Add ClouDNS LetsEncrypt certificate

[phillipmcmahon]

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes
• Are you sure you're not using someone else's docker image?
  • Yes
• Have you searched for similar issues (both open and closed)?
  • Yes

Describe the bug
Error on cert generation. Error text below.

Nginx Proxy Manager Version

Error: Command failed: . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-cloudns~=0.4.0 && deactivate
ERROR: Will not install to the user site because it will lack sys.path precedence to certbot in /opt/certbot/lib/python3.7/site-packages

[notice] A new release of pip is available: 23.0.1 -> 23.1
[notice] To update, run: pip install --upgrade pip

at ChildProcess.exithandler (node:child_process:402:12)
at ChildProcess.emit (node:events:513:28)
at maybeClose (node:internal/child_process:1100:16)
at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)

Screenshots

[vpont]

I got the same error after upgrading:

[notice] A new release of pip is available: 23.0.1 -> 23.1
[notice] To update, run: pip install --upgrade pip

[4/21/2023] [10:24:33 AM] [Migrate  ] › ℹ  info      Current database version: none
[4/21/2023] [10:24:36 AM] [Global   ] › ✖  error     Command failed: . /opt/certbot/bin/activate && pip install --no-cache-dir --user certbot-dns-cloudns~=0.4.0  && deactivate
ERROR: Will not install to the user site because it will lack sys.path precedence to certbot in /opt/certbot/lib/python3.7/site-packages

[vpont]

Related to: #2776

[phillipmcmahon]

Upgraded to 2.10.3 and still getting the same error when attempting to generate a cert using Cloudns plugin.

Help! :)

@jc21

[mashb1t]

i encountered the same issue and would appreciate a fix

[jeffshead]

I also encountered the same issue and got the same error with:latest (2.10.3).

So I pulled the 2971 pr image (#2971) but it did not solve the issue. Now, I get the error below which is different:

Error: Command failed: certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-21" --agree-tos --email "user@example.com" --domains "*.example.com,example.com" --authenticator dns-cloudns --dns-cloudns-credentials "/etc/letsencrypt/credentials/credentials-21"
Traceback (most recent call last):
  File "/usr/bin/certbot", line 5, in 
    from certbot.main import main
  File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 6, in 
    from certbot._internal import main as internal_main
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 28, in 
    from certbot import crypto_util
  File "/opt/certbot/lib/python3.7/site-packages/certbot/crypto_util.py", line 42, in 
    from certbot import interfaces
  File "/opt/certbot/lib/python3.7/site-packages/certbot/interfaces.py", line 21, in 
    from acme.client import ClientBase
ImportError: cannot import name 'ClientBase' from 'acme.client' (/opt/certbot/lib/python3.7/site-packages/acme/client.py)

    at ChildProcess.exithandler (node:child_process:402:12)
    at ChildProcess.emit (node:events:513:28)
    at maybeClose (node:internal/child_process:1100:16)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)

[wolviex]

@jeffshead

File "/opt/certbot/lib/python3.7/site-packages/certbot/interfaces.py", line 21, in
from acme.client import ClientBase

I would have expected this to be

from acme.client import ClientV2

It sounds like you somehow have conflicting versions of python modules acme/certbot/certbot-nginx.
Are you able to confirm the version of the certbot module? I'm seeing 2.5.0
You could try pruning all related images and builds and pulling/building fresh.

@phillipmcmahon @vpont @mashb1t - is this the same as #2921 ?

[jeffshead]

You could try pruning all related images and builds and pulling/building fresh.

I did pull new images and I ran docker image prune -a and docker system prune -a. I have no idea how there could be conflicting versions. I've not modified either image. Could there be something static in one of the NPM Docker volumes (letsencrypt or data) that needs to be deleted/edited?

Are you able to confirm the version of the certbot module?

certbot --version returns 2.5.0

I don't have all that much experience with Docker. What other steps do I need to perform when switching from :latest to the :github-pr-2971 image? I used Portainer to recreate the container, re-pull the image and rebooted the server.

Also, I have a CanaryTokens container on the same server. Could this be interfering in someway since it also has nginx and certbot-nginx? But it was working with DNSMadeEasy challenge before I updated NPM to 2.10.3.

[phillipmcmahon]

@jeffshead

File "/opt/certbot/lib/python3.7/site-packages/certbot/interfaces.py", line 21, in
from acme.client import ClientBase

I would have expected this to be

from acme.client import ClientV2

It sounds like you somehow have conflicting versions of python modules acme/certbot/certbot-nginx. Are you able to confirm the version of the certbot module? I'm seeing 2.5.0 You could try pruning all related images and builds and pulling/building fresh.

