SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-11 02:31:41 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Certbot issue #1329

New Issue
Closed
opened 2025-11-20 05:28:34 -05:00 by saavagebueno · 4 comments
saavagebueno commented 2025-11-20 05:28:34 -05:00
Owner
Copy Link

Originally created by @fr33n0rm on GitHub (Oct 11, 2024).

Describe the problem

Certbot certificate creation issue.
I am using Google Workspace as IdP and followed the step provided. I have run the ./configure script however im still having issue with the let's encrypt cert even though all ports are open to the internet(80,443).

To Reproduce

Steps to reproduce the behavior:

  1. Go to 'setup.env' and added config
    `
    NETBIRD_DASHBOARD_TAG=""
    NETBIRD_SIGNAL_TAG=""
    NETBIRD_MANAGEMENT_TAG=""
    COTURN_TAG=""
    NETBIRD_RELAY_TAG=""

NETBIRD_DOMAIN="nb2.example.com"

NETBIRD_TURN_DOMAIN=""

NETBIRD_TURN_EXTERNAL_IP="35.221.174.49"

NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://accounts.google.com/.well-known/openid-configuration"
NETBIRD_AUTH_AUDIENCE="44444444-uklmene.apps.googleusercontent.com"
NETBIRD_AUTH_CLIENT_ID="44444444-uklmene.apps.googleusercontent.com"
NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email"
NETBIRD_AUTH_CLIENT_SECRET="GOCSPAUTH_CLIENT_SECRET"
NETBIRD_USE_AUTH0="false"
NETBIRD_AUTH_REDIRECT_URI="/auth"
NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth"
NETBIRD_TOKEN_SOURCE="idToken"
NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none"
NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID=""
NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE
NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid"
NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false
NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000"
NETBIRD_MGMT_IDP="google"
NETBIRD_IDP_MGMT_CLIENT_ID=$NETBIRD_AUTH_CLIENT_ID
NETBIRD_IDP_MGMT_CLIENT_SECRET=""
NETBIRD_IDP_MGMT_EXTRA_SERVICE_ACCOUNT_KEY="b64key"
NETBIRD_IDP_MGMT_EXTRA_CUSTOMER_ID="909098d9s"
NETBIRD_DISABLE_LETSENCRYPT=false
NETBIRD_LETSENCRYPT_EMAIL="it@example.com"
NETBIRD_DISABLE_ANONYMOUS_METRICS=false
NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted

NETBIRD_RELAY_DOMAIN=""

NETBIRD_RELAY_PORT=""
``
3. Run ./configure
4. Compose file
`
version: "3"
services:
#UI dashboard
dashboard:
image: netbirdio/dashboard:latest
restart: unless-stopped
ports:
- 80:80
- 443:443
environment:
# Endpoints
- NETBIRD_MGMT_API_ENDPOINT=https://nb2.example.com:33073
- NETBIRD_MGMT_GRPC_API_ENDPOINT=https://nb2.example.com:33073
# OIDC
- AUTH_AUDIENCE=44444444-uklmene.apps.googleusercontent.com
- AUTH_CLIENT_ID=44444444-uklmene.apps.googleusercontent.com
- AUTH_CLIENT_SECRET=GOCSPAUTH_CLIENT_SECRET
- AUTH_AUTHORITY=https://accounts.google.com
- USE_AUTH0=false
- AUTH_SUPPORTED_SCOPES=openid profile email
- AUTH_REDIRECT_URI=/auth
- AUTH_SILENT_REDIRECT_URI=/silent-auth
- NETBIRD_TOKEN_SOURCE=idToken
# SSL
- NGINX_SSL_PORT=443
# Letsencrypt
- LETSENCRYPT_DOMAIN=nb2.example.com
- LETSENCRYPT_EMAIL=it@example.com
volumes:
- netbird-letsencrypt:/etc/letsencrypt/
logging:
driver: "json-file"
options:
max-size: "500m"
max-file: "2"

Signal

signal:
image: netbirdio/signal:latest
restart: unless-stopped
volumes:
- netbird-signal:/var/lib/netbird
ports:
- 10000:80

# port and command for Let's Encrypt validation

- 443:443

command: ["--letsencrypt-domain", "nb2.example.com", "--log-file", "console"]

logging:
  driver: "json-file"
  options:
    max-size: "500m"
    max-file: "2"

Relay

relay:
image: netbirdio/relay:latest
restart: unless-stopped
environment:
- NB_LOG_LEVEL=info
- NB_LISTEN_ADDRESS=:33080
- NB_EXPOSED_ADDRESS=nb2.example.com:33080
# todo: change to a secure secret
- NB_AUTH_SECRET=jt7373737773/ojO83838383883838388383
ports:
- 33080:33080
logging:
driver: "json-file"
options:
max-size: "500m"
max-file: "2"

Management

management:
image: netbirdio/management:latest
restart: unless-stopped
depends_on:
- dashboard
volumes:
- netbird-mgmt:/var/lib/netbird
- netbird-letsencrypt:/etc/letsencrypt:ro
- ./management.json:/etc/netbird/management.json
ports:
- 33073:443 #API port

