Auto renewal doesn't work, "Internal Error"

[Salvora]

Problem/Motivation

The certs didn't get renewed after expiration.

Expected behavior

It should be renewed automatically.

Actual behavior

I use cloudflare with dns challange. (Wildcard certs)
Cloudflare DNS proxy is disabled.
The renewal doesn't work however I can get a new certificate with the same credentials. But when it expires, it will again fail to renew and I will have to manually get the certificate again.

I am getting below error in data/logs/letsencrypt/letsencrypt.log

2021-08-17 21:03:55,029:CRITICAL:certbot._internal.auth_handler:Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.
2021-08-17 21:03:55,029:ERROR:certbot._internal.renewal:Failed to renew certificate npm-2 with error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.
2021-08-17 21:03:55,036:DEBUG:certbot._internal.renewal:Traceback was:
Traceback (most recent call last):
  File "/usr/lib/python3.8/site-packages/certbot/_internal/renewal.py", line 471, in handle_renewal_request
    main.renew_cert(lineage_config, plugins, renewal_candidate)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1235, in renew_cert
    renewed_lineage = _get_and_save_cert(le_client, config, lineage=lineage)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 124, in _get_and_save_cert
    renewal.renew_cert(config, domains, le_client, lineage)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/renewal.py", line 331, in renew_cert
    new_cert, new_chain, new_key, _ = le_client.obtain_certificate(domains, new_key)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 374, in obtain_certificate
    orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 421, in _get_order_and_authorizations
    authzr = self.auth_handler.handle_authorizations(orderr, best_effort)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 62, in handle_authorizations
    achalls = self._choose_challenges(authzrs)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 204, in _choose_challenges
    path = gen_challenge_path(
  File "/usr/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 319, in gen_challenge_path
    return _find_smart_path(challbs, preferences, combinations)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 355, in _find_smart_path
    _report_no_chall_path(challbs)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 394, in _report_no_chall_path
    raise errors.AuthorizationError(msg)
certbot.errors.AuthorizationError: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.

2021-08-17 21:03:57,170:INFO:certbot._internal.auth_handler:Performing the following challenges:
2021-08-17 21:03:57,171:CRITICAL:certbot._internal.auth_handler:Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.
2021-08-17 21:03:57,172:ERROR:certbot._internal.renewal:Failed to renew certificate npm-3 with error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.
2021-08-17 21:03:57,174:DEBUG:certbot._internal.renewal:Traceback was:
Traceback (most recent call last):
  File "/usr/lib/python3.8/site-packages/certbot/_internal/renewal.py", line 471, in handle_renewal_request
    main.renew_cert(lineage_config, plugins, renewal_candidate)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1235, in renew_cert
    renewed_lineage = _get_and_save_cert(le_client, config, lineage=lineage)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 124, in _get_and_save_cert
    renewal.renew_cert(config, domains, le_client, lineage)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/renewal.py", line 331, in renew_cert
    new_cert, new_chain, new_key, _ = le_client.obtain_certificate(domains, new_key)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 374, in obtain_certificate
    orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 421, in _get_order_and_authorizations
    authzr = self.auth_handler.handle_authorizations(orderr, best_effort)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 62, in handle_authorizations
    achalls = self._choose_challenges(authzrs)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 204, in _choose_challenges
    path = gen_challenge_path(
  File "/usr/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 319, in gen_challenge_path
    return _find_smart_path(challbs, preferences, combinations)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 355, in _find_smart_path
    _report_no_chall_path(challbs)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 394, in _report_no_chall_path
    raise errors.AuthorizationError(msg)
certbot.errors.AuthorizationError: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.

