SSL certificate error ERR_CERT_DATE_INVALID

daz · June 26, 2025, 7:36am

Hi,
after a few month of successfull operation there were several occurences this week when connecting to NS8 mattermost app from web, mobile app and api on various devices an “Invalid SSL certificate error” / “ERR_CERT_DATE_INVALID” arised.
According to Settings/TLS certificates all used FQDNs have their certificates obtained.
After about 30 minutes the error self-healed without any changes made to the system.
NS8 cluster is up to date.
Earlier this week I have updated also the underlying Rocky Linux (from ns- repositoriy), if it could have any relation to the problem (?).
I have checked the system time settings

[admin@ns8 ~]$ timedatectl status 
Local time: Wed 2025-06-25 15:26:49 UTC 
Universal time: Wed 2025-06-25 15:26:49 UTC 
RTC time: Wed 2025-06-25 15:26:49 
Time zone: UTC (UTC, +0000) 
System clock synchronized: yes 
NTP service: active 
RTC in local TZ: no

what seems ok to me, except for Time zone, which I have set accordingly to my geolocation afterwards (Europe/Prague (CEST, +0200)), but the SSL error reoccured later again.

Is there anything else I should check?
Would deteting the certificate and re-obtaining it be helpful?

Thanks

NethServer Version: NS8
Module: mattermost Version 2.2.1

davidep · June 26, 2025, 7:46am

It can be an expired certificate? You can inspect the certificate expiration dates with your browser, or a command like

 curl -v https://mattermost.example.org 2>&1 >/dev/null  |  grep '^\*  '

As I just wrote the update for another Bug, I ask you: do you have Webtop installed on the same node? See Latest issue with LetsEncrypt.

daz · June 26, 2025, 7:58am

Hi,

# curl -v https://mattermost.twr.cz 2>&1 >/dev/null  |  grep '^\*  '
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  subject: CN=hur.twr.cz
*  start date: Jun 23 18:46:53 2025 GMT
*  expire date: Sep 21 18:46:52 2025 GMT
*  subjectAltName: host "mattermost.twr.cz" matched cert's "mattermost.twr.cz"
*  issuer: C=US; O=Let's Encrypt; CN=R10
*  SSL certificate verify ok.

No, I dont have Webtop installed.

davidep · June 26, 2025, 8:01am

According to the system’s clock and CA bundle, your certificate is valid. A client’s clock or cache misalignment may explain the original error.

daz · June 26, 2025, 9:09am

It reapeared now again on several various devices. Seems strange it is caused by their misalignment when they have problems just with this certificate and not any others…

daz · June 26, 2025, 9:15am

Now I tried to resolve it by deleting the certificate from NS8 GUI with an idea to recreate it again but I’ve got an error:

{"context":{"action":"delete-certificate","data":{"fqdn":"mattermost.twr.cz","type":"internal"},"extra":{"description":"Processing","eventId":"1744a26e-d34b-4be2-a121-85231c238369","title":"Delete certificate for mattermost.twr.cz"},"id":"5f8c889c-02ed-40ee-b9b6-22ddaf2d688f","parent":"","queue":"module/traefik1/tasks","timestamp":"2025-06-26T09:12:55.768747477Z","user":"admin"},"status":"aborted","progress":0,"subTasks":[],"validated":false,"result":{"error":"<3>Timeout after about 30 seconds. Certificate not obtained for ['hur.twr.cz', 'nextcloud.twr.cz', 'nvcti.twr.cz', 'nvproxy.twr.cz', 'nv.twr.cz', 'collabora.twr.cz', 'intra.twr.cz', 'sogo.twr.cz', 'tel.twr.cz', 'nethvoice.twr.cz'].\n<3>\n","exit_code":3,"file":"task/module/traefik1/5f8c889c-02ed-40ee-b9b6-22ddaf2d688f","output":false}}

Certificate was not deleted and I am kind of stuck now.

daz · June 26, 2025, 9:18am

Additionaly it seems problems are now also on the other FQDNs I use on NS8.

mrmarkuz · June 26, 2025, 9:29am

I checked the cert and there’s a domain mmtest.twr.cz included that’s not known by DNS and maybe is the cause that obtaining a new cert fails.
You could check if configuring DNS for mmtest.twr.cz to the public IP makes obtaining certs work again.

daz · June 26, 2025, 9:34am

Yes, I can check it, but I would rather like to get rid of mmtest.twr.cz because it was used just in a testing process some time ago. But I dont see it in the NS8 WebGUI.

mrmarkuz · June 26, 2025, 9:51am

Is that cert listed in traefiks acme.json?

runagent -m traefik1 nano acme/acme.json

daz · June 26, 2025, 9:55am

yes it is

davidep · June 26, 2025, 9:58am

Just to be sure… Does it appear somewhere else under Traefik’s config?

grep -R -F 'mmtest.twr.cz' /home/traefik*/.config/state/configs

daz · June 26, 2025, 10:35am

no, output of this command is empty

davidep · June 26, 2025, 12:15pm

The listed server names already provide valid certificates, signed by Let’Encrypt-signed. Their verification is successful by my side. They were generated on Jun 23. So the error from your client can depend on something between them and the server. Possible?

