NginxProxyManager / NginxProxyManager/nginx-proxy-manager

Certbot fails when host has only IPv6 and no IPv4 address

Open
#4,415 2 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
34.2k
Forks
3.9k
Avg merge
21h 12m
Merged PRs (30d)
20

Description

Checklist

  • Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
    • Yes
  • Are you sure you're not using someone else's docker image?
    • Yes
  • Have you searched for similar issues (both open and closed)?
    • Yes

Describe the bug
Certbot will fail when requesting a new ssl certificate, if you only have an IPv6-address. If you run certbot on the host, you will get a ssl cert just fine.

Nginx Proxy Manager Version
v2.12.3

To Reproduce
Steps to reproduce the behavior:

  1. Have a server without an IPv4 address (e.g. one from v6node.com).

  2. Install NPM.

  3. Make sure your AAAA record is correctly set and propagated for your domain. (A records? Where we are going, we don't need A records...)

  4. In NPM: request new ssl cert for your domain and accept TOS.

  5. Admire error page:
    `debug log to /tmp/letsencrypt-log/letsencrypt.log
    An unexpected error occurred:
    ValueError: Requesting acme-v02.api.letsencrypt.org/directory: Network is unreachable
    Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details.

    at /app/lib/utils.js:16:13
    at ChildProcess.exithandler (node:child_process:430:5)
    at ChildProcess.emit (node:events:518:28)
    at maybeClose (node:internal/child_process:1104:16)
    at ChildProcess._handle.onexit (node:internal/child_process:304:5)`

If you add an IPv4-address however, it just runs fine... Also runs fine on host without IPv4, just not via docker.

Expected behavior
Add new ssl cert to the list.

Operating System
Debian, x86

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Certbot error log at /tmp/letsencrypt-log/letsencrypt.log and the failure path at /app/lib/utils.js. Reproduce the request on a Docker host with only IPv6, then compare it with the working host-side Certbot behavior. Done means a new SSL certificate can be requested successfully without an IPv4 address.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, node.js
Domain
devops, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.