# command for Let's Encrypt validation without dashboard container

command: ["--letsencrypt-domain", "nb2.example.com", "--log-file", "console"]

command: [
  "--port", "443",
  "--log-file", "console",
  "--log-level", "info",
  "--disable-anonymous-metrics=false",
  "--single-account-mode-domain=nb2.example.com",
  "--dns-domain=netbird.selfhosted"
  ]
logging:
  driver: "json-file"
  options:
    max-size: "500m"
    max-file: "2"
environment:
  - NETBIRD_STORE_ENGINE_POSTGRES_DSN=

Coturn

coturn:
image: coturn/coturn:latest
restart: unless-stopped
#domainname: nb2.example.com # only needed when TLS is enabled
volumes:
- ./turnserver.conf:/etc/turnserver.conf:ro
# - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
# - ./cert.pem:/etc/coturn/certs/cert.pem:ro
network_mode: host
command:
- -c /etc/turnserver.conf
logging:
driver: "json-file"
options:
max-size: "500m"
max-file: "2"
volumes:
netbird-mgmt:
netbird-signal:
netbird-letsencrypt:
6. See error
dashboard-1 |
dashboard-1 | Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
dashboard-1 | Domain: nb2.example.com
dashboard-1 | Type: connection
dashboard-1 | Detail: During secondary validation: 35.221.174.49: Fetching http://nb2.example.com/.well-known/acme-challenge/IpkLf3E7NL8-vVivqWl9U9rS7xFhAy1ivXrUApnFA-s: Timeout during connect (likely firewall problem)
dashboard-1 |
dashboard-1 | Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
dashboard-1 |
dashboard-1 | Some challenges have failed.
dashboard-1 | Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
`

Expected behavior

Create a letsencrypt certificate and will automatically renew using http-01 challenge

Are you using NetBird Cloud?

Please specify whether you use NetBird Cloud or self-host NetBird's control plane.

NetBird version

0.30

Originally created by @fr33n0rm on GitHub (Oct 11, 2024). **Describe the problem** Certbot certificate creation issue. I am using Google Workspace as IdP and followed the step provided. I have run the ./configure script however im still having issue with the let's encrypt cert even though all ports are open to the internet(80,443). **To Reproduce** Steps to reproduce the behavior: 1. Go to 'setup.env' and added config ` NETBIRD_DASHBOARD_TAG="" NETBIRD_SIGNAL_TAG="" NETBIRD_MANAGEMENT_TAG="" COTURN_TAG="" NETBIRD_RELAY_TAG="" NETBIRD_DOMAIN="nb2.example.com" NETBIRD_TURN_DOMAIN="" NETBIRD_TURN_EXTERNAL_IP="35.221.174.49" NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://accounts.google.com/.well-known/openid-configuration" NETBIRD_AUTH_AUDIENCE="44444444-uklmene.apps.googleusercontent.com" NETBIRD_AUTH_CLIENT_ID="44444444-uklmene.apps.googleusercontent.com" NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email" NETBIRD_AUTH_CLIENT_SECRET="GOCSPAUTH_CLIENT_SECRET" NETBIRD_USE_AUTH0="false" NETBIRD_AUTH_REDIRECT_URI="/auth" NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth" NETBIRD_TOKEN_SOURCE="idToken" NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none" NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="" NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid" NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000" NETBIRD_MGMT_IDP="google" NETBIRD_IDP_MGMT_CLIENT_ID=$NETBIRD_AUTH_CLIENT_ID NETBIRD_IDP_MGMT_CLIENT_SECRET="" NETBIRD_IDP_MGMT_EXTRA_SERVICE_ACCOUNT_KEY="b64key" NETBIRD_IDP_MGMT_EXTRA_CUSTOMER_ID="909098d9s" NETBIRD_DISABLE_LETSENCRYPT=false NETBIRD_LETSENCRYPT_EMAIL="it@example.com" NETBIRD_DISABLE_ANONYMOUS_METRICS=false NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted NETBIRD_RELAY_DOMAIN="" NETBIRD_RELAY_PORT="" `` 3. Run ./configure 4. Compose file ` version: "3" services: #UI dashboard dashboard: image: netbirdio/dashboard:latest restart: unless-stopped ports: - 80:80 - 443:443 environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://nb2.example.com:33073 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://nb2.example.com:33073 # OIDC - AUTH_AUDIENCE=44444444-uklmene.apps.googleusercontent.com - AUTH_CLIENT_ID=44444444-uklmene.apps.googleusercontent.com - AUTH_CLIENT_SECRET=GOCSPAUTH_CLIENT_SECRET - AUTH_AUTHORITY=https://accounts.google.com - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email - AUTH_REDIRECT_URI=/auth - AUTH_SILENT_REDIRECT_URI=/silent-auth - NETBIRD_TOKEN_SOURCE=idToken # SSL - NGINX_SSL_PORT=443 # Letsencrypt - LETSENCRYPT_DOMAIN=nb2.example.com - LETSENCRYPT_EMAIL=it@example.com volumes: - netbird-letsencrypt:/etc/letsencrypt/ logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Signal signal: image: netbirdio/signal:latest restart: unless-stopped volumes: - netbird-signal:/var/lib/netbird ports: - 10000:80 # # port and command for Let's Encrypt validation # - 443:443 # command: ["--letsencrypt-domain", "nb2.example.com", "--log-file", "console"] logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Relay relay: image: netbirdio/relay:latest restart: unless-stopped environment: - NB_LOG_LEVEL=info - NB_LISTEN_ADDRESS=:33080 - NB_EXPOSED_ADDRESS=nb2.example.com:33080 # todo: change to a secure secret - NB_AUTH_SECRET=jt7373737773/ojO83838383883838388383 ports: - 33080:33080 logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Management management: image: netbirdio/management:latest restart: unless-stopped depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro - ./management.json:/etc/netbird/management.json ports: - 33073:443 #API port # # command for Let's Encrypt validation without dashboard container # command: ["--letsencrypt-domain", "nb2.example.com", "--log-file", "console"] command: [ "--port", "443", "--log-file", "console", "--log-level", "info", "--disable-anonymous-metrics=false", "--single-account-mode-domain=nb2.example.com", "--dns-domain=netbird.selfhosted" ] logging: driver: "json-file" options: max-size: "500m" max-file: "2" environment: - NETBIRD_STORE_ENGINE_POSTGRES_DSN= # Coturn coturn: image: coturn/coturn:latest restart: unless-stopped #domainname: nb2.example.com # only needed when TLS is enabled volumes: - ./turnserver.conf:/etc/turnserver.conf:ro # - ./privkey.pem:/etc/coturn/private/privkey.pem:ro # - ./cert.pem:/etc/coturn/certs/cert.pem:ro network_mode: host command: - -c /etc/turnserver.conf logging: driver: "json-file" options: max-size: "500m" max-file: "2" volumes: netbird-mgmt: netbird-signal: netbird-letsencrypt: ` 6. See error ` dashboard-1 | dashboard-1 | Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems: dashboard-1 | Domain: nb2.example.com dashboard-1 | Type: connection dashboard-1 | Detail: During secondary validation: 35.221.174.49: Fetching http://nb2.example.com/.well-known/acme-challenge/IpkLf3E7NL8-vVivqWl9U9rS7xFhAy1ivXrUApnFA-s: Timeout during connect (likely firewall problem) dashboard-1 | dashboard-1 | Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet. dashboard-1 | dashboard-1 | Some challenges have failed. dashboard-1 | Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details. ` **Expected behavior** Create a letsencrypt certificate and will automatically renew using http-01 challenge **Are you using NetBird Cloud?** Please specify whether you use NetBird Cloud or self-host NetBird's control plane. **NetBird version** `0.30`
saavagebueno added the serverself-hosting labels 2025-11-20 05:28:34 -05:00
saavagebueno commented 2025-11-20 05:28:35 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 11, 2024):