Now you want to remove mattermost.twr.cz and it fails. To compare the timeout error with similar failure cases, I’d like to see if it’s used as “main” server name in Traefik’s config. Please share the output of:

grep -C 5 -R -F 'mattermost.twr.cz' /home/traefik*/.config/state/configs

daz · June 26, 2025, 12:16pm

[root@hur-ns8 admin]# grep -C 5 -R -F 'mattermost.twr.cz' /home/traefik*/.config/state/configs
/home/traefik1/.config/state/configs/_default_cert.yml-          - nextcloud.twr.cz
/home/traefik1/.config/state/configs/_default_cert.yml-          - nvcti.twr.cz
/home/traefik1/.config/state/configs/_default_cert.yml-          - nvproxy.twr.cz
/home/traefik1/.config/state/configs/_default_cert.yml-          - nv.twr.cz
/home/traefik1/.config/state/configs/_default_cert.yml-          - collabora.twr.cz
/home/traefik1/.config/state/configs/_default_cert.yml:          - mattermost.twr.cz
/home/traefik1/.config/state/configs/_default_cert.yml-          - intra.twr.cz
/home/traefik1/.config/state/configs/_default_cert.yml-          - sogo.twr.cz
/home/traefik1/.config/state/configs/_default_cert.yml-          - tel.twr.cz
/home/traefik1/.config/state/configs/_default_cert.yml-          - nethvoice.twr.cz
--
/home/traefik1/.config/state/configs/mattermost1.yml-      loadBalancer:
/home/traefik1/.config/state/configs/mattermost1.yml-        servers:
/home/traefik1/.config/state/configs/mattermost1.yml-        - url: http://127.0.0.1:20006
/home/traefik1/.config/state/configs/mattermost1.yml-  routers:
/home/traefik1/.config/state/configs/mattermost1.yml-    mattermost1-http:
/home/traefik1/.config/state/configs/mattermost1.yml:      rule: Host(`mattermost.twr.cz`)
/home/traefik1/.config/state/configs/mattermost1.yml-      priority: 2
/home/traefik1/.config/state/configs/mattermost1.yml-      service: mattermost1
/home/traefik1/.config/state/configs/mattermost1.yml-      middlewares:
/home/traefik1/.config/state/configs/mattermost1.yml-      - http2https-redirectscheme
/home/traefik1/.config/state/configs/mattermost1.yml-      entryPoints:
/home/traefik1/.config/state/configs/mattermost1.yml-      - http
/home/traefik1/.config/state/configs/mattermost1.yml-    mattermost1-https:
/home/traefik1/.config/state/configs/mattermost1.yml:      rule: Host(`mattermost.twr.cz`)
/home/traefik1/.config/state/configs/mattermost1.yml-      priority: 2
/home/traefik1/.config/state/configs/mattermost1.yml-      service: mattermost1
/home/traefik1/.config/state/configs/mattermost1.yml-      entryPoints:
/home/traefik1/.config/state/configs/mattermost1.yml-      - https
/home/traefik1/.config/state/configs/mattermost1.yml-      tls:
/home/traefik1/.config/state/configs/mattermost1.yml-        domains:
/home/traefik1/.config/state/configs/mattermost1.yml:        - main: mattermost.twr.cz

davidep · June 26, 2025, 12:32pm

If system journal wasn’t recently rotated we’d see ACME errors in the journal:

journalctl --grep acmeCA

As alternative, for older data, let’s ask Loki:

logcli  query -q --no-labels --limit=1000 --since=7d '{module_id="traefik1"} |= "acmeCA" | json | line_format "{{.MESSAGE}}"'

daz · June 26, 2025, 12:49pm

journalctl --grep acmeCA
Jun 26 12:28:54 hur-ns8 traefik[2467]: 2025-06-26T10:28:54Z INF Testing certificate renew... acmeCA=https://acme-v02>
Jun 26 12:29:05 hur-ns8 traefik[2467]: 2025-06-26T10:29:05Z INF Renewing certificate from LE : {Main:mmtest.twr.cz S>
Jun 26 12:29:14 hur-ns8 traefik[2467]: 2025-06-26T10:29:14Z ERR Error renewing certificate from LE: {mmtest.twr.cz [>
Jun 26 12:29:14 hur-ns8 traefik[2467]: 2025-06-26T10:29:14Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs>
Jun 26 12:29:55 hur-ns8 traefik[2467]: 2025-06-26T10:29:55Z ERR Error renewing certificate from LE: {hur.twr.cz [sog>
lines 1-5/5 (END)

