[GH-ISSUE #2935] All public ressources show Certificate failed #32336

New Issue

2026-06-15T09:45:30-05:00

GiteaMirror commented

2026-06-15 09:45:30 -05:00

Originally created by @Schnookeuz on GitHub (Apr 29, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2935

Describe the Bug

I updated to v1.18.1 and the new certificate indicator for private ressources shows that the certificate is invalid.

Environment

OS Type & Version: Debian 13
Pangolin Version: 1.18.1 EE
Gerbil Version: 1.3.1
Traefik Version: 3.6.14
Newt Version: 1.12.2

To Reproduce

Update to v1.18.1
Create a privateConfig.yml in config/ with content (i also tried without that):

acme:
  acme_json_path: "config/letsencrypt/acme.json"
  sync_interval_ms: 5000

Start Compose stack
Go to private ressouces

The logs are showing:

pangolin            | 2026-04-29T22:51:23+00:00 [warn]: Certificate not found for domain: domain1
pangolin            | 2026-04-29T22:51:23+00:00 [warn]: Certificate not found for domain: domain1
pangolin            | 2026-04-29T22:51:23+00:00 [warn]: Certificate not found for domain: domain1
pangolin            | 2026-04-29T22:51:23+00:00 [warn]: Certificate not found for domain: domain1

Additional info:
-I use DNS-01 challenge for a wildcard certificate.
-I only have one domain.

Expected Behavior

All certificates are fine.

Originally created by @Schnookeuz on GitHub (Apr 29, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/2935 ### Describe the Bug I updated to v1.18.1 and the new certificate indicator for private ressources shows that the certificate is invalid. ### Environment - OS Type & Version: Debian 13 - Pangolin Version: 1.18.1 EE - Gerbil Version: 1.3.1 - Traefik Version: 3.6.14 - Newt Version: 1.12.2 ### To Reproduce - Update to v1.18.1 - Create a privateConfig.yml in config/ with content (i also tried without that): ``` acme: acme_json_path: "config/letsencrypt/acme.json" sync_interval_ms: 5000 ``` - Start Compose stack - Go to private ressouces <img width="1075" height="662" alt="Image" src="https://github.com/user-attachments/assets/71d1a739-d34a-4b7c-ad5c-78dafae3cd01" /> The logs are showing: ``` pangolin | 2026-04-29T22:51:23+00:00 [warn]: Certificate not found for domain: domain1 pangolin | 2026-04-29T22:51:23+00:00 [warn]: Certificate not found for domain: domain1 pangolin | 2026-04-29T22:51:23+00:00 [warn]: Certificate not found for domain: domain1 pangolin | 2026-04-29T22:51:23+00:00 [warn]: Certificate not found for domain: domain1 ``` Additional info: -I use DNS-01 challenge for a wildcard certificate. -I only have one domain. ### Expected Behavior All certificates are fine.

GiteaMirror added the bug label 2026-06-15 09:45:30 -05:00

GiteaMirror closed this issue

2026-06-15 09:45:30 -05:00

GiteaMirror commented

2026-06-15 09:45:32 -05:00

@Schnookeuz commented on GitHub (Apr 29, 2026):

I also entered a shell inside the pangolin container and my acme.json is accessible:

root@pangolin:~# docker exec -it pangolin /bin/bash

root@fe18cd5de0b0:/app# ls -l config/letsencrypt/acme.json
-rw------- 1 root root 7922 Mar 12 21:07 config/letsencrypt/acme.json

@Schnookeuz commented on GitHub (Apr 29, 2026): I also entered a shell inside the pangolin container and my acme.json is accessible: ``` root@pangolin:~# docker exec -it pangolin /bin/bash root@fe18cd5de0b0:/app# ls -l config/letsencrypt/acme.json -rw------- 1 root root 7922 Mar 12 21:07 config/letsencrypt/acme.json ```

GiteaMirror commented

2026-06-15 09:45:33 -05:00

@oschwartz10612 commented on GitHub (Apr 29, 2026):

Looking into it

@oschwartz10612 commented on GitHub (Apr 29, 2026): Looking into it

GiteaMirror commented

2026-06-15 09:45:34 -05:00

@oschwartz10612 commented on GitHub (Apr 29, 2026):

Could you do the following to help us troubleshoot?

sudo apt install sqlite3
sqlite3 config/db/db.sqlite
> select domain,domainId,wildcard,valid from certificates;

and let us know the output?

@oschwartz10612 commented on GitHub (Apr 29, 2026): Could you do the following to help us troubleshoot? ``` sudo apt install sqlite3 sqlite3 config/db/db.sqlite > select domain,domainId,wildcard,valid from certificates; ``` and let us know the output?

