then declare a ressource in pangolin, like readeck.mydomain.tld
connect to it with your browser...
Expected Behavior
expected to go to the readeck screen to create a new (first) user
browser says "invalid certificate" error
Originally created by @gilluc on GitHub (Nov 1, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1791
### Describe the Bug
since last week i guess, SSL on new containers give me an error in the browser.
Old containers work well.
attached 2 images
- old certificate for baikal : working
- new certificate for readeck : error
-
<img width="544" height="672" alt="Image" src="https://github.com/user-attachments/assets/a54d45c8-1037-45ea-9aa2-d5faccfb22c8" />
<img width="804" height="710" alt="Image" src="https://github.com/user-attachments/assets/8f6d286e-ec37-4c90-952e-d3ce77a2c09f" />
### Environment
- OS Type & Version: (e.g., Ubuntu 22.04) Debian 12 ARM64 / Portainer 2.33.3 LTS
- Pangolin Version: 1.11.1
- Gerbil Version: 1.2.2
- Traefik Version: v3.6.0-rc1
- Newt Version: 1.1.3
- Olm Version: (if applicable) ?
### To Reproduce
create a new stack on portainer, like readeck and deploy
version: "3.3"
services:
readeck:
container_name: readeck
image: codeberg.org/readeck/readeck:latest
ports:
- 8280:8000
volumes:
- readeck-data:/readeck
restart: always
volumes:
readeck-data:
then declare a ressource in pangolin, like readeck.mydomain.tld
connect to it with your browser...
### Expected Behavior
expected to go to the readeck screen to create a new (first) user
browser says "invalid certificate" error
is it possible that it has something to do with iptables rules i added in DOCKER-USER to prevent connections from "all the world" ??
<!-- gh-comment-id:3476448360 -->
@gilluc commented on GitHub (Nov 1, 2025):
is it possible that it has something to do with iptables rules i added in DOCKER-USER to prevent connections from "all the world" ??
<img width="882" height="129" alt="Image" src="https://github.com/user-attachments/assets/d5a31505-211e-42f3-8904-d986db0717e4" />
is it possible that it has something to do with iptables rules i added in DOCKER-USER to prevent connections from "all the world" ??
yes that the issue. revert is to root or the previous user
<!-- gh-comment-id:3476746703 -->
@hhftechnology commented on GitHub (Nov 1, 2025):
> is it possible that it has something to do with iptables rules i added in DOCKER-USER to prevent connections from "all the world" ??
>
> <img alt="Image" width="882" height="129" src="https://private-user-images.githubusercontent.com/45982037/508567343-d5a31505-211e-42f3-8904-d986db0717e4.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NjIwMjcxOTksIm5iZiI6MTc2MjAyNjg5OSwicGF0aCI6Ii80NTk4MjAzNy81MDg1NjczNDMtZDVhMzE1MDUtMjExZS00MmYzLTg5MDQtZDk4NmRiMDcxN2U0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNTExMDElMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjUxMTAxVDE5NTQ1OVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTNmNjNkZTJlMDMzODc3OGQ0ZmU4MDJmYmI5Y2M0ODllYWEzMzA5MzE2NWQxYTI1MjI1ZWNkZGU3YjQyMTlkZDEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.zf8POPeUd55M8RlYnRZaETr3GsHzMQTmn3YQkCLJPSw">
yes that the issue. revert is to root or the previous user
is it possible that it has something to do with iptables rules i added in DOCKER-USER to prevent connections from "all the world" ??
yes that the issue. revert is to root or the previous user
I deleted the DROP line in iptables but still doesn't work.
how to force certificate renewal ?
<!-- gh-comment-id:3478020569 -->
@gilluc commented on GitHub (Nov 2, 2025):
> > is it possible that it has something to do with iptables rules i added in DOCKER-USER to prevent connections from "all the world" ??
