Issues with renewing SSL certificates

[rex3511]

Hello!!

I've been using nextcloud aio for a few months now and I believe my SSL certificate expired.

It appears the apache container is attempting to renew the certificate but the connection is being refused.

Any suggestions on how to fix this?

PS The performance on these containers is amazing, great work!!

nc: getaddrinfo for host "nextcloud-aio-nextcloud" port 9000: Name or service not known
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
Waiting for Nextcloud to start...
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.8. Set the 'ServerName' directive globally to suppress this message
{"level":"info","ts":1662107692.1914177,"msg":"using provided configuration","config_file":"/Caddyfile","config_adapter":""}
{"level":"warn","ts":1662107692.193937,"msg":"Caddyfile input is not formatted; run the 'caddy fmt' command to fix inconsistencies","adapter":"caddyfile","file":"/Caddyfile","line":2}
{"level":"info","ts":1662107692.195376,"logger":"admin","msg":"admin endpoint started","address":"tcp/localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"info","ts":1662107692.1958208,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc0002f0000"}
{"level":"info","ts":1662107692.1962643,"logger":"http","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port":443}
{"level":"warn","ts":1662107692.1962986,"logger":"http","msg":"automatic HTTP->HTTPS redirects are disabled","server_name":"srv0"}
{"level":"info","ts":1662107692.1973817,"logger":"tls","msg":"cleaning storage unit","description":"FileStorage:/mnt/data/caddy"}
{"level":"info","ts":1662107692.197889,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["sub.domain.tld"]}
{"level":"info","ts":1662107692.1985264,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"warn","ts":1662107692.2942233,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [sub.domain.tld]: parsing OCSP response: ocsp: error from server: unauthorized","identifiers":["sub.domain.tld"]}
{"level":"info","ts":1662107692.2948837,"msg":"autosaved config (load with --resume flag)","file":"/var/www/.config/caddy/autosave.json"}
{"level":"info","ts":1662107692.2949023,"msg":"serving initial configuration"}
{"level":"info","ts":1662107692.2949212,"logger":"tls.renew","msg":"acquiring lock","identifier":"sub.domain.tld"}
{"level":"info","ts":1662107692.2963445,"logger":"tls.renew","msg":"lock acquired","identifier":"sub.domain.tld"}
{"level":"info","ts":1662107692.297243,"logger":"tls.renew","msg":"renewing certificate","identifier":"sub.domain.tld","remaining":-525085.297233916}
{"level":"info","ts":1662107692.3004124,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["sub.domain.tld"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":""}
{"level":"info","ts":1662107692.3008091,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["sub.domain.tld"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":""}
{"level":"info","ts":1662107692.5701797,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"sub.domain.tld","challenge_type":"tls-alpn-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1662107692.9033887,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"sub.domain.tld","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1662107692.9038162,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"sub.domain.tld","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/564347006/121784701187","attempt":1,"max_attempts":3}
{"level":"error","ts":1662107692.9038694,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"sub.domain.tld","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"error","ts":1662107692.9038885,"logger":"tls.renew","msg":"will retry","error":"[sub.domain.tld] Renew: [sub.domain.tld] solving challenge: sub.domain.tld: [sub.domain.tld] authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge (ca=https://acme-v02.api.letsencrypt.org/directory)","attempt":1,"retrying_in":60,"elapsed":0.607522791,"max_duration":2592000}
{"level":"info","ts":1662107752.9050586,"logger":"tls.renew","msg":"renewing certificate","identifier":"sub.domain.tld","remaining":-525145.905051697}
{"level":"info","ts":1662107753.1686246,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"sub.domain.tld","challenge_type":"tls-alpn-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1662107753.7881958,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"sub.domain.tld","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1662107753.7882586,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"sub.domain.tld","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/62417054/3893794923","attempt":1,"max_attempts":3}
{"level":"error","ts":1662107753.788294,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"sub.domain.tld","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"error","ts":1662107753.788305,"logger":"tls.renew","msg":"will retry","error":"[sub.domain.tld] Renew: [sub.domain.tld] solving challenge: sub.domain.tld: [sub.domain.tld] authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":2,"retrying_in":120,"elapsed":61.491940677,"max_duration":2592000}
{"level":"info","ts":1662107873.78931,"logger":"tls.renew","msg":"renewing certificate","identifier":"sub.domain.tld","remaining":-525266.789291818}
{"level":"info","ts":1662107873.9306173,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"sub.domain.tld","challenge_type":"tls-alpn-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1662107874.5474567,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"sub.domain.tld","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1662107874.547546,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"sub.domain.tld","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/62417054/3893814513","attempt":1,"max_attempts":3}
{"level":"error","ts":1662107874.5476036,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"sub.domain.tld","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"error","ts":1662107874.5476313,"logger":"tls.renew","msg":"will retry","error":"[sub.domain.tld] Renew: [sub.domain.tld] solving challenge: sub.domain.tld: [sub.domain.tld] authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":3,"retrying_in":120,"elapsed":182.251266228,"max_duration":2592000}
{"level":"info","ts":1662107994.5487506,"logger":"tls.renew","msg":"renewing certificate","identifier":"sub.domain.tld","remaining":-525387.548741681}
{"level":"info","ts":1662107994.693364,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"sub.domain.tld","challenge_type":"tls-alpn-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1662107995.3132777,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"sub.domain.tld","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1662107995.3133426,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"sub.domain.tld","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/62417054/3893834853","attempt":1,"max_attempts":3}
{"level":"error","ts":1662107995.3133938,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"sub.domain.tld","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"error","ts":1662107995.313417,"logger":"tls.renew","msg":"will retry","error":"[sub.domain.tld] Renew: [sub.domain.tld] solving challenge: sub.domain.tld: [sub.domain.tld] authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":4,"retrying_in":300,"elapsed":303.01705089,"max_duration":2592000}
{"level":"info","ts":1662108292.1995585,"logger":"tls.cache.maintenance","msg":"certificate expires soon; queuing for renewal","identifiers":["sub.domain.tld"],"remaining":-525685.199550752}
{"level":"info","ts":1662108295.3146915,"logger":"tls.renew","msg":"renewing certificate","identifier":"sub.domain.tld","remaining":-525688.314682291}
{"level":"info","ts":1662108295.5513995,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"sub.domain.tld","challenge_type":"tls-alpn-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1662108296.167409,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"sub.domain.tld","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1662108296.167492,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"sub.domain.tld","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/62417054/3893885073","attempt":1,"max_attempts":3}
{"level":"error","ts":1662108296.167554,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"sub.domain.tld","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"error","ts":1662108296.1675775,"logger":"tls.renew","msg":"will retry","error":"[sub.domain.tld] Renew: [sub.domain.tld] solving challenge: sub.domain.tld: [sub.domain.tld] authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":5,"retrying_in":600,"elapsed":603.871212947,"max_duration":2592000}