2021-08-17 21:03:57,179:DEBUG:certbot.display.util:Notifying user: 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2021-08-17 21:03:57,179:ERROR:certbot._internal.renewal:All renewals failed. The following certificates could not be renewed:
2021-08-17 21:03:57,180:ERROR:certbot._internal.renewal:  /etc/letsencrypt/live/npm-2/fullchain.pem (failure)
  /etc/letsencrypt/live/npm-3/fullchain.pem (failure)
2021-08-17 21:03:57,181:DEBUG:certbot.display.util:Notifying user: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2021-08-17 21:03:57,181:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/bin/certbot", line 33, in <module>
    sys.exit(load_entry_point('certbot==1.11.0', 'console_scripts', 'certbot')())
  File "/usr/lib/python3.8/site-packages/certbot/main.py", line 15, in main
    return internal_main.main(cli_args)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1421, in main
    return config.func(config, plugins)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1318, in renew
    renewal.handle_renewal_request(config)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/renewal.py", line 496, in handle_renewal_request
    raise errors.Error("{0} renew failure(s), {1} parse failure(s)".format(
certbot.errors.Error: 2 renew failure(s), 0 parse failure(s)
2021-08-17 21:03:57,183:ERROR:certbot._internal.log:2 renew failure(s), 0 parse failure(s)

some info are omitted but I can provide them if requested.

Steps to reproduce

Get a certificate from cloudflare with dns challange using your cloudflare api key.
Wait for it to expire.

Proposed changes

(If you have a proposed change, workaround or fix,
describe the rationale behind it)

[hs6666]

Hi, I am gerting the exact same issue (using cloudflared api), inaccessible ha :(

[eddiegrau]

Same issue here. I tried the renew button 3 times and it worked on the third try. Not sure why, haven't had a chance to dig into it.

[X1pheR]

Also same issue here, again. Using a wildcard certificate with DNS challenge on CloudFlare. Previous time it happened I thought I had done something wrong. I couldn't renew and only received timeout message. So eventually I removed the certificate and created a new one which worked right away. Also, shouldn't it automatically renew? In the logs I see a expire timer message. So I would believe it should normally also renew automatically right?

