let's encrypt certbot requests should not use --preferred-challenges dns,http if "use a DNS challenge" is not requested

I am having trouble with setting up the let's encrypt certificates and finding debugging this quite tricky.
I also see others report similar problems.

I notice that when trying to setup a let's encrypt TLS certificate for a domain that I have only configured request certificate yet I notice the code is using --preferred-challenges dns,http when specifically I have not enabled "use a DNS challenge".

My intended configuration is:

• homelab
• home router redirects incoming port 80/443 to js21/nginx-proxy-manager:latest container
• DNS is via an external provider HE which I manage myself.

Redirection of the domain to http://mydomain.example.com works

• However, these days Chrome and many other browsers insist on trying to use https making it harder to use this setup and friends may be using a computer or a phone and setups vary significantly.

When enabling TLS support via let's encrypt I don't yet force any behaviour, just using the default.

I get many internal errrors from the npm UI interface which are unhelpful. The actual error message is not exposed to the user, leading me to have to dig into the logs.

I have seen that due to misconfiguration and multiple attempts to try to get this working that I have been blocked by let's encrypt due to too many failed attempts. This error which could occur is not logged and just means that subsequent attempts will fail.

Nginx Proxy Manager Version

2.10.4

Expected behavior

• Better logging and sharing of the error with the user.
• clarification that under normal circumstances it's best not to do anything except just request the certificate to get things working, then later enabling HSTS is a good idea.
• I see no options to customise the configuration of the certbot

I saw it being called this way:

certbot --force-renewal --config /etc/letsencrypt.ini --work-dir /tmp/letsencrypt-lib --logs-dir /tmp/letsencrypt-log -cert-name npm-4 --preferred-challenges dns,http --no-random-sleep-on-renew --disable-hook-validation

but suspect that dns should only be enabled if the DNS-01 validation is being requested.

• given the naming it would be helpful to have a better way to recognise what may be a long list of proxy hostnames to figure out more quickly which host npm-4 actually is. Perhaps have an option to generate the name based on the proxy host/port combination or similar?

Operating System

linux with docker

Additional context

Start by tracing where the Nginx Proxy Manager UI constructs and logs the displayed certbot command, especially the --preferred-challenges arguments. Reproduce a normal certificate request and a failed or rate-limited request; done means challenge selection matches the requested options and the actionable certbot error is visible to the user and in logs.