@phillipmcmahon @vpont @mashb1t - is this the same as #2921 ?

Not too sure, I pulled the version referenced in that issue. Prior to that did a docker system prune -a, and when trying to generate a cert get a similar looking error.

Internal Error
Error: Command failed: certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-15" --agree-tos --email "phillip.mcmahon@gmail.com" --domains "cloud.phillipmcmahon.com" --authenticator dns-cloudns --dns-cloudns-credentials "/etc/letsencrypt/credentials/credentials-15" --dns-cloudns-propagation-seconds 180
Traceback (most recent call last):
  File "/usr/bin/certbot", line 5, in 
    from certbot.main import main
  File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 6, in 
    from certbot._internal import main as internal_main
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 28, in 
    from certbot import crypto_util
  File "/opt/certbot/lib/python3.7/site-packages/certbot/crypto_util.py", line 42, in 
    from certbot import interfaces
  File "/opt/certbot/lib/python3.7/site-packages/certbot/interfaces.py", line 21, in 
    from acme.client import ClientBase
ImportError: cannot import name 'ClientBase' from 'acme.client' (/opt/certbot/lib/python3.7/site-packages/acme/client.py)

    at ChildProcess.exithandler (node:child_process:402:12)
    at ChildProcess.emit (node:events:513:28)
    at maybeClose (node:internal/child_process:1100:16)
    at Process.ChildProcess._handle.onexit (node:internal/child

[wolviex]

ImportError: cannot import name 'ClientBase' from 'acme.client' (/opt/certbot/lib/python3.7/site-packages/acme/client.py)

is quite different from this issue's

ERROR: Will not install to the user site because it will lack sys.path precedence to certbot in /opt/certbot/lib/python3.7/site-packages

It might make the most sense to open a new issue for that.

What you're seeing looks like a mismatch between the certbot and acme.client modules - but I'm really not sure how you're getting there. Try attaching a console to the container and checking their versions.

/opt/certbot/bin/pip show acme certbot

[jeffshead]

@wolviex - Thank you for taking the time.

/opt/certbot/bin/pip show acme certbot:

Name: acme
Version: 2.5.0
Summary: ACME protocol implementation in Python
Home-page: https://github.com/letsencrypt/letsencrypt
Author: Certbot Project
Author-email: certbot-dev@eff.org
License: Apache License 2.0
Location: /opt/certbot/lib/python3.7/site-packages
Requires: cryptography, josepy, PyOpenSSL, pyrfc3339, pytz, requests, setuptools
Required-by: certbot, certbot-dns-dnsmadeeasy
---
Name: certbot
Version: 1.32.0
Summary: ACME client
Home-page: https://github.com/letsencrypt/letsencrypt
Author: Certbot Project
Author-email: certbot-dev@eff.org
License: Apache License 2.0
Location: /opt/certbot/lib/python3.7/site-packages
Requires: acme, ConfigArgParse, configobj, cryptography, distro, josepy, parsedatetime, pyrfc3339, pytz, setuptools, zope.component, zope.interface
Required-by: certbot-dns-cloudns, certbot-dns-dnsmadeeasy

[wolviex]

I still have no idea how you have that old version of certbot in this container.

/opt/certbot/bin/pip install certbot==2.5.0

Will sort you out, at least temporarily.

[jeffshead]

Unfortunatly, that command did not fix the issue.

/opt/certbot/bin/pip install certbot==2.5.0 output:

