# Unable to Renew Certificate (Traefik - Docker\_ProviderTLS)

**URL:** <https://community.letsencrypt.org/t/unable-to-renew-certificate-traefik-docker-providertls/149586>\
**Category:** Help\
**Created:** [April 13, 2021, 9:13am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificate-traefik-docker-providertls/149586 "2021-04-13T09:13:01Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![buju](https://avatars.discourse-cdn.com/v4/letter/b/34f0e0/32.png) [@buju](https://community.letsencrypt.org/u/buju)\
**Post date:** [April 13, 2021, 9:13am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificate-traefik-docker-providertls/149586/1 "2021-04-13T09:13:02Z")

</div>

Hello Guys,

Two days now i'm trying to get rid of the weired behavior.  
I have more than one server with same OS versions, running odoo behind a traefik reverse.  
So, same configuration for docker-compose and traefik.toml. And on some of them, the minus 30 days certificate renewal fails with the bellow errors.  
Logs are reporting a FW issue, but there is no FORWARD issue on port 443  
Could you please provide support ?

My domains are: [odoo12.imaginationsfertiles.fr](http://odoo12.imaginationsfertiles.fr) and [odoo12-test.imaginationsfertiles.fr](http://odoo12-test.imaginationsfertiles.fr)

I ran this command: sudo docker-compose up -d --force-recreate

#### My docker-compose

version: "2.1"  
services:  
proxy:  
image: traefik:latest  
container\_name: inverseproxy  
environment:  
TZ: "Europe/Paris"  
networks:  
shared:  
aliases:  
- [odoo12.imaginationsfertiles.fr](http://odoo12.imaginationsfertiles.fr)  
- [odoo12-test.imaginationsfertiles.fr](http://odoo12-test.imaginationsfertiles.fr)  
smtp:  
private:  
volumes:  
- cert:/etc/traefik/acme:rw,Z  
- logs:/var/log/traefik/:rw  
- ./traefik.toml:/etc/traefik/traefik.toml:ro  
ports:  
- "80:80"  
- "443:443"  
depends\_on:  
- dockersocket  
restart: unless-stopped

```
dockersocket:
    image: tecnativa/docker-socket-proxy
    container_name: inverseproxy_socket
    privileged: true
    userns_mode: "host"
    networks:
        private:
    volumes:
        - /var/run/docker.sock:/var/run/docker.sock
    environment:
        CONTAINERS: 1
        NETWORKS: 1
        SERVICES: 1
        SWARM: 1
        TASKS: 1
    restart: unless-stopped

```

networks:  
shared:  
driver\_opts:  
encrypted: 1  
smtp:  
internal: true  
driver\_opts:  
encrypted: 1  
private:  
internal: true  
driver\_opts:  
encrypted: 1

volumes:  
cert:

#### My traefik

entryPoints]  
[entryPoints.web]  
address = ":80"  
[entryPoints.web.http]  
[entryPoints.web.http.redirections]  
[entryPoints.web.http.redirections.entryPoint]  
to = "websecure"  
scheme = "https"

[entryPoints.websecure]  
address = ":443"  
[entryPoints.websecure.http]  
middlewares = ["security-headers@file", "limit@file", "compression@file"]  
[entryPoints.websecure.http.tls]  
options = "default"  
certResolver = "le"

[providers]  
[providers.docker]  
endpoint = "[http://dockersocket:2375](http://dockersocket:2375)"  
exposedByDefault = false  
network = "inverseproxy\_shared"  
[providers.file]  
directory = "/etc/traefik"

[log]  
level = "DEBUG"

[accesslog]  
filePath = "/var/log/traefik/access.log"  
[accessLog.fields]  
defaultMode = "keep"  
[accessLog.fields.headers]  
defaultMode = "keep"  
[accessLog.fields.names]  
StartUTC = "drop"  
[accessLog.filters]  
statusCodes = "400-499"

[certificatesResolvers]  
[certificatesResolvers.le]  
[certificatesResolvers.le.acme]  
email = "mco@mail"  
storage = "/etc/traefik/acme/acme.json"  
[certificatesResolvers.le.acme.tlsChallenge]