In case it helps here is also my log

[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] permissions: applying... 
[fix-attrs.d] permissions: exited 0.
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 00-banner.sh: executing... 
-----------------------------------------------------------
 Add-on: Nginx Proxy Manager
 Manage Nginx proxy hosts with a simple, powerful interface
-----------------------------------------------------------
 Add-on version: 0.11.0
 You are running the latest version of this add-on.
 System: Home Assistant OS 6.2  (aarch64 / raspberrypi4-64)
 Home Assistant Core: 2021.9.1
 Home Assistant Supervisor: 2021.08.1
-----------------------------------------------------------
 Please, share the above information when looking for help
 or support in, e.g., GitHub, forums or the Discord chat.
-----------------------------------------------------------
[cont-init.d] 00-banner.sh: exited 0.
[cont-init.d] 01-log-level.sh: executing... 
[cont-init.d] 01-log-level.sh: exited 0.
[cont-init.d] mysql.sh: executing... 
[cont-init.d] mysql.sh: exited 0.
[cont-init.d] nginx.sh: executing... 
[cont-init.d] nginx.sh: exited 0.
[cont-init.d] npm.sh: executing... 
[cont-init.d] npm.sh: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
[14:47:49] INFO: Starting the Manager...
[14:47:49] INFO: Starting NGinx...
[9/3/2021] [2:47:55 PM] [Migrate  ] › ℹ  info      Current database version: 20210210154703
[9/3/2021] [2:48:01 PM] [Setup    ] › ℹ  info      Added Certbot plugins certbot-dns-cloudflare==1.8.0 cloudflare
[9/3/2021] [2:48:01 PM] [IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[9/3/2021] [2:48:01 PM] [IP Ranges] › ℹ  info      Fetching https://ip-ranges.amazonaws.com/ip-ranges.json
[9/3/2021] [2:48:02 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[9/3/2021] [2:48:02 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[9/3/2021] [2:48:02 PM] [SSL      ] › ℹ  info      Let's Encrypt Renewal Timer initialized
[9/3/2021] [2:48:02 PM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...
[9/3/2021] [2:48:02 PM] [IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized
[9/3/2021] [2:48:02 PM] [Global   ] › ℹ  info      Backend PID 540 listening on port 3000 ...
[9/3/2021] [2:48:51 PM] [SSL      ] › ✖  error     Error: Command failed: /usr/bin/certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation  
Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.
Failed to renew certificate npm-1 with error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. You may need to use an authenticator plugin that can do challenges over DNS.
All renewals failed. The following certificates could not be renewed:
  /etc/letsencrypt/live/npm-1/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
    at ChildProcess.exithandler (child_process.js:308:12)
    at ChildProcess.emit (events.js:315:20)
    at maybeClose (internal/child_process.js:1048:16)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:288:5)
`QueryBuilder#allowEager` method is deprecated. You should use `allowGraph` instead. `allowEager` method will be removed in 3.0
`QueryBuilder#eager` method is deprecated. You should use the `withGraphFetched` method instead. `eager` method will be removed in 3.0
QueryBuilder#omit is deprecated. This method will be removed in version 3.0
[9/3/2021] [2:50:42 PM] [SSL      ] › ℹ  info      Renewing Let'sEncrypt certificates via Cloudflare for Cert #1: *.hypershell.nl
[03/Sep/2021:14:52:57 +0200] 400 - - http localhost "-" [Client 138.199.28.42] [Length 150] [Gzip -] "-" "-"
[03/Sep/2021:14:52:57 +0200] 400 - - http localhost "-" [Client 5.253.204.151] [Length 150] [Gzip -] "-" "-"
[03/Sep/2021:14:52:57 +0200] 400 - - http localhost "-" [Client 45.133.172.81] [Length 150] [Gzip -] "-" "-"
[03/Sep/2021:14:52:57 +0200] 400 - GET http i.pixita.com "/robots.txt" [Client 185.246.211.182] [Length 248] [Gzip -] "-" "-"
[03/Sep/2021:14:52:57 +0200] 400 - - http localhost "-" [Client 212.102.49.72] [Length 150] [Gzip -] "-" "-"
[03/Sep/2021:14:52:57 +0200] 400 - GET http i.pixita.com "/robots.txt" [Client 178.162.222.41] [Length 248] [Gzip -] "-" "-"
[9/3/2021] [2:54:51 PM] [SSL      ] › ℹ  info      - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/npm-1.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Renewing an existing certificate for *.hypershell.nl
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/npm-1/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all renewals succeeded: 
  /etc/letsencrypt/live/npm-1/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[X1pheR]

Quick update. I restarted and I'm now seeing I have a new renewed certificate. But looking back in my previous log it appears it was renewed when I pressed the renew button a second time. Then I restarted. However, home assistant itself was not accessible. the other web interfaces from addons I proxied were though (bitwarden/unifi). See log 1 below.

Then I closed the nginx proxy manager addon and tried checking wat was up with home assistant itself. Eventually looked like nothing was wrong so I started the addon again but now I can access home assistant again from externally. See log 2. I didn't do anything though.

So for me problem solved for now. Hope the logs help and if I can provide anything else please let me know. And in the meanwhile I'll hope the renewal bug is fixed upon my next renewal 😁🤞🏼

