually I came around to deleting the error SSL and remaking the proxy host, requesting the SSL again. When you view docker logs what do they contain? |
|
I've got the same issue.
There is definitely a bug with Let's Encrypt certs. Currently my Enginx Proxy Manager works only on port 81 (so I've got access to panel). Whatever I try to change - I've got internal error (but after web page refresh changes looks like saved). Unfortunately all my web traffic is dead now regarding to this issue :( |
|
I've managed to make it running by simple copying any other cert on place where script looking for and everything start's working:
|
Can you explain me what you did exactly and it's working now ? (Also i am a noob in docker so if you could provide the command to access the docker shell with it would be really nice from you c: !) |
|
I've used Portainer (Docker GUI), but you can do it running bellowed command on your node server: To list all docker containers: To enter into container: Then inside just go into You can also do it on volume level as letsencrypt directories should be keep outside dicker container. On default config: |
|
I see intressting thanks ! i hope @jc21 see this so maybe he can foudn a fix for it |
|
Yup, just got the same issue. Has anyone found a fix yet that doesn't involve messing with the container itself? I'm not at all familiar with Docker, I'm happy that I got it running somehow haha :) Let's ping @jc21 again to see if it helps ;) |
|
Same here. Running on docker as well. |
|
same, but I have problems with NAT Loopback (because of my router). Could this be an issue? |
|
I've didn't check my logs deeply when it occur, but it can be a case (I'm using it on home configuration and behind of home router as well). |
|
Same issues as above. Don't know Docker - friend setup for me. Worked forever but had to re-image OS drive (All Virtual stuff through HyperV and none of this was even on OS drive). After that nothing works. I try to delete all hosts and SSL certs and just get "Internal Error" for everything. Hoping somebody posts some things to try / command to fix |
|
I think I found the issue. When the URL you gave it isn't reachable it'll act as if everything worked instead of telling you what went wrong. I accidentally gave it an URL that hadn't been configured properly yet. |
|
I started having this same issue yesterday after updating to 2.1.0. Rolling back to 2.0.14 seems to have fixed it. |
|
@lachlan334 it would be nice to know why it failed, the docker logs would have the info. FWIW I'm using 2.1.0 in production and not having these problems. |
|
Guys, I also have unhealthy status of npm-container, but it's works... what will be the recommendations? |
The output I'm getting from the health check is Logs are as follows: |
|
@lachlan334 hey buddy I have the same.. but npm is working fine. |
|
If it means anything, I've been getting this error with version 2.0.14 running the docker image jlesage/nginx-proxy-manager |
|
@GregHilston Yep that means a lot. I don't maintain @lachlan334 Looks like you were using that 2.1.1 image, but it doesn't make sense why the Healthcheck is still using a setting from a previous docker image. The correct healthcheck will eventually run a curl command: Perhaps try pulling down the stack entirely and putting it back up, assuming your have directory mounted volumes: |
|
I'm running into a similar problem. Requesting a new SSL certificate generates an Internal Error. ` I don't mean to hijack, but perhaps this is the same problem as OP's running into. EDIT: Code formatting |
Same here ! Using jc21's image, version 2.1.1, on docker bridge. EDIT: deleting the container and creating a new one from scratch did fix it though. |
|
Not sure if it's a docker bug or expected behaviour but it feels like upgrading a docker image within an already-created container, doesn't update the healthcheck. There were quite a few changes between 2.0.* and 2.1.* of NPM so I recommend bringing down the stack entirely and recreating it. Using existing |
|
So guys, what I need to do? Use the develop of the container? 'Coz I have unhealthy still. Thanks in advance. |
|
@SAOPP unhealthy typically means the container took more than 5 seconds to return an OK status. If you're able to create new SSL certificates, you should be good to go. The unhealthy status isn't a big deal. |
|
Yes I understood it, just interesting, and yes I can create a new certs, but I see guys talked about not possible auto renewal certs or I misunderstood? |
|
Please forgive my being uninformed on Docker, but when will this get pushed out to places like Dockerhub? I'm using an Unraid environment. |
|
@Foxglove-X I believe it was already pushed about 4 days ago. |
|
Ah I see! Mine was pulled from jlesage/nginx-proxy-manager/ which is 5 months out of date. |
|
jlesage will have to update his own docker images each time I release mine. I don't have an unraid setup myself so I don't know what changes are required to make it work |
|
Hello, docker-compose.yml config.json I tried to add new SSL certificates and i go this issue when try to generate it :
I have
Thank for all |
|
@rto54 without the logs from the docker containers themselves, there's not a whole lot anyone can debug. Can you provide them? |
|
@nldoty, You can help me for this. |
|
|
Logs letsencrypt |
|
I seem to have a very similar issue... container-start.sh docker image inspect jc21/nginx-proxy-manager:latest logs in container: Let me know if there are any other information missing from above. |
|