[http]  
[http.middlewares]  
[http.middlewares.security-headers.headers]  
browserXssFilter = true  
contentTypeNosniff = true  
referrerPolicy = "same-origin"  
forceSTSHeader = true  
frameDeny = true  
customFrameOptionsValue = "SAMEORIGIN"  
sslRedirect = true  
stsIncludeSubdomains = true  
stsPreload = true  
stsSeconds = 15552000  
[http.middlewares.security-headers.headers.customResponseHeaders]  
server = "" # Removes  
[http.middlewares.compression.compress]  
[http.middlewares.limit.buffering]  
retryExpression = "IsNetworkError() && Attempts() \< 5"  
[http.middlewares.auth.basicAuth]  
users = ["iffil:gdfgdgdfggdggdfqzrerer]  
[http.middlewares.smtp-stripprefix.stripprefix]  
prefixes = ["/smtp"]  
[http.middlewares.norobot-headers.headers]  
[http.middlewares.norobot-headers.headers.customResponseHeaders]  
X-Robots-Tag = "noindex, nofollow"

[tls]  
[tls.options]  
[tls.options.default]  
minVersion = "VersionTLS12"  
sniStrict = true  
cipherSuites = [  
"TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384",  
"TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384",  
"TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256",  
"TLS\_ECDHE\_ECDSA\_WITH\_CHACHA20\_POLY1305",  
"TLS\_ECDHE\_RSA\_WITH\_CHACHA20\_POLY1305",  
"TLS\_AES\_256\_GCM\_SHA384",  
"TLS\_AES\_128\_GCM\_SHA256",  
"TLS\_CHACHA20\_POLY1305\_SHA256",  
"TLS\_FALLBACK\_SCSV" # Client is doing version fallback. See RFC 7507.  
]

My web server is (include version):  
Moved from traefik: v2.4 to traefik:latest

The operating system my web server runs on is (include version):  
DISTRIB\_ID=Ubuntu  
DISTRIB\_RELEASE=20.04  
DISTRIB\_CODENAME=focal  
DISTRIB\_DESCRIPTION="Ubuntu 20.04.2 LTS"

I can login to a root shell on my machine (yes ):  
And i get following error after runing the command#  
"sudo docker-compose logs -f | grep -i error"

##### 

inverseproxy | time="2021-04-13T10:41:45+02:00" level=debug msg="Setting up buffering: request limits: 0 (mem), 0 (max), response limits: 0 (mem), 0 (max) with retry: 'IsNetworkError() && Attempts() \< 5'" middlewareType=Buffer entryPointName=websecure routerName=websecure-odootest-restrict@docker middlewareName=limit@file  
inverseproxy | time="2021-04-13T10:41:45+02:00" level=error msg="Error renewing certificate from LE: {[odoo12-test.imaginationsfertiles.fr](http://odoo12-test.imaginationsfertiles.fr) }, error: one or more domains had a problem:\n[[odoo12-test.imaginationsfertiles.fr](http://odoo12-test.imaginationsfertiles.fr)] acme: error: 400 :: urn:ietf:params:acme:error:connection :: Timeout during connect (likely firewall problem)\n" providerName=le.acme  
inverseproxy | time="2021-04-13T10:41:47+02:00" level=debug msg="Setting up buffering: request limits: 0 (mem), 0 (max), response limits: 0 (mem), 0 (max) with retry: 'IsNetworkError() && Attempts() \< 5'" middlewareName=limit@file middlewareType=Buffer entryPointName=websecure routerName=websecure-odootestsmtp@docker

---

<div class="post-metadata">

**Author:** ![buju](https://avatars.discourse-cdn.com/v4/letter/b/34f0e0/32.png) [@buju](https://community.letsencrypt.org/u/buju)\
**Post date:** [April 13, 2021, 10:37am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificate-traefik-docker-providertls/149586/2 "2021-04-13T10:37:34Z")

</div>

Is the [testflume.ct.letsencrypt.org](http://testflume.ct.letsencrypt.org) (Testing) listed under [https://letsencrypt.status.io/](https://letsencrypt.status.io/) has any impact on certificate renewal ?