[szaimen]

Hi, I cannot reproduce your problem unfortunately. Are you maybe using Cloudflare anywhere?

[rex3511]

Hi, I cannot reproduce your problem unfortunately. Are you maybe using Cloudflare anywhere?

Oh I forgot to mention that, yes I am.

[rex3511]

I was able to fix the issue, by temporarily disabling the proxy feature on cloud flare. Once I disabled it, I then rebooted the apache container and it was able to generate a certificate.

Thanks for pointing me in the right direction @szaimen !!

[szaimen]

Great that you were abke to solve it!

[joezimjs]

This worked in the past but is no longer working for me.

[DavidAnderson684]

I use Cloudflare, and have the same problem.

Temporarily turning off Cloudflare proxying and restarting the Apache container also worked for me. But it'd be better to have a long-term solution than have to do this every 90 days (the duration of a LetsEncrypt certificate).

Here's what's logged for the Apache container. ...

{"level":"error","ts":1684159912.9467077,"logger":"http.acme_client","msg":"challenge failed","identifier":"nextoffice.example.com","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1684159912.9471095,"logger":"http.acme_client","msg":"validating authorization","identifier":"nextoffice.example.com","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/955551816/182339094697","attempt":1,"max_attempts":3}
{"level":"error","ts":1684159912.947343,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"nextoffice.example.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"error","ts":1684159912.9475207,"logger":"tls.renew","msg":"will retry","error":"[nextoffice.example.com] Renew: [nextoffice.example.com] solving challenge: nextoffice.example.com: [nextoffice.example.com] authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge (ca=https://acme-v02.api.letsencrypt.org/directory)","attempt":1,"retrying_in":60,"elapsed":1.34925776,"max_duration":2592000}
{"level":"error","ts":1684159974.4079943,"logger":"http.acme_client","msg":"challenge failed","identifier":"nextoffice.example.com","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1684159974.4080987,"logger":"http.acme_client","msg":"validating authorization","identifier":"nextoffice.example.com","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/97430314/8758764744","attempt":1,"max_attempts":3}
{"level":"error","ts":1684159974.4081345,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"nextoffice.example.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"error","ts":1684159974.4082928,"logger":"tls.renew","msg":"will retry","error":"[nextoffice.example.com] Renew: [nextoffice.example.com] solving challenge: nextoffice.example.com: [nextoffice.example.com] authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":2,"retrying_in":120,"elapsed":62.810028559,"max_duration":2592000}
{"level":"error","ts":1684160095.4053903,"logger":"http.acme_client","msg":"challenge failed","identifier":"nextoffice.example.com","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1684160095.4054606,"logger":"http.acme_client","msg":"validating authorization","identifier":"nextoffice.example.com","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/97430314/8758797414","attempt":1,"max_attempts":3}
{"level":"error","ts":1684160095.4055014,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"nextoffice.example.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"error","ts":1684160095.405547,"logger":"tls.renew","msg":"will retry","error":"[nextoffice.example.com] Renew: [nextoffice.example.com] solving challenge: nextoffice.example.com: [nextoffice.example.com] authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":3,"retrying_in":120,"elapsed":183.807283799,"max_duration":2592000}
{"level":"error","ts":1684160216.3998506,"logger":"http.acme_client","msg":"challenge failed","identifier":"nextoffice.example.com","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1684160216.3999634,"logger":"http.acme_client","msg":"validating authorization","identifier":"nextoffice.example.com","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/97430314/8758829674","attempt":1,"max_attempts":3}