Requirement already satisfied: certbot==2.5.0 in /opt/certbot/lib/python3.7/site-packages (2.5.0)
Requirement already satisfied: acme>=2.5.0 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (2.5.0)
Requirement already satisfied: ConfigArgParse>=0.9.3 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (1.5.3)
Requirement already satisfied: configobj>=5.0.6 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (5.0.8)
Requirement already satisfied: cryptography>=2.5.0 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (2.8)
Requirement already satisfied: distro>=1.0.1 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (1.8.0)
Requirement already satisfied: josepy>=1.13.0 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (1.13.0)
Requirement already satisfied: parsedatetime>=2.4 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (2.6)
Requirement already satisfied: pyrfc3339 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (1.1)
Requirement already satisfied: pytz>=2019.3 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (2023.3)
Requirement already satisfied: setuptools>=41.6.0 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (67.8.0)
Requirement already satisfied: PyOpenSSL!=23.1.0,>=17.5.0 in /opt/certbot/lib/python3.7/site-packages (from acme>=2.5.0->certbot==2.5.0) (19.1.0)
Requirement already satisfied: requests>=2.20.0 in /opt/certbot/lib/python3.7/site-packages (from acme>=2.5.0->certbot==2.5.0) (2.31.0)
Requirement already satisfied: six in /opt/certbot/lib/python3.7/site-packages (from configobj>=5.0.6->certbot==2.5.0) (1.16.0)
Requirement already satisfied: cffi!=1.11.3,>=1.8 in /opt/certbot/lib/python3.7/site-packages (from cryptography>=2.5.0->certbot==2.5.0) (1.15.1)
Requirement already satisfied: pycparser in /opt/certbot/lib/python3.7/site-packages (from cffi!=1.11.3,>=1.8->cryptography>=2.5.0->certbot==2.5.0) (2.21)
Requirement already satisfied: charset-normalizer<4,>=2 in /opt/certbot/lib/python3.7/site-packages (from requests>=2.20.0->acme>=2.5.0->certbot==2.5.0) (3.1.0)
Requirement already satisfied: idna<4,>=2.5 in /opt/certbot/lib/python3.7/site-packages (from requests>=2.20.0->acme>=2.5.0->certbot==2.5.0) (3.4)
Requirement already satisfied: urllib3<3,>=1.21.1 in /opt/certbot/lib/python3.7/site-packages (from requests>=2.20.0->acme>=2.5.0->certbot==2.5.0) (2.0.2)
Requirement already satisfied: certifi>=2017.4.17 in /opt/certbot/lib/python3.7/site-packages (from requests>=2.20.0->acme>=2.5.0->certbot==2.5.0) (2023.5.7)

I also tried to update just to see what would happen:
/opt/certbot/bin/pip install --upgrade pip output:

Requirement already satisfied: pip in /opt/certbot/lib/python3.7/site-packages (23.1.2)

Initial output when accessing console:

 _   _       _            ____                      __  __                                   
| \ | | __ _(_)_ __ __  _|  _ \ _ __ _____  ___   _|  \/  | __ _ _ __   __ _  __ _  ___ _ __ 
|  \| |/ _` | | '_ \\ \/ / |_) | '__/ _ \ \/ / | | | |\/| |/ _` | '_ \ / _` |/ _` |/ _ \ '__|
| |\  | (_| | | | | |>  <|  __/| | | (_) >  <| |_| | |  | | (_| | | | | (_| | (_| |  __/ |   
|_| \_|\__, |_|_| |_/_/\_\_|   |_|  \___/_/\_\\__, |_|  |_|\__,_|_| |_|\__,_|\__, |\___|_|   
       |___/                                  |___/                          |___/           
Traceback (most recent call last):
  File "/usr/bin/certbot", line 5, in <module>
    from certbot.main import main
  File "/opt/certbot/lib/python3.7/site-packages/certbot/main.py", line 6, in <module>
    from certbot._internal import main as internal_main
  File "/opt/certbot/lib/python3.7/site-packages/certbot/_internal/main.py", line 28, in <module>
    from certbot import crypto_util
  File "/opt/certbot/lib/python3.7/site-packages/certbot/crypto_util.py", line 42, in <module>
    from certbot import interfaces
  File "/opt/certbot/lib/python3.7/site-packages/certbot/interfaces.py", line 21, in <module>
    from acme.client import ClientBase
ImportError: cannot import name 'ClientBase' from 'acme.client' (/opt/certbot/lib/python3.7/site-packages/acme/client.py)
Version 2.10.3 (f39e527) 2023-06-01 18:12:13 UTC, OpenResty 1.21.4.1, debian 10 (buster), Certbot 
Base: debian:buster-slim, linux/amd64
Certbot: jc21/nginx-full:latest, linux/amd64
Node: jc21/nginx-full:certbot, linux/amd64

[root@docker-225315d7801d:/app]# 

[jeffshead]

I tried a couple more things.

