ACME error - Could not find solver for: tls-alpn-01

[Green2Matter]

Describe the bug
Not able to create SSL certificate using builtin ACME client

To Reproduce
Steps to reproduce the behavior:

1. Configure DNS credentials (OVH - ovh-eu, all keys provided and work correctly in other instances)
2. Go to 'Certificates List'
3. Click on 'Issue wildcard cert.'
4. Log:

Getting the certificate, please wait...

2024/05/24 19:38:29 [INFO] [Nginx UI] Preparing lego configurations

2024/05/24 19:38:29 [INFO] [Nginx UI] ACME User: System Initial User, Email: admin@domain.com, CA Dir: https://acme-v02.api.letsencrypt.org/directory

2024/05/24 19:38:29 [INFO] [Nginx UI] Creating client facilitates communication with the CA server

2024/05/24 19:38:29 [INFO] [Nginx UI] Setting DNS01 challenge provider

2024/05/24 19:38:29 [INFO] [Nginx UI] Setting environment variables

2024/05/24 19:38:29 [INFO] [Nginx UI] Obtaining certificate

2024/05/24 19:38:29 [INFO] [*.domain.com, domain.com] acme: Obtaining bundled SAN certificate

2024/05/24 19:38:31 [INFO] [*.domain.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/1111111111111111

2024/05/24 19:38:31 [INFO] [domain.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/2222222222222

2024/05/24 19:38:31 [INFO] [*.domain.com] acme: use dns-01 solver

2024/05/24 19:38:31 [INFO] [domain.com] acme: Could not find solver for: tls-alpn-01

2024/05/24 19:38:31 [INFO] [domain.com] acme: Could not find solver for: http-01

2024/05/24 19:38:31 [INFO] [domain.com] acme: use dns-01 solver

2024/05/24 19:38:31 [INFO] [*.domain.com] acme: Preparing to solve DNS-01

2024/05/24 19:38:31 [INFO] Found CNAME entry for "_acme-challenge.domain.com.": "domain.com."

2024/05/24 19:38:31 [INFO] [domain.com] acme: Preparing to solve DNS-01

2024/05/24 19:38:31 [INFO] Found CNAME entry for "_acme-challenge.domain.com.": "domain.com."

2024/05/24 19:38:31 [INFO] [*.domain.com] acme: Cleaning DNS-01 challenge

2024/05/24 19:38:31 [INFO] Found CNAME entry for "_acme-challenge.domain.com.": "domain.com."

2024/05/24 19:38:31 [WARN] [*.domain.com] acme: cleaning up failed: ovh: unknown record ID for 'domain.com.'

2024/05/24 19:38:31 [INFO] [domain.com] acme: Cleaning DNS-01 challenge

2024/05/24 19:38:31 [INFO] Found CNAME entry for "_acme-challenge.domain.com.": "domain.com."

2024/05/24 19:38:31 [WARN] [domain.com] acme: cleaning up failed: ovh: unknown record ID for 'domain.com.'

2024/05/24 19:38:31 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/1111111111111111

2024/05/24 19:38:31 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/2222222222222

2024/05/24 19:38:32 [INFO] [Nginx UI] Reloading nginx

obtain certificate error: error: one or more domains had a problem: [*.domain.com] [*.domain.com] acme: error presenting token: ovh: no subdomain because the domain and the zone are identical: domain.com. [domain.com] [domain.com] acme: error presenting token: ovh: no subdomain because the domain and the zone are identical: domain.com.

Expected behavior
Create certificate

Info (please complete the following information):

• Server OS: Proxmox LXC
• Server Arch: x86
• Nginx UI Version: 2.0.0-beta.24 (135)
• Your Browser: Chrome, Safari

[0xJacky]

no subdomain because the domain and the zone are identical: domain.com.

It seems that the error is returned by the dns provider, have you try to issue the certificate again, or try another dns prodiver?

[Green2Matter]

no subdomain because the domain and the zone are identical: domain.com.

It seems that the error is returned by the dns provider, have you try to issue the certificate again, or try another dns prodiver?

I've installed acme.sh and got certificate (using same API keys) after issuing:
acme.sh --issue -d domain.com -d '*.domain.com' --dns dns_ovh --server letsencrypt --keylength ec-384
To me it looks like nginxui acme client doesn't submit correctly either keys or domain while sending request...

[0xJacky]

You can try https://github.com/go-acme/lego with CLI mode, in nginxui we use this tool to obtain certificate, if the problem still exists maybe we should turn to the author of that project for help.

[Green2Matter]

What version of lego package do you use? In debian there's available lego/stable 4.9.1-1 amd64.
When I have spare time, I'll try to install and test it...