{"level":"error","ts":1684160216.4000165,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"nextoffice.example.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"error","ts":1684160216.400068,"logger":"tls.renew","msg":"will retry","error":"[nextoffice.example.com] Renew: [nextoffice.example.com] solving challenge: nextoffice.example.com: [nextoffice.example.com] authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":4,"retrying_in":300,"elapsed":304.801804908,"max_duration":2592000}
{"level":"error","ts":1684160517.6784616,"logger":"http.acme_client","msg":"challenge failed","identifier":"nextoffice.example.com","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1684160517.6794257,"logger":"http.acme_client","msg":"validating authorization","identifier":"nextoffice.example.com","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/97430314/8758887904","attempt":1,"max_attempts":3}
{"level":"error","ts":1684160517.679504,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"nextoffice.example.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"error","ts":1684160517.6795561,"logger":"tls.renew","msg":"will retry","error":"[nextoffice.example.com] Renew: [nextoffice.example.com] solving challenge: nextoffice.example.com: [nextoffice.example.com] authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":5,"retrying_in":600,"elapsed":606.081292555,"max_duration":2592000}

[szaimen]

Cloudflare Proxy apparently blocks the automatic cert renewal from working correctly. There is nothing we can do from the AIO side to fix this.

[DavidAnderson684]

@szaimen But why is there nothing that can be done to fix it? I have many different HTTP applications that are behind Cloudflare proxies and which use LetsEncrypt and successfully auto-renew ..... it's only NextCloud that doesn't. So there's nothing specific to the Cloudflare/LetsEncrypt combination that means it can't work if done correctly.

[szaimen]

It could be because we use the tls-alpn-01 challenge here which might be blocked by cloudflare. Anyway, this would need to be fixed on Cloudflare or Caddy side which we use for that.

[DavidAnderson684]

Having read https://letsencrypt.org/docs/challenge-types/ explains why tls-alpn-01 I believe it won't work - " it uses a custom ALPN protocol " - i.e. it's not a case of being blocked, but the proxy has to specifically implement it. The dns-01 challenge type would work together with the Cloudflare DNS API (perhaps you could provide a configuration option for calling a script, and then end-users such as myself can code for our own systems, in this case the Cloudflare DNS API, and share with other users), or http-01 would work, but I guess that on your current model the request doesn't make it down into the Apache container?

[AT-StephenDetomasi]

Just wanted to chime in to say that I am up against the same issue - trying to use Nextcloud using a Cloudflare Tunnel. Tried all sorts of fixes, disabling Proxying doesn't seem to help. Tempted to ditch the entire idea and just spin up another VPS so I can get a new public IP address.

[kwuzy]

2024 solution

1. Turn off proxy on cloudflare
2. Try to stop/restart your nextcloud containers
3. If you get caught in a feedback loop then make a backup, completely tear down nextcloud and all the docker containers, start AIO all over again, be sure you have the backup path and pw
4. Restore from backup (or restart nextcloud all together) and then start all the containers
5. Check you can see your site
6. Turn proxy back on if you want on cloudflare

[CPorat]

How do you turn off the proxy? Is that in cloudflare or in one of the AIO containers itself? I'd prefer to lock down and just access directly through tailscale, also to remove file upload speed limits.

[szaimen]

For tailscale see #5439

[CPorat]

what if I don't want to deal with all of that/am using unraid so docker compose not really an option as easily? I'd really like to just turn off the need to use the proxy and just allow me to directly access nextcloud through the IP address. I don't need the fancy proxying and docker compose.