[root@docker-225315d7801d:/app]# /opt/certbot/bin/pip uninstall certbot
Found existing installation: certbot 1.32.0
Uninstalling certbot-1.32.0:
  Would remove:
    /opt/certbot/bin/certbot
    /opt/certbot/lib/python3.7/site-packages/certbot-1.32.0.dist-info/*
    /opt/certbot/lib/python3.7/site-packages/certbot/*
Proceed (Y/n)? y
  Successfully uninstalled certbot-1.32.0
[root@docker-225315d7801d:/app]# /opt/certbot/bin/pip install certbot==2.5.0
Collecting certbot==2.5.0
  Downloading certbot-2.5.0-py3-none-any.whl (398 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 398.4/398.4 kB 24.1 MB/s eta 0:00:00
Requirement already satisfied: acme>=2.5.0 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (2.5.0)
Requirement already satisfied: ConfigArgParse>=0.9.3 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (1.5.3)
Requirement already satisfied: configobj>=5.0.6 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (5.0.8)
Requirement already satisfied: cryptography>=2.5.0 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (2.8)
Requirement already satisfied: distro>=1.0.1 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (1.8.0)
Requirement already satisfied: josepy>=1.13.0 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (1.13.0)
Requirement already satisfied: parsedatetime>=2.4 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (2.6)
Requirement already satisfied: pyrfc3339 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (1.1)
Requirement already satisfied: pytz>=2019.3 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (2023.3)
Requirement already satisfied: setuptools>=41.6.0 in /opt/certbot/lib/python3.7/site-packages (from certbot==2.5.0) (67.8.0)
Requirement already satisfied: PyOpenSSL!=23.1.0,>=17.5.0 in /opt/certbot/lib/python3.7/site-packages (from acme>=2.5.0->certbot==2.5.0) (19.1.0)
Requirement already satisfied: requests>=2.20.0 in /opt/certbot/lib/python3.7/site-packages (from acme>=2.5.0->certbot==2.5.0) (2.31.0)
Requirement already satisfied: six in /opt/certbot/lib/python3.7/site-packages (from configobj>=5.0.6->certbot==2.5.0) (1.16.0)
Requirement already satisfied: cffi!=1.11.3,>=1.8 in /opt/certbot/lib/python3.7/site-packages (from cryptography>=2.5.0->certbot==2.5.0) (1.15.1)
Requirement already satisfied: pycparser in /opt/certbot/lib/python3.7/site-packages (from cffi!=1.11.3,>=1.8->cryptography>=2.5.0->certbot==2.5.0) (2.21)
Requirement already satisfied: charset-normalizer<4,>=2 in /opt/certbot/lib/python3.7/site-packages (from requests>=2.20.0->acme>=2.5.0->certbot==2.5.0) (3.1.0)
Requirement already satisfied: idna<4,>=2.5 in /opt/certbot/lib/python3.7/site-packages (from requests>=2.20.0->acme>=2.5.0->certbot==2.5.0) (3.4)
Requirement already satisfied: urllib3<3,>=1.21.1 in /opt/certbot/lib/python3.7/site-packages (from requests>=2.20.0->acme>=2.5.0->certbot==2.5.0) (2.0.2)
Requirement already satisfied: certifi>=2017.4.17 in /opt/certbot/lib/python3.7/site-packages (from requests>=2.20.0->acme>=2.5.0->certbot==2.5.0) (2023.5.7)
Installing collected packages: certbot
ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
certbot-dns-cloudns 0.4.0 requires certbot<2.0.0,>=1.12.0, but you have certbot 2.5.0 which is incompatible.
Successfully installed certbot-2.5.0
[root@docker-225315d7801d:/app]#

Next, I used the info from here (inventage/certbot-dns-cloudns#2):

apt install nano
nano /opt/certbot/lib/python3.7/site-packages/certbot_dns_cloudns-0.4.0.dist-info/METADATA

Changed Requires-Dist: certbot (>=1.12.0 ,<2.0.0 ) to Requires-Dist: certbot (>=1.12.0) and changed the zope reference to Requires-Dist: zope.interface (>=5.1.0)

Still fails. I got the following error:

Error: Command failed: certbot certonly --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-25" --agree-tos --email "example@example.com" --domains "*.example.com,example.com" --authenticator dns-cloudns --dns-cloudns-credentials "/etc/letsencrypt/credentials/credentials-25"
Saving debug log to /tmp/letsencrypt-log/letsencrypt.log
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details.

    at ChildProcess.exithandler (node:child_process:402:12)
    at ChildProcess.emit (node:events:513:28)
    at maybeClose (node:internal/child_process:1100:16)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)

I'm sure the user id and password are correct.

UPDATE:
It seems you cannot use special characters in the ClouDNS password, in the NPM DNS challange input box. Is this true? Can you use quotes?

For example:

dns_cloudns_auth_password="%passw#ord1"

I'm afraid I will reach my limit on cert requests so I haven't tried. I removed the special characters from the password and the cert was created without any errors being displayed.

UPDATE 2:
You can wrap your password in quotes and use special characters in your password.