[0xJacky]

v4.16.1

[Green2Matter]

So, after issuing command:
lego --email admin@domain.com --dns ovh --domains domain.com --domains *.domain.com run
I received:

2024/05/27 03:26:33 No key found for account admin@domain.com. Generating a P256 key.
2024/05/27 03:26:33 Saved key to /root/.lego/accounts/acme-v02.api.letsencrypt.org/admin@domain.com/keys/admin@domain.com.key
2024/05/27 03:26:34 Please review the TOS at https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf
Do you accept the TOS? Y/n
y
2024/05/27 03:26:36 [INFO] acme: Registering account for admin@domain.com
!!!! HEADS UP !!!!

Your account credentials have been saved in your Let's Encrypt
configuration directory at "/root/.lego/accounts".

You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
2024/05/27 03:26:37 [INFO] [domain.com, *.domain.com] acme: Obtaining bundled SAN certificate
2024/05/27 03:26:37 [INFO] [*.domain.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/355956570702
2024/05/27 03:26:37 [INFO] [domain.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/355956570712
2024/05/27 03:26:37 [INFO] [*.domain.com] acme: use dns-01 solver
2024/05/27 03:26:37 [INFO] [domain.com] acme: Could not find solver for: tls-alpn-01
2024/05/27 03:26:37 [INFO] [domain.com] acme: Could not find solver for: http-01
2024/05/27 03:26:37 [INFO] [domain.com] acme: use dns-01 solver
2024/05/27 03:26:37 [INFO] [*.domain.com] acme: Preparing to solve DNS-01
2024/05/27 03:26:38 [INFO] Found CNAME entry for "_acme-challenge.domain.com.": "domain.com."
2024/05/27 03:26:38 [INFO] [domain.com] acme: Preparing to solve DNS-01
2024/05/27 03:26:38 [INFO] Found CNAME entry for "_acme-challenge.domain.com.": "domain.com."
2024/05/27 03:26:38 [INFO] [*.domain.com] acme: Trying to solve DNS-01
2024/05/27 03:26:38 [INFO] Found CNAME entry for "_acme-challenge.domain.com.": "domain.com."
2024/05/27 03:26:38 [INFO] [*.domain.com] acme: Checking DNS record propagation using [1.1.1.1:53]
2024/05/27 03:26:40 [INFO] Wait for propagation [timeout: 1m0s, interval: 2s]
2024/05/27 03:26:47 [INFO] [*.domain.com] The server validated our request
2024/05/27 03:26:47 [INFO] [domain.com] acme: Trying to solve DNS-01
2024/05/27 03:26:47 [INFO] Found CNAME entry for "_acme-challenge.domain.com.": "domain.com."
2024/05/27 03:26:47 [INFO] [domain.com] acme: Checking DNS record propagation using [1.1.1.1:53]
2024/05/27 03:26:49 [INFO] Wait for propagation [timeout: 1m0s, interval: 2s]
2024/05/27 03:26:57 [INFO] [domain.com] The server validated our request
2024/05/27 03:26:57 [INFO] [*.domain.com] acme: Cleaning DNS-01 challenge
2024/05/27 03:26:57 [INFO] Found CNAME entry for "_acme-challenge.domain.com.": "domain.com."
2024/05/27 03:26:57 [INFO] [domain.com] acme: Cleaning DNS-01 challenge
2024/05/27 03:26:57 [INFO] Found CNAME entry for "_acme-challenge.domain.com.": "domain.com."
2024/05/27 03:26:57 [INFO] [domain.com, *.domain.com] acme: Validations succeeded; requesting certificates
2024/05/27 03:26:58 [INFO] [domain.com] Server responded with a certificate.

Thus, it seems like issue is within nginxui...

[DekFTW]

I'm unable to get wildcard certificates, too. But they worked in the past with nginx-ui.

[0xJacky]

I'm unable to get wildcard certificates, too. But they worked in the past with nginx-ui.

Please provide the logs, thanks!

[Green2Matter]

I will add also that dashboard's graphs (CPU and Network) aren't refreshed properly:

Graphs are visible only on page load and after a few seconds - with first auto refresh, they are gone...

[0xJacky]

Did you use nginx to proxy the nginx-ui?

[0xJacky]

I will add also that dashboard's graphs (CPU and Network) aren't refreshed properly: Graphs are visible only on page load and after a few seconds - with first auto refresh, they are gone...

This issue is common if the websocket is not available, you can press F12 to open the console of the browser, switch to the Network tab and check if the server send the analytics data through websocket properly.

[0xJacky]

What version of lego package do you use? In debian there's available lego/stable 4.9.1-1 amd64. When I have spare time, I'll try to install and test it...

I will upgrade lego to the latest version(v4.17.3) in next beta verison of nginx-ui, but I can't ensure this will solve your problem.

[Green2Matter]

This issue is common if the websocket is not available, you can press F12 to open the console of the browser, switch to the Network tab and check if the server send the analytics data through websocket properly.

"nodes?token" https status is 101 (switching protocols) and there are empty ("{}") messages sent. Same behaviour is on non proxied (port 9000, raw nginxui data) service as is on proxied https - which uses http2.
"nginx_log?token" has same status (101) and in messages: '{"type":"error","server_idx":null,"directive_idx":null}'
In both cases payload consists of the same token.