Auto SSL certificate renewal failing using AWS Route53 DNS #1916
Comments
|
@coreylane I am having the same issue. Would you be kind enough to share the manual command, please? I could not find it. Thank you. |
|
@chaddm Try renewing through the NPM GUI, under SSL Certificates -> Renew Now
|
|
@coreylane Thank you. It worked correctly. |
|
Same issue. Renewing manually through GUI fixed the issue which was the renewal at 4/25/2022 1:01AM `[4/24/2022] [10:41:18 PM] [SSL ] › ℹ info Renewing SSL certs close to expiry... Renewing an existing certificate for *.NOTMYDOMAIN.com Congratulations, all renewals succeeded:
|
|
I can replicate this issue. Works manually via the GUI. |
|
I have the same issue. I'm unable to verify the logs (it's been a week or two since the last manual renewal) but symptoms are the same. Let's Encrypt via Route53 DNS, get e-mail from Let's Encrypt that the cert was not automatically renewed, manual renewal saves the day. |
|
I have the same Issue, Automatic renewal doesn't work, manual renewal does. Below a snippet from the docker log: Auto renewalManual renewalNOTE: I've anonymized the domain names, but the structure is the same |
|
I'm still experiencing this issue on the latest version. Is anyone able to fix this issue? |
@matthew-larner Renewing through the NPM GUI works fine for me, I posted a screenshot in an earlier comment. If this doesn't work you may have an issue with your AWS credentials. Perhaps the User doesn't have required permissions to route53. What do your logs say? Required AWS permissions: |
|
@coreylane renewing via the GUI works fine. Automatic renewals don't though. Since I have 50+ entries it's a real pain having to renew manually. How much effort is required to fix the auto renewals? Thanks for you help on this. |
|
It looks like the code use for auto renewal isnt using the same renewal functions as the UI, but a simple command to certbot nginx-proxy-manager/backend/internal/certificate.js Lines 42 to 106 in 14b889a It should use this function to renew the certificates nginx-proxy-manager/backend/internal/certificate.js Lines 999 to 1028 in 14b889a I've "quick" fixed my installation by hardcoding the aws credentials: const cmd = certbotCommand + ' renew --non-interactive --quiet ' +
'--config "' + letsencryptConfig + '" ' +
'--preferred-challenges "dns,http" ' +
'--disable-hook-validation ' +
(letsencryptStaging ? '--staging' : '');
let mainCmd = 'AWS_CONFIG_FILE=\'/etc/letsencrypt/credentials/credentials-3\' '+cmd
return utils.exec(/*cmd*/mainCmd)
.then((result) => { |
|
@jc21 if I can push a fix for this would you support a PR? |
|
Still having this issue. I was able to resolve by passing the credentials as an environment variable in docker-compose:
|
|
Just to thank @miztertea for contributing a solution, and to confirm that the env variable solved the problem for me as well. |
|
How would I handle this for an install that has multiple credential files? I have 9 domains requiring certificates with all separate AWS keys. credentials-11, credentials-13...etc |
|
Unfortunately this workaround will only help with one credential file. I suppose you could create one IAM user that has access to all of your domains. As long as its the same IAM user, it won't matter which cred file you specify as they would all be the same access/secret pair |
This still would only work from one AWS tenant/account |
|
You can also pass the credentials directly to the certbot by setting two environment vars in your docker-compose file: |
|
That is excellent @Ich-Eben. Thanks! |
|
I implemented @emkookmer's suggestion in #3392 |
Just came to thank you for your attention to detail here <3 Thank you! |
|
Issue is now considered stale. If you want to keep it open, please comment 👍 |
Uh oh!
There was an error while loading. Please reload this page.
Checklist
jc21/nginx-proxy-manager:latestdocker image?Describe the bug
Automatic SSL certificate renewal fails when using AWS Route53 DNS challenge, but renewing manually through NPM console works fine.
Based on initial review of the logs, it looks like the automated renewal command is not setting the required "AWS_CONFIG_FILE" environment variable:
Nginx Proxy Manager Version
v2.9.16
To Reproduce
Steps to reproduce the behavior:
Expected behavior
SSL certificate is renewed as the expiry date approaches
Operating System
Unraid 6.10.0-rc2
Docker version 20.10.9, build c2ea9bc
Additional context
Logs
Workaround: Renewing through the console works as expected
The text was updated successfully, but these errors were encountered: