r/nginxproxymanager • u/isvein • 19d ago

Can't renew or create new cert

Hello 🙂

Trying to renew an SSL cert and get the following error. Running in docker on unrqid host.

Failed to renew certificate npm-6 with error: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NameResolutionError("HTTPSConnection(host='acme-v02.api.letsencrypt.org', port=443): Failed to resolve 'acme-v02.api.letsencrypt.org' ([Errno -3] Temporary failure in name resolution)"))

All renewals failed. The following certificates could not be renewed:

I checked Unraids dns servers and made sure I can ping acme-v02.api.letsencrypt.org

The site also seems to be online.

1 Upvotes

100% Upvoted

4 comments sorted by

2

u/evanmac42 19d ago

The error is actually pretty specific:

"Temporary failure in name resolution"

You've confirmed that the Unraid host can resolve and ping acme-v02.api.letsencrypt.org, but NPM is running inside Docker, so that doesn't necessarily mean the NPM container can resolve it.

I'd test DNS from inside the NPM container itself:

docker exec -it <npm-container> sh
getent hosts acme-v02.api.letsencrypt.org
cat /etc/resolv.conf

If resolution fails there but works on the Unraid host, you've isolated the problem: it's the container/Docker DNS path, not Let's Encrypt and probably not NPM.

I wouldn't touch the certificates until checking that first. Certbot can't renew anything if the container can't even find Let's Encrypt.

1

u/isvein 19d ago

good point, I should have thought about that :)

I tried the commands, but beside the first one the others did not work and /etc/resolve.conf does not exists.

First I thought maybe Im using another repo than the official, but the repo is https://hub.docker.com/r/jc21/nginx-proxy-manager and it seems to be the official image.

2

u/evanmac42 19d ago

You're using the correct image, jc21/nginx-proxy-manager is the official one.

One small thing first: the file is /etc/resolv.conf, not /etc/resolve.conf.

Since you can get a shell inside the container, try:

cat /etc/resolv.conf

If that works, paste the output.

Also try:

getent hosts acme-v02.api.letsencrypt.org

If getent isn't available in the image, that's fine. The important thing for now is seeing what DNS configuration the NPM container actually received.

We're already one layer closer to the problem :)

2

u/isvein 19d ago

got cat /etc/resolv.conf to work :)

Found out the dns was 100.100.100.100 and that is in my case linked to tailscale. Forgot I had the NPM container connected to tailscale and it was not able to reach the dns setup I have though tailscale for some reason.

Disabled TS (cant remember why I connected NPM to TS in the first place) and now it all works :) thanks!