Log 1 - Renewed but home assistant not reachable

[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] permissions: applying... 
[fix-attrs.d] permissions: exited 0.
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 00-banner.sh: executing... 
-----------------------------------------------------------
 Add-on: Nginx Proxy Manager
 Manage Nginx proxy hosts with a simple, powerful interface
-----------------------------------------------------------
 Add-on version: 0.11.0
 You are running the latest version of this add-on.
 System: Home Assistant OS 6.2  (aarch64 / raspberrypi4-64)
 Home Assistant Core: 2021.9.1
 Home Assistant Supervisor: 2021.08.1
-----------------------------------------------------------
 Please, share the above information when looking for help
 or support in, e.g., GitHub, forums or the Discord chat.
-----------------------------------------------------------
[cont-init.d] 00-banner.sh: exited 0.
[cont-init.d] 01-log-level.sh: executing... 
[cont-init.d] 01-log-level.sh: exited 0.
[cont-init.d] mysql.sh: executing... 
[cont-init.d] mysql.sh: exited 0.
[cont-init.d] nginx.sh: executing... 
[cont-init.d] nginx.sh: exited 0.
[cont-init.d] npm.sh: executing... 
[cont-init.d] npm.sh: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
[15:12:12] INFO: Starting the Manager...
[15:12:12] INFO: Starting NGinx...
[9/3/2021] [3:12:16 PM] [Migrate  ] › ℹ  info      Current database version: 20210210154703
[03/Sep/2021:15:12:20 +0200] - 400 400 - POST https home.hypershell.nl "/api/webhook/ce1c3c7421422724a93573e531919856bb1b67789726d265e5e177311d650e7c" [Client 141.101.104.188] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"
[03/Sep/2021:15:12:20 +0200] - 400 400 - POST https home.hypershell.nl "/api/webhook/ce1c3c7421422724a93573e531919856bb1b67789726d265e5e177311d650e7c" [Client 162.158.111.242] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"
[03/Sep/2021:15:12:21 +0200] - 400 400 - POST https home.hypershell.nl "/api/webhook/ce1c3c7421422724a93573e531919856bb1b67789726d265e5e177311d650e7c" [Client 141.101.105.229] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"
[03/Sep/2021:15:12:21 +0200] - 400 400 - POST https home.hypershell.nl "/api/webhook/ce1c3c7421422724a93573e531919856bb1b67789726d265e5e177311d650e7c" [Client 141.101.76.177] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"
[9/3/2021] [3:12:22 PM] [Setup    ] › ℹ  info      Added Certbot plugins certbot-dns-cloudflare==1.8.0 cloudflare
[9/3/2021] [3:12:22 PM] [IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[9/3/2021] [3:12:22 PM] [IP Ranges] › ℹ  info      Fetching https://ip-ranges.amazonaws.com/ip-ranges.json
[9/3/2021] [3:12:22 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[9/3/2021] [3:12:22 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[9/3/2021] [3:12:22 PM] [SSL      ] › ℹ  info      Let's Encrypt Renewal Timer initialized
[9/3/2021] [3:12:22 PM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...
[9/3/2021] [3:12:22 PM] [IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized
[9/3/2021] [3:12:22 PM] [Global   ] › ℹ  info      Backend PID 540 listening on port 3000 ...
[9/3/2021] [3:12:27 PM] [Nginx    ] › ℹ  info      Reloading Nginx
[9/3/2021] [3:12:27 PM] [SSL      ] › ℹ  info      Renew Complete
`QueryBuilder#allowEager` method is deprecated. You should use `allowGraph` instead. `allowEager` method will be removed in 3.0
`QueryBuilder#eager` method is deprecated. You should use the `withGraphFetched` method instead. `eager` method will be removed in 3.0
QueryBuilder#omit is deprecated. This method will be removed in version 3.0
[03/Sep/2021:15:12:34 +0200] - 400 400 - POST https home.hypershell.nl "/api/webhook/46a572e57009c3868f34a344e25216ea16d71e162d4b64e9ff1c77747770f218" [Client 172.70.82.101] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"
[03/Sep/2021:15:12:40 +0200] - 200 200 - GET https bitwarden.hypershell.nl "/api/accounts/revision-date" [Client 141.101.77.115] [Length 13] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "-"
[03/Sep/2021:15:12:45 +0200] - 400 400 - POST https home.hypershell.nl "/api/webhook/3ecb7ec4562f563a67e6764467b87e30634ebff1bb88e079e9a13aea72f8a7cf" [Client 172.69.54.100] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"
[03/Sep/2021:15:12:51 +0200] - 400 400 - POST https home.hypershell.nl "/api/webhook/3ecb7ec4562f563a67e6764467b87e30634ebff1bb88e079e9a13aea72f8a7cf" [Client 141.101.104.214] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"
[03/Sep/2021:15:13:27 +0200] - 400 400 - POST https home.hypershell.nl "/auth/token" [Client 162.158.89.112] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "OpenAuth" "-"
[03/Sep/2021:15:13:53 +0200] - 400 400 - GET https home.hypershell.nl "/" [Client 172.70.82.101] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "-"
[03/Sep/2021:15:13:54 +0200] - 400 400 - GET https home.hypershell.nl "/manifest.json" [Client 172.70.82.101] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "https://home.hypershell.nl/lovelace"
[03/Sep/2021:15:13:54 +0200] - 400 400 - POST https home.hypershell.nl "/auth/token" [Client 172.70.82.101] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "https://home.hypershell.nl/"
[03/Sep/2021:15:13:54 +0200] - 400 400 - GET https home.hypershell.nl "/api/websocket" [Client 172.70.82.244] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "-"
[03/Sep/2021:15:13:56 +0200] - 400 400 - GET https home.hypershell.nl "/service_worker.js" [Client 172.70.82.39] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "https://home.hypershell.nl/service_worker.js"
[03/Sep/2021:15:13:57 +0200] - 400 400 - GET https home.hypershell.nl "/lovelace" [Client 172.70.82.101] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "https://home.hypershell.nl/lovelace"
[03/Sep/2021:15:13:58 +0200] - 400 400 - GET https home.hypershell.nl "/favicon.ico" [Client 172.70.82.149] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "https://home.hypershell.nl/lovelace"
[03/Sep/2021:15:13:59 +0200] - 400 400 - GET https home.hypershell.nl "/service_worker.js" [Client 172.70.82.39] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "https://home.hypershell.nl/service_worker.js"
[03/Sep/2021:15:14:35 +0200] - 400 400 - POST https home.hypershell.nl "/api/webhook/ce1c3c7421422724a93573e531919856bb1b67789726d265e5e177311d650e7c" [Client 141.101.105.93] [Length 16] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"

