Reusing certificate after hiting rate limit #914

gauravcanon · 2022-01-13T05:10:49Z

gauravcanon
Jan 13, 2022

Error Description

Info: running acme-companion version v2.1.2-7-g4b23f7f

Info: 4096 bits RFC7919 Diffie-Hellman group found, generation skipped.

Reloading nginx proxy (d780f463e85b09c6480bd3b9aa077d36c4a53f1488a47493ad0022ce342e798c)...

2022/01/13 04:56:29 Generated '/etc/nginx/conf.d/default.conf' from 5 containers

2022/01/13 04:56:29 [notice] 63#63: signal process started

Warning: /app/letsencrypt_service_data not found, skipping data from containers.

Reloading nginx proxy (d780f463e85b09c6480bd3b9aa077d36c4a53f1488a47493ad0022ce342e798c)...

Reloading nginx proxy (d780f463e85b09c6480bd3b9aa077d36c4a53f1488a47493ad0022ce342e798c)...

2022/01/13 04:56:30 Generated '/etc/nginx/conf.d/default.conf' from 5 containers

2022/01/13 04:56:30 [notice] 94#94: signal process started

Creating/renewal teamcity.shiftboolean.com certificates... (my.domain.name)

[Thu Jan 13 04:56:31 UTC 2022] Using CA: https://acme-v02.api.letsencrypt.org/directory

[Thu Jan 13 04:56:31 UTC 2022] Creating domain key

[Thu Jan 13 04:56:31 UTC 2022] The domain key is here: /etc/acme.sh/[email protected]/my.domain.name/my.domain.name.key

[Thu Jan 13 04:56:31 UTC 2022] Single domain=my.domain.name'

[Thu Jan 13 04:56:32 UTC 2022] Getting domain auth token for each domain

2022/01/13 04:56:29 Generated '/app/letsencrypt_service_data' from 5 containers

2022/01/13 04:56:29 Running '/app/signal_le_service'

2022/01/13 04:56:29 Watching docker events

2022/01/13 04:56:29 Contents of /app/letsencrypt_service_data did not change. Skipping notification '/app/signal_le_service'

[Thu Jan 13 04:56:34 UTC 2022] Create new order error. Le_OrderFinalize not found. {

  "type": "urn:ietf:params:acme:error:rateLimited",

  "detail": "Error creating new order :: too many certificates (5) already issued for this exact set of domains in the last 168 hours: teamcity.shiftboolean.com: see https://letsencrypt.org/docs/rate-limits/",

  "status": 429

}

[Thu Jan 13 04:56:34 UTC 2022] Please check log file for more details: /dev/null

Sleep for 3600s

acme-companion image version : v1.12

Info: running acme-companion version v2.1.2-7-g4b23f7f

Issue
As testing some deployment configuration and using volumes in docker-compose. every docker-compose up and docker-compose down was a re-issuing certificate. While searching through the issue I came across #216 . Earlier my docker-compose.yml file was

version: '3.3'
  networks:
     luna:
            driver: bridge
  services:
        nginx-proxy:
            container_name: nginx-proxy
            image: jwilder/nginx-proxy
            labels:
                com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
            ports:
                    - "80:80"
                    - "443:443"
            volumes:
                    - /var/run/docker.sock:/tmp/docker.sock:ro
                    - /usr/share/nginx/html
                    - ./luna/nginx/certs:/etc/nginx/certs:ro
                    - ./luna/nginx/vhost:/etc/nginx/vhost.d
            environment:
                    - DEFAULT_HOST=ci.shiftboolean.com
            networks:
                    - luna

        nginx-letsencrypt:
            container_name: nginx-letsencrypt
            image: jrcs/letsencrypt-nginx-proxy-companion
            environment:
                    - NGINX_PROXY_CONTAINER=nginx-proxy
            volumes:
                 - ./luna/nginx/certs:/etc/nginx/certs:rw
                 - /var/run/docker.sock:/var/run/docker.sock:ro
            volumes_from:
              - "nginx-proxy"
            networks:
                 - luna
        postgres:
             image: postgres:10
                volumes:
                    - ./postgress/srv/postgresql/data:/var/lib/postgresql/data
                environment:
                    - POSTGRES_PASSWORD=xxx
                    - POSTGRES_USER=xxx
                    - POSTGRES_DB=xxx
                expose:
                    - 5432
                ports:
                    - "5432:5432"l
                networks:
                    - luna

IT seems this was creating a certificate every time the container was restarted. and hit rate limit

I updated my docker compose to use a new image as reading through the issue. But I was already at the rate limit. I want to re-issue the certificate which was created earlier which I have

