Error creating certificate (NGINX Proxy manager & Docker)

abrin518 · December 14, 2023, 9:01pm

May anyeone can help me?
I'm not sure to solve this.
The DNS records are pointing on the server (* and @)

I ran this command:
Command: certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-17" --agree-tos --authenticator webroot --email "@.com" --preferred-challenges "dns,http" --domains "files.hyspi.de"

It produced this output:

2023-12-14 20:48:41,521:DEBUG:certbot._internal.main:certbot version: 2.5.0
2023-12-14 20:48:41,521:DEBUG:certbot._internal.main:Location of certbot entry point: /usr/bin/certbot
2023-12-14 20:48:41,521:DEBUG:certbot._internal.main:Arguments: ['--config', '/etc/letsencrypt.ini', '--work-dir', '/tmp/letsencrypt-lib', '--logs-dir', '/tmp/letsencrypt-log', '--cert-name', 'npm-16', '--agree-tos', '--authenticator', 'webroot', '--email', '**@****.de', '--preferred-challenges', 'dns,http', '--domains', 'files.****.de']
2023-12-14 20:48:41,521:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2023-12-14 20:48:41,535:DEBUG:certbot._internal.log:Root logging level set at 30
2023-12-14 20:48:41,536:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2023-12-14 20:48:41,538:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * webroot
Description: Saves the necessary validation files to a .well-known/acme-challenge/ directory within the nominated webroot path. A seperate HTTP server must be running and serving files from the webroot path. HTTP challenge only (wildcards not supported).
Interfaces: Authenticator, Plugin
Entry point: webroot = certbot._internal.plugins.webroot:Authenticator
Initialized: <certbot._internal.plugins.webroot.Authenticator object at 0x7f055d0bef28>
Prep: True
2023-12-14 20:48:41,539:DEBUG:certbot._internal.plugins.selection:Selected authenticator <certbot._internal.plugins.webroot.Authenticator object at 0x7f055d0bef28> and installer None
2023-12-14 20:48:41,539:INFO:certbot._internal.plugins.selection:Plugins selected: Authenticator webroot, Installer None
2023-12-14 20:48:41,562:DEBUG:certbot._internal.main:Picked account: <Account(RegistrationResource(body=Registration(key=None, contact=(), agreement=None, status=None, terms_of_service_agreed=None, only_return_existing=None, external_account_binding=None), uri='https://acme-v02.api.letsencrypt.org/acme/acct/1326707****', new_authzr_uri=None, terms_of_service=None), e376d4cae85adfaf0cee72ee2d5fb62d, Meta(creation_dt=datetime.datetime(2023, 9, 24, 19, 22, 18, tzinfo=<UTC>), creation_host='163bc696f06e', register_to_eff=None))>
2023-12-14 20:48:41,562:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2023-12-14 20:48:41,564:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org:443
2023-12-14 20:48:42,016:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "GET /directory HTTP/1.1" 200 752
2023-12-14 20:48:42,016:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Thu, 14 Dec 2023 20:48:41 GMT
Content-Type: application/json
Content-Length: 752
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "B9oNOfi97PI": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
  "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
  "meta": {
    "caaIdentities": [
      "letsencrypt.org"
    ],
    "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf",
    "website": "https://letsencrypt.org"
  },
  "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
  "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
  "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
  "renewalInfo": "https://acme-v02.api.letsencrypt.org/draft-ietf-acme-ari-01/renewalInfo/",
  "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"
}
2023-12-14 20:48:42,017:DEBUG:certbot._internal.display.obj:Notifying user: Requesting a certificate for files.hyspi.de
2023-12-14 20:48:42,021:DEBUG:acme.client:Requesting fresh nonce
2023-12-14 20:48:42,021:DEBUG:acme.client:Sending HEAD request to https://acme-v02.api.letsencrypt.org/acme/new-nonce.
2023-12-14 20:48:42,168:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "HEAD /acme/new-nonce HTTP/1.1" 200 0
2023-12-14 20:48:42,168:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Thu, 14 Dec 2023 20:48:42 GMT
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: AOx6y72mWhL3XbhdnERzJVUPZYjDuEM9PHNYufvS1ttcggFKcsg
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800


