NginxProxyManager / NginxProxyManager/nginx-proxy-manager

Cannot pull a cert with a cloudflare domain.

Open
#3,599 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
34.2k
Forks
3.9k
Avg merge
21h 12m
Merged PRs (30d)
20

Description

Checklist

  • Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
    • Yes
  • Are you sure you're not using someone else's docker image?
    • Yes
  • Have you searched for similar issues (both open and closed)?
    • Yes

Describe the bug
I tried pulling a cloudflare cert, token is 100% correct, log is showing this error

[3/3/2024] [4:43:27 PM] [Express ] › ⚠ warning Saving debug log to /tmp/letsencrypt-log/letsencrypt.log Error determining zone_id: 6003 Invalid request headers. Please confirm that you have supplied valid Cloudflare API credentials. (Did you copy your entire API token/key? To use Cloudflare tokens, you'll need the python package cloudflare>=2.3.1. This certbot is running cloudflare 2.19.2) Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details.

I bashed into the container and ran certbot -v

Saving debug log to /var/log/letsencrypt/letsencrypt.log Certbot doesn't know how to automatically configure the web server on this system. However, it can still get a certificate for you. Please run "certbot certonly" to do so. You'll need to manually configure your web server to use the resulting certificate.
Then as instructed checked the log, and got this:

2024-03-03 16:51:22,160:DEBUG:certbot._internal.main:Location of certbot entry point: /opt/certbot/bin/certbot 2024-03-03 16:51:22,160:DEBUG:certbot._internal.main:Arguments: ['-v'] 2024-03-03 16:51:22,160:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#dns-cloudflare,PluginEntryPoint#manual,PluginEntryP> 2024-03-03 16:51:22,167:DEBUG:certbot._internal.log:Root logging level set at 20 2024-03-03 16:51:22,168:DEBUG:certbot._internal.plugins.selection:Requested authenticator None and installer None 2024-03-03 16:51:22,168:DEBUG:certbot._internal.plugins.selection:No candidate plugin

Nginx Proxy Manager Version
2.10.0

To Reproduce
Try to pull a cert with a cloudflare domain/token

Expected behavior
A cert should be pulled

Operating System
Docker

Additional context
I know its not my network settings, as I pulled a cert no problem with linuxserver/swag as a test.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the Cloudflare certificate request in the Docker image, then inspect /tmp/letsencrypt-log/letsencrypt.log and /var/log/letsencrypt/letsencrypt.log, including verbose Certbot output. Compare the installed cloudflare package version and credential handling with the reported error; done means a certificate is successfully issued with a valid Cloudflare token.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, nginx
Domain
infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.