> > <img alt="Image" width="882" height="129" src="https://private-user-images.githubusercontent.com/45982037/508567343-d5a31505-211e-42f3-8904-d986db0717e4.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NjIwMjcxOTksIm5iZiI6MTc2MjAyNjg5OSwicGF0aCI6Ii80NTk4MjAzNy81MDg1NjczNDMtZDVhMzE1MDUtMjExZS00MmYzLTg5MDQtZDk4NmRiMDcxN2U0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNTExMDElMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjUxMTAxVDE5NTQ1OVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTNmNjNkZTJlMDMzODc3OGQ0ZmU4MDJmYmI5Y2M0ODllYWEzMzA5MzE2NWQxYTI1MjI1ZWNkZGU3YjQyMTlkZDEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.zf8POPeUd55M8RlYnRZaETr3GsHzMQTmn3YQkCLJPSw">
>
> yes that the issue. revert is to root or the previous user
I deleted the DROP line in iptables but still doesn't work.
how to force certificate renewal ?
yes it works now BUT it does'nt fix the need of a DROP line in iptables.
has anyone any tip for that ?
which IP addresses should I accept or anything else to protect my homelab AND let certificates renewal ??
<!-- gh-comment-id:3479682852 -->
@gilluc commented on GitHub (Nov 3, 2025):
yes it works now BUT it does'nt fix the need of a DROP line in iptables.
has anyone any tip for that ?
which IP addresses should I accept or anything else to protect my homelab AND let certificates renewal ??
I'd always suggest dns validation as it doesn't require port 80 to be open. Or any ports for that matter just need to be able to make an api call out to LE and then your DNS provider.
Oop forgot to mention DNS validation grants you wildcards.. and it also is less information disclosure in the end. as https://crt.sh exists and no you can't opt out of having your certs being listed but you can limit how much is shown.
<!-- gh-comment-id:3483188325 -->
@AstralDestiny commented on GitHub (Nov 4, 2025):
I'd always suggest dns validation as it doesn't require port 80 to be open. Or any ports for that matter just need to be able to make an api call out to LE and then your DNS provider.
https://docs.fossorial.io/Pangolin/Configuration/wildcard-certs
https://go-acme.github.io/lego/dns/
Oop forgot to mention DNS validation grants you wildcards.. and it also is less information disclosure in the end. as https://crt.sh exists and no you can't opt out of having your certs being listed but you can limit how much is shown.
@github-actions[bot] commented on GitHub (Nov 19, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
<!-- gh-comment-id:3550023128 -->
@github-actions[bot] commented on GitHub (Nov 19, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@github-actions[bot] commented on GitHub (Dec 3, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
<!-- gh-comment-id:3604501445 -->
@github-actions[bot] commented on GitHub (Dec 3, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @gilluc on GitHub (Nov 1, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1791
Describe the Bug
since last week i guess, SSL on new containers give me an error in the browser.
Old containers work well.
attached 2 images
Environment
To Reproduce
create a new stack on portainer, like readeck and deploy
version: "3.3"
services:
readeck:
container_name: readeck
image: codeberg.org/readeck/readeck:latest
ports:
- 8280:8000
volumes:
- readeck-data:/readeck
restart: always
volumes:
readeck-data:
then declare a ressource in pangolin, like readeck.mydomain.tld
connect to it with your browser...
Expected Behavior
expected to go to the readeck screen to create a new (first) user
browser says "invalid certificate" error
@gilluc commented on GitHub (Nov 1, 2025):
is it possible that it has something to do with iptables rules i added in DOCKER-USER to prevent connections from "all the world" ??
@hhftechnology commented on GitHub (Nov 1, 2025):
yes that the issue. revert is to root or the previous user
@gilluc commented on GitHub (Nov 2, 2025):
I deleted the DROP line in iptables but still doesn't work.
how to force certificate renewal ?
@AstralDestiny commented on GitHub (Nov 3, 2025):
It'll happen automatically.
@gilluc commented on GitHub (Nov 3, 2025):
yes it works now BUT it does'nt fix the need of a DROP line in iptables.
has anyone any tip for that ?
which IP addresses should I accept or anything else to protect my homelab AND let certificates renewal ??
@AstralDestiny commented on GitHub (Nov 4, 2025):
I'd always suggest dns validation as it doesn't require port 80 to be open. Or any ports for that matter just need to be able to make an api call out to LE and then your DNS provider.
https://docs.fossorial.io/Pangolin/Configuration/wildcard-certs
https://go-acme.github.io/lego/dns/
Oop forgot to mention DNS validation grants you wildcards.. and it also is less information disclosure in the end. as https://crt.sh exists and no you can't opt out of having your certs being listed but you can limit how much is shown.
@github-actions[bot] commented on GitHub (Nov 19, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@github-actions[bot] commented on GitHub (Dec 3, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.