Log 2 - Restarted addon with long pause in between and home assistant is working again

[cont-init.d] mysql.sh: executing... 
[cont-init.d] mysql.sh: exited 0.
[cont-init.d] nginx.sh: executing... 
[cont-init.d] nginx.sh: exited 0.
[cont-init.d] npm.sh: executing... 
[cont-init.d] npm.sh: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
[15:55:12] INFO: Starting NGinx...
[15:55:12] INFO: Starting the Manager...
[9/3/2021] [3:55:17 PM] [Migrate  ] › ℹ  info      Current database version: 20210210154703
2021/09/03 15:55:22 [error] 574#574: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 10.0.0.131, server: nginxproxymanager, request: "GET /api/ HTTP/1.1", upstream: "http://127.0.0.1:3000/", host: "homeassistant:81", referrer: "http://homeassistant:81/nginx/proxy"
[9/3/2021] [3:55:23 PM] [Setup    ] › ℹ  info      Added Certbot plugins certbot-dns-cloudflare==1.8.0 cloudflare
[9/3/2021] [3:55:23 PM] [IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[9/3/2021] [3:55:23 PM] [IP Ranges] › ℹ  info      Fetching https://ip-ranges.amazonaws.com/ip-ranges.json
[9/3/2021] [3:55:23 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[9/3/2021] [3:55:24 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[9/3/2021] [3:55:24 PM] [SSL      ] › ℹ  info      Let's Encrypt Renewal Timer initialized
[9/3/2021] [3:55:24 PM] [SSL      ] › ℹ  info      Renewing SSL certs close to expiry...
[9/3/2021] [3:55:24 PM] [IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized
[9/3/2021] [3:55:24 PM] [Global   ] › ℹ  info      Backend PID 539 listening on port 3000 ...
[9/3/2021] [3:55:29 PM] [Nginx    ] › ℹ  info      Reloading Nginx
[9/3/2021] [3:55:29 PM] [SSL      ] › ℹ  info      Renew Complete
`QueryBuilder#allowEager` method is deprecated. You should use `allowGraph` instead. `allowEager` method will be removed in 3.0
`QueryBuilder#eager` method is deprecated. You should use the `withGraphFetched` method instead. `eager` method will be removed in 3.0
QueryBuilder#omit is deprecated. This method will be removed in version 3.0
[03/Sep/2021:15:57:27 +0200] - 200 200 - GET https bitwarden.hypershell.nl "/api/accounts/revision-date" [Client 172.69.55.82] [Length 13] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "-"
[03/Sep/2021:15:57:40 +0200] - 200 200 - POST https home.hypershell.nl "/api/webhook/46a572e57009c3868f34a344e25216ea16d71e162d4b64e9ff1c77747770f218" [Client 162.158.92.179] [Length 2] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"
[03/Sep/2021:15:57:40 +0200] - 200 200 - POST https home.hypershell.nl "/api/webhook/46a572e57009c3868f34a344e25216ea16d71e162d4b64e9ff1c77747770f218" [Client 162.158.92.179] [Length 2] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"
[03/Sep/2021:15:58:47 +0200] - 200 200 - POST https bitwarden.hypershell.nl "/api/ciphers" [Client 172.70.51.180] [Length 2237] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "-"
[03/Sep/2021:15:58:47 +0200] - 200 200 - GET https bitwarden.hypershell.nl "/api/ciphers/5433413b-444e-4106-8f72-5dd4660ef514" [Client 172.70.51.180] [Length 2237] [Gzip -] [Sent-to 10.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84" "-"
[03/Sep/2021:15:59:20 +0200] - 200 200 - POST https home.hypershell.nl "/api/webhook/46a572e57009c3868f34a344e25216ea16d71e162d4b64e9ff1c77747770f218" [Client 141.101.105.229] [Length 2] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"
[03/Sep/2021:15:59:20 +0200] - 200 200 - POST https home.hypershell.nl "/api/webhook/46a572e57009c3868f34a344e25216ea16d71e162d4b64e9ff1c77747770f218" [Client 141.101.105.229] [Length 2] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"
[03/Sep/2021:15:59:41 +0200] - 200 200 - POST https home.hypershell.nl "/api/webhook/46a572e57009c3868f34a344e25216ea16d71e162d4b64e9ff1c77747770f218" [Client 162.158.111.242] [Length 312] [Gzip -] [Sent-to 10.0.0.1] "okhttp/4.9.1" "-"

[Salvora]

@X1pheR I am curious, is your cloudflare DNS proxy enabled for your dns records? Mine is not.

[X1pheR]

Hi @Salvora , yes the proxy is enabled for all records.

[rantanlan]

This seem to be an upstream issue. Can we get a new version @frenck ? Seems to be fixed in the latest version... NginxProxyManager/nginx-proxy-manager#1286

[John10240]

not work too...

[porok]

Same issue..

[sochkasov]

+1

[mundschenk-at]

Just got a mail from Let's Encrypt that my certificate is expiring soon. /cc @frenck

[X1pheR]

me also. @frenck could update so that the auto renewal function is fixed?

[frenck]

auto renewal function is fixed?

I don't have that problem.

Can we get a new version @frenck ? Seems to be fixed in the latest version...

It is being worked on, but is a large overhaul that takes time.

[Maes152]

Any news on this yet? Every 3 months I run into huge issues when my SSL certificate expires.
It's going to expire again tomorrow, I've been desperately trying to renew the certificate today but to no avail. At one point I deleted the existing certificate through the NPM interface and now I cannot add it back anymore. It keeps telling me "an error occured: Another instance of certbot is already running".

[Salvora]

@Maes152 Did you try restarting the addon? If not it should time out after a while.
@frenck

I don't have that problem.

This doesn't make sense. At least my cloudflare DNS challange renewals always fail. It has not been able to auto-renew the certs even once. The problem is due to some upstream issue I think, I don't exactly remember but I've seen a similar issue on NPM github pages being fixed with an update.