Hello @fr33n0rm, the errors is this:

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
dashboard-1 | Domain: nb2.example.com
dashboard-1 | Type: connection
dashboard-1 | Detail: During secondary validation: 35.221.174.49: Fetching http://nb2.example.com/.well-known/acme-challenge/IpkLf3E7NL8-vVivqWl9U9rS7xFhAy1ivXrUApnFA-s: Timeout during connect (likely firewall problem)

Have you checked your firewall? And is the domain pointing to the right address?

@mlsmaycon commented on GitHub (Oct 11, 2024): Hello @fr33n0rm, the errors is this: ``` Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems: dashboard-1 | Domain: nb2.example.com dashboard-1 | Type: connection dashboard-1 | Detail: During secondary validation: 35.221.174.49: Fetching http://nb2.example.com/.well-known/acme-challenge/IpkLf3E7NL8-vVivqWl9U9rS7xFhAy1ivXrUApnFA-s: Timeout during connect (likely firewall problem) ``` Have you checked your firewall? And is the domain pointing to the right address?
saavagebueno commented 2025-11-20 05:28:35 -05:00
Author
Owner
Copy Link

@fr33n0rm commented on GitHub (Oct 11, 2024):

@mlsmaycon
Yes i have checked the firewall and allowed all IP 0.0.0.0/0 to connect

@fr33n0rm commented on GitHub (Oct 11, 2024): @mlsmaycon Yes i have checked the firewall and allowed all IP 0.0.0.0/0 to connect
saavagebueno commented 2025-11-20 05:28:36 -05:00
Author
Owner
Copy Link

@fr33n0rm commented on GitHub (Oct 11, 2024):

please ignore.. i think it's the firewall.. i tried adding 0.0.0.0/0 again and it successfully created a new cert. Thanks

@fr33n0rm commented on GitHub (Oct 11, 2024): please ignore.. i think it's the firewall.. i tried adding 0.0.0.0/0 again and it successfully created a new cert. Thanks
saavagebueno commented 2025-11-20 05:28:36 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 11, 2024):

That's great. I will close this one.

@mlsmaycon commented on GitHub (Oct 11, 2024): That's great. I will close this one.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label self-hosting server
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1329
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?