Failure in getting certificate from nginx proxy manager running in container

I have a problem getting the certificate in nginx proxy manager. Here are the logs from /var/log/letsencrypt in the container. What can you make out of this ? (both side.gr and site.eu domains are "obfuscated" and the word "site" represents the same word registered both as .gr and .eu).

--------------------------- logs ---------------------------------------------
2022-04-16 16:04:35,750:DEBUG:certbot._internal.main:certbot version: 1.25.0
2022-04-16 16:04:35,751:DEBUG:certbot._internal.main:Location of certbot entry point: /usr/bin/certbot
2022-04-16 16:04:35,751:DEBUG:certbot._internal.main:Arguments: ['--config', '/etc/letsencrypt.ini', '--cert-name', 'npm-6', '--agree-tos', '--authenticator', 'webroot', '--email', 'administrator@site.gr', '--preferred-challenges', 'dns,http', '--domains', 'manage.site.eu']
2022-04-16 16:04:35,752:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2022-04-16 16:04:35,765:DEBUG:certbot._internal.log:Root logging level set at 30
2022-04-16 16:04:35,766:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2022-04-16 16:04:35,769:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * webroot
Description: Place files in webroot directory
Interfaces: Authenticator, Plugin
Entry point: webroot = certbot._internal.plugins.webroot:Authenticator
Initialized: <certbot._internal.plugins.webroot.Authenticator object at 0x7f23151e97f0>
Prep: True
2022-04-16 16:04:35,770:DEBUG:certbot._internal.plugins.selection:Selected authenticator <certbot._internal.plugins.webroot.Authenticator object at 0x7f23151e97f0> and installer None
2022-04-16 16:04:35,770:INFO:certbot._internal.plugins.selection:Plugins selected: Authenticator webroot, Installer None
2022-04-16 16:04:35,840:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2022-04-16 16:04:35,842:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org:443
2022-04-16 16:04:55,872:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
File "/opt/certbot/lib/python3.7/site-packages/urllib3/connection.py", line 175, in _new_conn
(self._dns_host, self.port), self.timeout, **extra_kw
File "/opt/certbot/lib/python3.7/site-packages/urllib3/util/connection.py", line 72, in create_connection
for res in socket.getaddrinfo(host, port, family, socket.SOCK_STREAM):
File "/usr/lib/python3.7/socket.py", line 748, in getaddrinfo
for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
socket.gaierror: [Errno -3] Temporary failure in name resolution

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/certbot/lib/python3.7/site-packages/urllib3/connectionpool.py", line 710, in urlopen
chunked=chunked,
File "/opt/certbot/lib/python3.7/site-packages/urllib3/connectionpool.py", line 386, in _make_request
self._validate_conn(conn)
File "/opt/certbot/lib/python3.7/site-packages/urllib3/connectionpool.py", line 1040, in _validate_conn
conn.connect()
File "/opt/certbot/lib/python3.7/site-packages/urllib3/connection.py", line 358, in connect
self.sock = conn = self._new_conn()
File "/opt/certbot/lib/python3.7/site-packages/urllib3/connection.py", line 187, in _new_conn
self, "Failed to establish a new connection: %s" % e
urllib3.exceptions.NewConnectionError: <urllib3.connection.HTTPSConnection object at 0x7f23151f05f8>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/certbot/lib/python3.7/site-packages/requests/adapters.py", line 450, in send
timeout=timeout
File "/opt/certbot/lib/python3.7/site-packages/urllib3/connectionpool.py", line 786, in urlopen
method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]
File "/opt/certbot/lib/python3.7/site-packages/urllib3/util/retry.py", line 592, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f23151f05f8>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/bin/certbot", line 8, in
sys.exit(main())
File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 19, in main
return internal_main.main(cli_args)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 1715, in main
return config.func(config, plugins)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 1556, in certonly
le_client = _init_le_client(config, auth, installer)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 810, in _init_le_client
acc, acme = _determine_account(config)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 725, in _determine_account
config, account_storage, tos_cb=_tos_cb)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 216, in register
acme = acme_from_config_key(config, key)
File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/client.py", line 76, in acme_from_config_key
client = acme_client.BackwardsCompatibleClientV2(net, key, config.server)
File "/opt/certbot/lib/python3.7/site-packages/acme/client.py", line 877, in init
directory = messages.Directory.from_json(net.get(server).json())
File "/opt/certbot/lib/python3.7/site-packages/acme/client.py", line 1238, in get
self._send_request('GET', url, **kwargs), content_type=content_type)
File "/opt/certbot/lib/python3.7/site-packages/acme/client.py", line 1176, in _send_request
response = self.session.request(method, url, *args, **kwargs)
File "/opt/certbot/lib/python3.7/site-packages/requests/sessions.py", line 529, in request
resp = self.send(prep, **send_kwargs)
File "/opt/certbot/lib/python3.7/site-packages/requests/sessions.py", line 645, in send
r = adapter.send(request, **kwargs)
File "/opt/certbot/lib/python3.7/site-packages/requests/adapters.py", line 519, in send
raise ConnectionError(e, request=request)
requests.exceptions.ConnectionError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f23151f05f8>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution'))
2022-04-16 16:04:55,875:ERROR:certbot._internal.log:An unexpected error occurred:
2022-04-16 16:04:55,875:ERROR:certbot._internal.log:requests.exceptions.ConnectionError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f23151f05f8>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution'))
--------------------------- logs ---------------------------------------------

It looks like your container is not resolving names with DNS properly

From the container, what does this do?

nslookup acme-v02.api.letsencrypt.org

Note: I am placing this over in Help topic to draw more attention.

3 Likes

It says that nslookup command does not exist. I have found a solution though. I was mislead. I was trying to use ufw and the ports were not blocked even though I restarted again and again the firewall. Googling I have found a thread in stackoverflow that said that docker was messing with the iptables and the advice was to insert in /etc/docker/daemon.json (the file did not exist and I created it) this object : { "iptables" : false }. The result was that the containers could not access the internet. I tried in the container with "apt-get update" and the result was the same (Temporary failure in name resolution). It was then easy to figure out what was the problem.

1 Like

Besides my solution does anyone know a way to make ufw and docker cooperate excepting the answer in the solution...

Edit - Here is the solution:

That's a question better directed to the Docker forum.

2 Likes

actually, they don't. docker just does whatever the hell it wants using its own iptables chain.

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.