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [April 13, 2021, 3:51pm UTC](https://community.letsencrypt.org/t/unable-to-renew-certificate-traefik-docker-providertls/149586/3 "2021-04-13T15:51:03Z")

</div>

Nope, it doesn't. (I'm not familiar with docker nor Traefik, so can't help you with that, sorry.)

---

<div class="post-metadata">

**Author:** ![buju](https://avatars.discourse-cdn.com/v4/letter/b/34f0e0/32.png) [@buju](https://community.letsencrypt.org/u/buju)\
**Post date:** [April 14, 2021, 7:29am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificate-traefik-docker-providertls/149586/4 "2021-04-14T07:29:24Z")

</div>

Thanks Osiris for your insights.  
Anyone to help me tackle this issue ?  
Regards

---

<div class="post-metadata">

**Author:** ![buju](https://avatars.discourse-cdn.com/v4/letter/b/34f0e0/32.png) [@buju](https://community.letsencrypt.org/u/buju)\
**Post date:** [April 14, 2021, 7:40am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificate-traefik-docker-providertls/149586/5 "2021-04-14T07:40:33Z")

</div>

Following the test result from outside:  
curl -IkL -m 15 [https://odoo12.imaginationsfertiles.fr](https://odoo12.imaginationsfertiles.fr)  
HTTP/2 200  
content-type: text/html; charset=utf-8  
date: Wed, 14 Apr 2021 07:38:01 GMT  
referrer-policy: same-origin  
set-cookie: session\_id=8eb5ec378fb4ce9b3dd77b313be5cefea1d33849; Expires=Tue, 13-Jul-2021 07:38:01 GMT; Max-Age=7776000; HttpOnly; Path=/  
strict-transport-security: max-age=15552000; includeSubDomains; preload  
vary: Accept-Encoding  
x-content-type-options: nosniff  
x-frame-options: SAMEORIGIN  
x-xss-protection: 1; mode=block  
content-length: 84

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [April 14, 2021, 9:20am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificate-traefik-docker-providertls/149586/6 "2021-04-14T09:20:19Z")

</div>

Hi @buju

> [@buju](#):
>
> My domains are: [odoo12.imaginationsfertiles.fr](http://odoo12.imaginationsfertiles.fr)

I don't know how docker works.

But your configuration has minimal two bugs, that can't work - see [https://check-your-website.server-daten.de/?q=odoo12.imaginationsfertiles.fr#url-checks](https://check-your-website.server-daten.de/?q=odoo12.imaginationsfertiles.fr#url-checks)

| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://odoo12.imaginationsfertiles.fr/](http://odoo12.imaginationsfertiles.fr/) 51.178.182.65 | 301 | [https://odoo12.imaginationsfertiles.fr/](https://odoo12.imaginationsfertiles.fr/) Html is minified: 100,00 % | 0.040 | A |
| | | | | |
| • [http://odoo12.imaginationsfertiles.fr/](http://odoo12.imaginationsfertiles.fr/) 2001:41d0:404:200::5475 | -14 | | 10.030 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [https://odoo12.imaginationsfertiles.fr/](https://odoo12.imaginationsfertiles.fr/) 51.178.182.65 Inline-JavaScript (∑/total): 1/41 Inline-CSS (∑/total): 0/0 | 200 | Html is minified: 323,08 % | 2.537 | B |
| small visible content (num chars: 0) | | | | |
| | | | | |
| • [https://odoo12.imaginationsfertiles.fr/](https://odoo12.imaginationsfertiles.fr/) 2001:41d0:404:200::5475 | -14 | | 10.023 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [http://odoo12.imaginationsfertiles.fr/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://odoo12.imaginationsfertiles.fr/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) 51.178.182.65 | -14 | | 10.020 | T |
| Timeout - The operation has timed out | | | | |
| Visible Content: | | | | |
| | | | | |
| • [http://odoo12.imaginationsfertiles.fr/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://odoo12.imaginationsfertiles.fr/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) 2001:41d0:404:200::5475 | -14 | | 10.020 | T |
| Timeout - The operation has timed out | | | | |

1. Checking your root http + ipv4 works, http + ipv6 doesn't work, timeout. That's fatal, Letsencrypt prefers ipv6, so your domain isn't visible.

2. But http + ipv4 + / answers, http + ipv4 + /.well-known/acme-challenge/random-filename doesn't answer.

Looks like you have another, additional configuration (proxy, that handles /.well-known, firewall, that blocks). /.well-known/acme-challenge/random-filename must answer (via ipv6, if you have ipv6).

---

<div class="post-metadata">

**Author:** ![buju](https://avatars.discourse-cdn.com/v4/letter/b/34f0e0/32.png) [@buju](https://community.letsencrypt.org/u/buju)\
**Post date:** [April 14, 2021, 10:03am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificate-traefik-docker-providertls/149586/7 "2021-04-14T10:03:18Z")

</div>

Thanks JuergenAuer for your detailed insights.  
I'm a newbie in using Traefik-Lestencrypt + Docker but now that i switched my Challenge from tls to http, thing seems to work better. Certificates have been renewed from 30 May to 31 July.  
Plus, the provided configuration had to work well and is still working on other servers i'm managing.  
I just check if ipv6 is disabled with the following result:  
imaginationsfertiles:~# sysctl -a 2\>/dev/null | grep disable\_ipv6  
net.ipv6.conf.all.disable\_ipv6 = 0  
net.ipv6.conf.br-20ecbfce02ee.disable\_ipv6 = 0  
net.ipv6.conf.br-6725bc40c6ec.disable\_ipv6 = 0  
net.ipv6.conf.br-6cf611c31e54.disable\_ipv6 = 0  
net.ipv6.conf.br-7a18718d6ea9.disable\_ipv6 = 0  
net.ipv6.conf.br-a5fd79c1b984.disable\_ipv6 = 0  
net.ipv6.conf.br-ccf861744af8.disable\_ipv6 = 0  
net.ipv6.conf.default.disable\_ipv6 = 0  
net.ipv6.conf.docker0.disable\_ipv6 = 0  
net.ipv6.conf.ens3.disable\_ipv6 = 0  
net.ipv6.conf.lo.disable\_ipv6 = 0  
net.ipv6.conf.veth021bd63.disable\_ipv6 = 0  
net.ipv6.conf.veth2b34572.disable\_ipv6 = 0  
net.ipv6.conf.veth445ab16.disable\_ipv6 = 0  
net.ipv6.conf.veth514ca69.disable\_ipv6 = 0  
net.ipv6.conf.veth6794eae.disable\_ipv6 = 0  
net.ipv6.conf.veth76d77ac.disable\_ipv6 = 0  
net.ipv6.conf.veth7e8c973.disable\_ipv6 = 0  
net.ipv6.conf.vetha21cb84.disable\_ipv6 = 0  
net.ipv6.conf.vethc69ed9f.disable\_ipv6 = 0  
net.ipv6.conf.vethca3b2d6.disable\_ipv6 = 0  
net.ipv6.conf.vethda8d313.disable\_ipv6 = 0  
net.ipv6.conf.vethe711f18.disable\_ipv6 = 0  
net.ipv6.conf.vethef3b9a7.disable\_ipv6 = 0

Also checked ipv6 open ports , only ssh and monitoring solutions ports are open.  
I have check that no more than these ports are open on working servers .

Could i say requirement for Letsencrypt tlsChallenge include https ip6 port open ?

Could you please explain a bit regarding bugs you mentioned ?

Regards

---

<div class="post-metadata">

**Author:** ![buju](https://avatars.discourse-cdn.com/v4/letter/b/34f0e0/32.png) [@buju](https://community.letsencrypt.org/u/buju)\
**Post date:** [April 14, 2021, 10:39am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificate-traefik-docker-providertls/149586/8 "2021-04-14T10:39:27Z")

</div>

And what about this entry

| P | [https://51.178.182.65/](https://51.178.182.65/) 51.178.182.65 |
| --- | --- |
| | -10 |
| | |
| | Error creating a TLS-Connection: TLSv1.3 found, but no connection via TLSv1.2 possible. Please activate TLSv1.2 |

Could it be my main issue ?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [May 14, 2021, 10:40am UTC](https://community.letsencrypt.org/t/unable-to-renew-certificate-traefik-docker-providertls/149586/9 "2021-05-14T10:40:02Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.