 /usr/local/bin/logcli  query -q --no-labels --limit=1000 --since=7d '{module_id="traefik1"} |= "acmeCA" | json | line_format "{{.MESSAGE}}"'
2025-06-26T12:29:55+02:00 2025-06-26T10:29:55Z ERR Error renewing certificate from LE: {hur.twr.cz [sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-26T12:29:14+02:00 2025-06-26T10:29:14Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs:[sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-26T12:29:14+02:00 2025-06-26T10:29:14Z ERR Error renewing certificate from LE: {mmtest.twr.cz []} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-26T12:29:05+02:00 2025-06-26T10:29:05Z INF Renewing certificate from LE : {Main:mmtest.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-26T12:28:54+02:00 2025-06-26T10:28:54Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-25T21:44:51+02:00 2025-06-25T19:44:51Z ERR Error renewing certificate from LE: {hur.twr.cz [sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-25T21:44:44+02:00 2025-06-25T19:44:44Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs:[sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-25T21:44:44+02:00 2025-06-25T19:44:44Z ERR Error renewing certificate from LE: {mmtest.twr.cz []} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-25T21:44:37+02:00 2025-06-25T19:44:37Z INF Renewing certificate from LE : {Main:mmtest.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-25T21:44:34+02:00 2025-06-25T19:44:34Z INF Renewing certificate from LE : {Main:collabora.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-25T21:44:34+02:00 2025-06-25T19:44:34Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-24T21:44:53+02:00 2025-06-24T19:44:53Z ERR Error renewing certificate from LE: {hur.twr.cz [sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-24T21:44:43+02:00 2025-06-24T19:44:43Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs:[sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-24T21:44:43+02:00 2025-06-24T19:44:43Z ERR Error renewing certificate from LE: {mmtest.twr.cz []} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-24T21:44:34+02:00 2025-06-24T19:44:34Z INF Renewing certificate from LE : {Main:mmtest.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-24T21:44:34+02:00 2025-06-24T19:44:34Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-23T21:45:00+02:00 2025-06-23T19:45:00Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs:[nvcti.twr.cz nvproxy.twr.cz sogo.twr.cz nethvoice.twr.cz intra.twr.cz nextcloud.twr.cz mattermost.twr.cz nv.twr.cz collabora.twr.cz]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-23T21:44:53+02:00 2025-06-23T19:44:53Z INF Renewing certificate from LE : {Main:intra.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-23T21:44:53+02:00 2025-06-23T19:44:53Z ERR Error renewing certificate from LE: {hur.twr.cz [sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-23T21:44:42+02:00 2025-06-23T19:44:42Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs:[sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-23T21:44:42+02:00 2025-06-23T19:44:42Z ERR Error renewing certificate from LE: {mmtest.twr.cz []} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-23T21:44:34+02:00 2025-06-23T19:44:34Z INF Renewing certificate from LE : {Main:mmtest.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-23T21:44:34+02:00 2025-06-23T19:44:34Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-22T21:44:48+02:00 2025-06-22T19:44:48Z ERR Error renewing certificate from LE: {hur.twr.cz [sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-22T21:44:39+02:00 2025-06-22T19:44:39Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs:[sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-22T21:44:39+02:00 2025-06-22T19:44:39Z ERR Error renewing certificate from LE: {mmtest.twr.cz []} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-22T21:44:34+02:00 2025-06-22T19:44:34Z INF Renewing certificate from LE : {Main:mmtest.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-22T21:44:34+02:00 2025-06-22T19:44:34Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-21T21:44:34+02:00 2025-06-21T19:44:34Z ERR Error renewing certificate from LE: {hur.twr.cz [sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-21T21:44:00+02:00 2025-06-21T19:44:00Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs:[sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-21T21:44:00+02:00 2025-06-21T19:44:00Z ERR Error renewing certificate from LE: {mmtest.twr.cz []} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-21T21:43:55+02:00 2025-06-21T19:43:55Z INF Renewing certificate from LE : {Main:mmtest.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-21T17:47:26+02:00 2025-06-21T15:47:26Z ERR Error renewing certificate from LE: {hur.twr.cz [sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-21T17:47:17+02:00 2025-06-21T15:47:17Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs:[sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-21T17:47:17+02:00 2025-06-21T15:47:17Z ERR Error renewing certificate from LE: {mmtest.twr.cz []} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-21T17:47:10+02:00 2025-06-21T15:47:10Z INF Renewing certificate from LE : {Main:mmtest.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-21T17:47:10+02:00 2025-06-21T15:47:10Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-20T17:47:38+02:00 2025-06-20T15:47:38Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs:[nextcloud.twr.cz nv.twr.cz collabora.twr.cz nethvoice.twr.cz sogo.twr.cz nvcti.twr.cz nvproxy.twr.cz mattermost.twr.cz]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-20T17:47:26+02:00 2025-06-20T15:47:26Z INF Renewing certificate from LE : {Main:nvcti.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-20T17:47:26+02:00 2025-06-20T15:47:26Z ERR Error renewing certificate from LE: {hur.twr.cz [sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-20T17:47:19+02:00 2025-06-20T15:47:19Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs:[sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-20T17:47:19+02:00 2025-06-20T15:47:19Z ERR Error renewing certificate from LE: {mmtest.twr.cz []} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-20T17:47:10+02:00 2025-06-20T15:47:10Z INF Renewing certificate from LE : {Main:mmtest.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-20T17:47:10+02:00 2025-06-20T15:47:10Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-19T17:47:27+02:00 2025-06-19T15:47:27Z ERR Error renewing certificate from LE: {hur.twr.cz [sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-19T17:47:16+02:00 2025-06-19T15:47:16Z INF Renewing certificate from LE : {Main:hur.twr.cz SANs:[sogo.twr.cz mattermost.twr.cz mmtest.twr.cz nextcloud.twr.cz collabora.twr.cz]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-19T17:47:16+02:00 2025-06-19T15:47:16Z ERR Error renewing certificate from LE: {mmtest.twr.cz []} error="error: one or more domains had a problem:\n[mmtest.twr.cz] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for mmtest.twr.cz - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for mmtest.twr.cz - check that a DNS record exists for this domain\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-19T17:47:10+02:00 2025-06-19T15:47:10Z INF Renewing certificate from LE : {Main:mmtest.twr.cz SANs:[]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme
2025-06-19T17:47:10+02:00 2025-06-19T15:47:10Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=acmeServer.acme