Current docker-compose.yml

  version: '3.3'
  networks:
     luna:
            driver: bridge

    
  services:
        nginx-proxy:
            container_name: nginx-proxy
            image: nginxproxy/nginx-proxy
            labels:
                com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
            ports:
                    - "80:80"
                    - "443:443"
            volumes:
                    - /var/run/docker.sock:/tmp/docker.sock:ro
                    - /usr/share/nginx/html
                    - ./nginx/certs:/etc/nginx/certs:ro
                    - ./nginx/vhost:/etc/nginx/vhost.d
            environment:
                    - DEFAULT_HOST=luna.domain.com
            networks:
                    - luna

        nginx-letsencrypt:
            container_name: nginx-proxy-acme
            image: nginxproxy/acme-companion
            environment:
                    - NGINX_PROXY_CONTAINER=nginx-proxy
            volumes:
                 - ./nginx/certs:/etc/nginx/certs:rw
                 - ./nginx/acme:/etc/acme.sh
                 - /var/run/docker.sock:/var/run/docker.sock:ro
            volumes_from:
              - "nginx-proxy"
            networks:
                 - luna
        luna-server:
                container_name: luna-server-instance
                user: root
                volumes:
                    - './luna/data:/data/luna_server/datadir'
                    - './luna/logs/:/opt/luna/logs'
                ports:
                    - '8111:8111'
                image: luna-server:latest
                environment:
                    - VIRTUAL_HOST=luna.domain.com            
                    - LETSENCRYPT_HOST=luna.domain.com
                    - [email protected]
                    - SERVER_URL=https://luna.domain.com
                depends_on:
                    - postgres
                networks:
                    - luna
        postgres:
                image: postgres:10
                volumes:
                    - ./postgress/srv/postgresql/data:/var/lib/postgresql/data
                environment:
                    - POSTGRES_PASSWORD=xxx
                    - POSTGRES_USER=xxx
                    - POSTGRES_DB=luna
                expose:
                    - 5432
                ports:
                    - "5432:5432"
                networks:
                    - luna

I am not sure how to make use to an old certificate created by older docker-compose

gauravcanon · 2022-01-13T05:37:17Z

gauravcanon
Jan 13, 2022
Author

#885 I have gone through this solution after posting
old certs structure and new structure

0 replies

buchdag · 2022-01-13T12:03:25Z

buchdag
Jan 13, 2022
Maintainer

Hi. I moved this away from issues because the fact that version >= 2.0 of this container needs a volume to make /etc/acme.sh persistent is clearly stated at the beginning of the README.

For your specific problem you can either switch to Zero SSL instead of Let's Encrypt, or do the following:

remove the LETSENCRYPT_HOST environment variables from the containers for which you already have certificates so that acme-companion will stop handling them.
copy the various private key and certificate files under /etc/nginx/certs, following nginx-proxy instructions for naming them.
when Let's Encrypt rate limit has elapsed, remove the certificates you manually named in /etc/nginx/certs then put back the LETSENCRYPT_HOST environment variables on the containers.

As a general advice, never use latest version of any Docker image if you don't want to experience uncontrolled updates to non backward compatible versions or versions with breaking changes. If an image does not provide any tag beside latest, tag the image yourself with say the date of the day or the corresponding commit hash and use the image you tagged.

5 replies

iamunadike Jun 10, 2022

Are you saying it like its not SAFE to use nginx-proxy/acme-companion, because your product is affecting my domain already. It issues certificates up and down, I am using
nginx-proxy:
container_name: nginx-proxy
build: ./nginx
restart: always
ports:
- 443:443
- 80:80
volumes:
- static_volume:/home/staticfiles
- certs:/etc/nginx/certs
- html:/usr/share/nginx/html
- vhost:/etc/nginx/vhost.d
- /var/run/docker.sock:/tmp/docker.sock:ro
depends_on:
- web

nginx-proxy-letsencrypt:
image: jrcs/letsencrypt-nginx-proxy-companion
environment:
- DEFAULT_EMAIL=[email protected]
- NGINX_PROXY_CONTAINER=nginx-proxy
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- certs:/etc/nginx/certs
- html:/usr/share/nginx/html
- vhost:/etc/nginx/vhost.d
- acme:/etc/acme.sh
depends_on:
- nginx-proxy

volumes:
static_volume:
certs:
html:
vhost:
acme:

I hit Rate Limit already, Dont know how lng I should wait, getting seriously angryy......... by the Way and REALLY want some good answers

nginx-proxy-letsencrypt-1  |   "detail": "Error creating new order :: too many certificates (5) already issued for this exact set of domains in the last 168 hours: mydomain.com,example.mydomain.com: see https://letsencrypt.org/docs/rate-limits/",

TonyRogers Jun 10, 2022

It looks like you auto updated a version without following the upgrade instructions.

iamunadike Jun 10, 2022

?
I dont really get that what do you mean by it

iamunadike Jun 10, 2022

auto updated a version without following the upgrade instructions.
How can I auto upgrade using docker bro?

iamunadike Jun 10, 2022

Docker compose up and down => It issues certificates up and down, auto renewals instead of being able to persist the existing certificate and it should have some tracking of certificates to forewarn how many hhas been issued and how many is left since , since it is very likely a running container may restart automatically or be restarted manually

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Reusing certificate after hiting rate limit #914

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 5 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Reusing certificate after hiting rate limit #914

gauravcanon Jan 13, 2022

Error Description

acme-companion image version : v1.12

Replies: 2 comments · 5 replies

gauravcanon Jan 13, 2022 Author

buchdag Jan 13, 2022 Maintainer

iamunadike Jun 10, 2022

TonyRogers Jun 10, 2022

iamunadike Jun 10, 2022

iamunadike Jun 10, 2022

iamunadike Jun 10, 2022

gauravcanon
Jan 13, 2022

Replies: 2 comments 5 replies

gauravcanon
Jan 13, 2022
Author

buchdag
Jan 13, 2022
Maintainer