Not sure if anyone else has run into this. I'm running the proxy container on VM inside corporate network and when I try and create the proxy in Nginx Proxy Manager, I too get the 'Internal Error' and in the log I can see that lets encrypt can't validate my domain. Under SSL Certificates there is an entry but its immediately expired. In the DNS Manager we use I have my domain mapped to the host IP of the machine where I'm running the proxy container in the Forward Lookup Zone. Am I correct in thinking letsencrypt just can't reach my domain to validate that 'I own it'? 2020-05-04 17:10:39,713:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/4362994539 HTTP/1.1" 200 625 { |
|
@jmford775 Yes, you are correct. Letsencrypt requires you to verify ownership of a domain before issuing a certificate. It does this by first looking for a valid domain response, then reaching out to the domain to verify the server is sitting there. For this to happen you will need to point the domain to the IP you plan on using and open port 80 on that IP and have it point to your proxy container. From the sound of your post you plan on using this internally. Note that setting up internal DNS to point to your machine will not be sufficient. There must be a valid public IP address with matching DNS pointed to your container. Likewise, the certificate will be valid ONLY for that external address and will not work internally (unless you utilize the same naming scheme). For example: Your container sits on 10.0.10.y and it requests a certificate for container.internal.com. Letsencrypt does not know where your container is, because it is using an internal DNS schema. If you request container.public.com then letsencrypt will be able to see that you pointed container.public.com to your external IP (1.1.1.x) and will reach out to that IP (Port 80 [forwarded on firewall]) to verify that the container is actually sitting there. |
|
@s4b3rt0oth I have the same problem as @jmford775 but mine is to connect from the outside. My port 80 and 443 are open and pointing to NPM server but it still shows internal error. The exact same thing happened to me where once trying to add SSL cert, it shows "Internal Error" and will show the cert expired same date and time when I tried adding. |
|
Same here. Running the github-develop build.
…Sent from my iPhone
On May 5, 2020, at 2:38 PM, AnonJervis ***@***.***> wrote:
@s4b3rt0oth I have the same problem as @jmford775 but mine is to connect from the outside. My port 80 and 443 are open and pointing to NPM server but it still shows internal error. The exact same thing happened to me where once trying to add SSL cert, it shows "Internal Error" and will show the cert expired same date and time when I tried adding.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or unsubscribe.
|
|
@s4b3rt0oth Yeah I realized it was going to be a no-go being inside our corporate network and thanks for the reply. I decided since we are already behind super strict firewalls that I would just run a no-auth registry and joxit ui |
|
Same thing here. Using the Nginx Proxy Manager Add On for Home Assistant |
|
are you change expose port of npm app difference 80 ? |
|
Got the same issue... I have 4 proxy-hosts, only one is unable to get a new certificate. Finally ended up in NGINX logs where I found that NGINX is not able to fire up the webserver for verification (cannot bind IP-address to port 80). |
|
Strangely, I had certs reporting as expired, but the browser was reporting up-to-date certificates. One of my certs was disconnected for a while, so of course it's cert didn't renew. Connecting and trying to renew showed me this internal error. I restarted my docker containers, then changed the 'default site' option in settings to 'custom page'. It was previously set to '404 page'. I was thinking that the 404 was returned before the challenge file, interfering with renewals. When I looked at the certificate page, all my certs were up-to-date. So I'm not sure if it was the container reboot, or if it was changing the 'default site' option that solved my problem. Give it a try? |
|
Same issue here, i change the Default Site from Congratulations Page to Redirect and i give internal error on cert renew. i think npm redirect the request before the certbot find the /.well-known/-acme-chellenge/ i change it back for congrat page but i have a same erreor...
|
|
I had this problem at one point. I use CloudFlare DNS, and I was able to resolve by disabling CloudFlare's proxy. |
|
it has to do with the dns it cant resolve the url just set your own dns server in /etc/resolv.conf or in docker-compose |
|
As this issue is very old, there have been huge changes in how certificates work since then. And as "Internal error" is just a generic error and does not provide any information about the actual error, all newer reports probably have nothing to do with the original issue reported in this ticket. To prevent people from posting "I see an internal error too", I will close and lock this issue. If you encounter any problems please look for other issues describing the same issue as you have, or if you can't find any, open a new issue. Include as much information as possible in this new issue like logs. Also see #1271 for more information. |
and others
I tried to add new SSL certificates and i go this issue when try to generate it :
it was working perfectly fine 2 days ago i pulled the last container and for some reason i got this message (unhealthy) with
docker psThe text was updated successfully, but these errors were encountered: