Why am I getting "Failed to estabish a new connection, when I request a certificate? I can netcat to "acme-staging-v02.api.letsencrypt.org" on port 443 OK

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: eib.development.agoradcm.io

I ran this command: ./init-letsencrypt.sh

It produced this output:
Existing data found for eib.development.agoradcm.io. Continue and replace existing certificate? (y/N) y

Creating dummy certificate for eib.development.agoradcm.io ...

Creating docker-compose_certbot_run ... done
Generating a RSA private key
.................................+++++
......+++++
writing new private key to '/etc/letsencrypt/live/eib.development.agoradcm.io/privkey.pem'

Starting nginx ...

Recreating docker-compose_nginx_1 ... done

Deleting dummy certificate for eib.development.agoradcm.io ...

Creating docker-compose_certbot_run ... done

*** domain_args set to

Requesting Let's Encrypt certificate for eib.development.agoradcm.io ...

Creating docker-compose_certbot_run ... done
Saving debug log to /var/log/letsencrypt/letsencrypt.log
An unexpected error occurred:
requests.exceptions.ConnectionError: HTTPSConnectionPool(host='acme-staging-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f4225d26550>: Failed to establish a new connection: [Errno -3] Try again'))
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
ERROR: 1

Reloading nginx ...

2023/08/31 10:37:11 [emerg] 10#10: cannot load certificate "/etc/letsencrypt/live/eib.development.agoradcm.io/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/eib.development.agoradcm.io/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/eib.development.agoradcm.io/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/eib.development.agoradcm.io/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)

My web server is (include version): nginx:1.23.1-alpine docker image

The operating system my web server runs on is (include version): AlmaLinux 8.8

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot:v1.30.0 docker image

2

Try restarting your docker daemon. From time to time, DNS resolution inside containers just breaks.

3

Interesting on the host dns is working, but in the nginx docker image dns is not working.
Restarting nginx docker didn't help, "docker-compose restart nginx"

4

I meant systemctl restart docker.service

5

ok I just ran "systemctl restart docker.service", but dns in the container still not working.

6

Did DNS ever work in that container?

7

You can force it.

8

Yes, we have created other certificates using the same nginx container in the past.

9

Then something has changed...
Can you run some DNS tests within that container?

10

yes all dns tests are failing in that container. Something has indeed changed.. and I'm investigating.. thank you, I will keep you posted.