daz · June 26, 2025, 1:58pm

So as was already said it seems the mmtest.twr.cz FQDN is causing the problem. How can I remove it manually? It is no more used by any app (was some months ago while testing another mattermost instance, which I removed later)

davidep · June 26, 2025, 2:05pm

Run this procedure. It will selectively remove certificates for mmtest.twr.cz from Traefik’s acme.json file. Finally Traefik must be fully restarted to pick up the change.

runagent -m traefik1
cd acme
<acme.json jq --arg domain "mmtest.twr.cz" '.acmeServer.Certificates |= map(select(.domain.main != $domain and ((.domain.sans//[])|contains([$domain])|not)))' >acme.json.acmejson-notify
cat acme.json.acmejson-notify >acme.json
systemctl --user restart traefik

daz · June 26, 2025, 2:33pm

Procedure run without errors.
By inspecting acme/acme.json there is no more reference to mmtest.twr.cz in it.
Subsequently I have tried to remove another no more used certificate, which was (opposite to mmtest) listed in GUI: nv.twr.cz.
By this attempt, error occured again:

{"context":{"action":"delete-certificate","data":{"fqdn":"nv.twr.cz","type":"internal"},"extra":{"description":"Processing","eventId":"d58d601d-85fd-4e67-b2a3-7a1248d50e05","title":"Delete certificate for nv.twr.cz"},"id":"051f9437-cf58-4fb7-8ab6-9a5d7e259796","parent":"","queue":"module/traefik1/tasks","timestamp":"2025-06-26T14:29:26.961969105Z","user":"admin"},"status":"aborted","progress":0,"subTasks":[],"validated":false,"result":{"error":"<3>Timeout after about 30 seconds. Certificate not obtained for ['hur.twr.cz', 'nextcloud.twr.cz', 'nvcti.twr.cz', 'nvproxy.twr.cz', 'collabora.twr.cz', 'mattermost.twr.cz', 'intra.twr.cz', 'sogo.twr.cz', 'tel.twr.cz', 'nethvoice.twr.cz'].\n<3>\n","exit_code":3,"file":"task/module/traefik1/051f9437-cf58-4fb7-8ab6-9a5d7e259796","output":false}}