2023-12-14 20:48:42,169:DEBUG:acme.client:Storing nonce: AOx6y72mWhL3XbhdnERzJVUPZYjDuEM9PHNYufvS1ttcggFKcsg
2023-12-14 20:48:42,169:DEBUG:acme.client:JWS payload:
b'{\n  "identifiers": [\n    {\n      "type": "dns",\n      "value": "files.****.de"\n    }\n  ]\n}'
2023-12-14 20:48:42,171:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/new-order:
{
  "protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8****************bmNyeXB0Lm9yZy9hY21lL2FjY3QvMTMyNjcwNzg4NiIsICJub25jZSI6ICJBT3g2eTcybVdoTDNYYmhkbkVSekpWVVBaWWpEdUVNOVBITll1ZnZTMXR0Y2dnRktjc2ciLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL25ldy1vcmRlciJ9",
  "signature": "lFMehYeW-5nk2p0BeJe9lTsAKhQKpclGnagFJ8Iqh37Wpg8GIKn4gEt50zgV8kT-P_bTTvXLoRfynAlY3YO3Y_4NYpGfjcStoCskMxrriVVzCvhq1PgbsTtvH1nXDg09xzOpMLk60sMq_uUqPVRZpURRpD8HpzexxZ8iZZnst5WCpjN0HLHkAzknKATISSxacIj5I6RdX9SriNvL6tN8IXtNM1vsW3mS9re2PJl3xya-3iKD5eY-73_o4viDmS2ybeR7ClqPojw5mpnaGo0AmcMiYixwHXMBFGSGzUbVlO-VmOeR5kJYJLAGexmNb8hpG2yj8H-sC7RwP0d38mfvWA",
  "payload": "ewogICJpZGVudGlmaWVycyI6IFsKICAgIHsKICAgICAgInR5cGUiOiAiZG5zIiwKICAgICAgInZhbHVlIjogImZp****"
}
2023-12-14 20:48:42,357:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/new-order HTTP/1.1" 429 213
2023-12-14 20:48:42,358:DEBUG:acme.client:Received response:
HTTP 429
Server: nginx
Date: Thu, 14 Dec 2023 20:48:42 GMT
Content-Type: application/problem+json
Content-Length: 213
Connection: keep-alive
Boulder-Requester: 1326707886
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: AOx6y72mqZkJwDpBaYjB5Pt5****3b83m508xiv_lYxEZag

{
  "type": "urn:ietf:params:acme:error:rateLimited",
  "detail": "Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/failed-validation-limit/",
  "status": 429
}
2023-12-14 20:48:42,358:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/bin/certbot", line 8, in <module>
    sys.exit(main())
  File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 19, in main
    return internal_main.main(cli_args)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 1864, in main
    return config.func(config, plugins)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 1597, in certonly
    lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 141, in _get_and_save_cert
    lineage = le_client.obtain_and_enroll_certificate(domains, certname)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 516, in obtain_and_enroll_certificate
    cert, chain, key, _ = self.obtain_certificate(domains)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 428, in obtain_certificate
    orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 478, in _get_order_and_authorizations
    orderr = self.acme.new_order(csr_pem)
  File "/opt/certbot/lib/python3.7/site-packages/acme/client.py", line 138, in new_order
    response = self._post(self.directory['newOrder'], order)
  File "/opt/certbot/lib/python3.7/site-packages/acme/client.py", line 366, in _post
    return self.net.post(*args, **kwargs)
  File "/opt/certbot/lib/python3.7/site-packages/acme/client.py", line 739, in post
    return self._post_once(*args, **kwargs)
  File "/opt/certbot/lib/python3.7/site-packages/acme/client.py", line 752, in _post_once
    response = self._check_response(response, content_type=content_type)
  File "/opt/certbot/lib/python3.7/site-packages/acme/client.py", line 603, in _check_response
    raise messages.Error.from_json(jobj)
acme.messages.Error: urn:ietf:params:acme:error:rateLimited :: There were too many requests of a given type :: Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/failed-validation-limit/
2023-12-14 20:48:42,360:ERROR:certbot._internal.log:An unexpected error occurred:
2023-12-14 20:48:42,360:ERROR:certbot._internal.log:Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/failed-validation-limit/

My web server is (include version):
NGINX

The operating system my web server runs on is (include version):
Ubunntu 23.2.2

My hosting provider, if applicable, is:
Netcup

I can login to a root shell on my machine (yes or no, or I don't know):
yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
yes

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

MikeMcQ · December 14, 2023, 9:25pm

abrin518:

{
  "type": "urn:ietf:params:acme:error:rateLimited",
  "detail": "Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/failed-validation-limit/",
  "status": 429
}

We would have to know the errors that happened before this one. This is just saying you are temporarily blocked due to too many failures too soon. See that link for more details

But, the earlier errors may be related to you saying you have an nginx server yet an OpenResty server is responding to HTTP requests to your domain.

While the below test said "OK" that just means it successfully communicated to a server and got an expected response (a 404). My eyes noticed you expect an nginx server to reply so this maybe a problem. Check that the DNS IP matches your public IP

Request to: files.hyspi.de/89.58.62.61, Result: [Address=89.58.62.61,Address Type=IPv4,Server=openresty,HTTP Status=404]

system · January 13, 2024, 9:25pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Error creating certificate in Nginx Proxy Manager [Solved] Help	6	12990	November 16, 2021
Problems by creating a new certificate Help	9	863	February 25, 2023
Failure in getting certificate from nginx proxy manager running in container Help	6	913	May 17, 2022
Can't create a certificate Help	5	749	September 17, 2019
Cert creation fail Help	11	707	October 14, 2022

Error creating certificate (NGINX Proxy manager & Docker)

Related topics