GiteaMirror commented

2026-06-15 09:45:34 -05:00

@Schnookeuz commented on GitHub (Apr 29, 2026):

There u go:

#With your query
sqlite> select domain,domainId,wildcard,valid from certificates;
Parse error: no such column: valid
  select domain,domainId,wildcard,valid from certificates;
                    error here ---^

#Then without 'valid'
sqlite> select domain,domainId,wildcard from certificates;
obfuscated.de|domain1|0

@Schnookeuz commented on GitHub (Apr 29, 2026): There u go: ``` #With your query sqlite> select domain,domainId,wildcard,valid from certificates; Parse error: no such column: valid select domain,domainId,wildcard,valid from certificates; error here ---^ #Then without 'valid' sqlite> select domain,domainId,wildcard from certificates; obfuscated.de|domain1|0 ```

GiteaMirror commented

2026-06-15 09:45:35 -05:00

@oschwartz10612 commented on GitHub (Apr 29, 2026):

Whoops sorry the column is status

Okay so it is not storing the domain as a wildcard in the database which is the problem. Would you mind sharing what your acme.json looks like? You can remove the base64 cert sections. I want to see how the domain is represented.

@oschwartz10612 commented on GitHub (Apr 29, 2026): Whoops sorry the column is `status` Okay so it is not storing the domain as a wildcard in the database which is the problem. Would you mind sharing what your acme.json looks like? You can remove the base64 cert sections. I want to see how the domain is represented.

GiteaMirror commented

2026-06-15 09:45:35 -05:00

@Schnookeuz commented on GitHub (Apr 29, 2026):

Sure...

sqlite> select domain,domainId,wildcard,status from certificates;
obfuscated.de|domain1|0|valid

{
  "letsencrypt": {
    "Account": {
      "Email": "schnookeuz@obfuscated.de",
      "Registration": {
        "body": {
          "status": "valid"
        },
        "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/123456789"
      },
      "PrivateKey": "StuffAndThingsInBase64",
      "KeyType": "P384"
    },
    "Certificates": [
      {
        "domain": {
          "main": "obfuscated.de",
          "sans": [
            "*.obfuscated.de"
          ]
        },
        "certificate": "StuffAndThingsInBase64",
        "key": "StuffAndThingsInBase64",
        "Store": "default"
      }
    ]
  }
}

and before you ask, here the section in the config.yml:

domains:
    domain1:
        base_domain: "obfuscated.de"
        prefer_wildcard_cert: true

@Schnookeuz commented on GitHub (Apr 29, 2026): Sure... ``` sqlite> select domain,domainId,wildcard,status from certificates; obfuscated.de|domain1|0|valid ``` ``` { "letsencrypt": { "Account": { "Email": "schnookeuz@obfuscated.de", "Registration": { "body": { "status": "valid" }, "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/123456789" }, "PrivateKey": "StuffAndThingsInBase64", "KeyType": "P384" }, "Certificates": [ { "domain": { "main": "obfuscated.de", "sans": [ "*.obfuscated.de" ] }, "certificate": "StuffAndThingsInBase64", "key": "StuffAndThingsInBase64", "Store": "default" } ] } } ``` and before you ask, here the section in the config.yml: ``` domains: domain1: base_domain: "obfuscated.de" prefer_wildcard_cert: true ```

GiteaMirror commented

2026-06-15 09:45:37 -05:00

@AstralDestiny commented on GitHub (Apr 29, 2026):

Same here,


Parse error: no such column: valid
  select domain,domainId,wildcard,valid from certificates;
                    error here ---^

{
  "dns": {
    "Account": {
      "Registration": {
        "body": {
          "status": "valid"
        },
        "uri": "https://acme-v02.api.letsencrypt.org/"
      },
      "PrivateKey": "",
      "KeyType": "P384"
    },
    "Certificates": [
      {
        "domain": {
          "main": "domain4.com",
          "sans": [
            "*.domain4.com"
          ]
        },
        "certificate": "=",
        "key": "",
        "Store": "default"
      },
      {
        "domain": {
          "main": "domain3.com",
          "sans": [
            "*.domain3.com"
          ]
        },
        "certificate": "==",
        "key": "",
        "Store": "default"
      },
      {
        "domain": {
          "main": "domain2.com",
          "sans": [
            "*.domain2.com"
          ]
        },
        "certificate": "=",
        "key": "",
        "Store": "default"
      },
      {
        "domain": {
          "main": "domain1.com",
          "sans": [
            "*.domain1.com",
            "*.customers.domain1.com",
            "*.internal.domain1.com"
          ]
        },
        "certificate": "",
        "key": "",
        "Store": "default"
      }
    ]
  },
  "http": {
    "Account": null,
    "Certificates": null
  }
}

config/privateconfig.yml

acme:
  acme_json_path: /acme.json
  resolver: dns

config/config.yml

domains:
  domain1:
    base_domain: domain1.com
    cert_resolver: dns
    prefer_wildcard_cert: true
  domain2:
    base_domain: domain2.com
    cert_resolver: dns
    prefer_wildcard_cert: true
  domain3:
    base_domain: domain3.com
    cert_resolver: dns
    prefer_wildcard_cert: true
  domain4:
    base_domain: domain4.com
    cert_resolver: dns
    prefer_wildcard_cert: true

@AstralDestiny commented on GitHub (Apr 29, 2026): Same here, ``` Parse error: no such column: valid select domain,domainId,wildcard,valid from certificates; error here ---^ ``` ``` { "dns": { "Account": { "Registration": { "body": { "status": "valid" }, "uri": "https://acme-v02.api.letsencrypt.org/" }, "PrivateKey": "", "KeyType": "P384" }, "Certificates": [ { "domain": { "main": "domain4.com", "sans": [ "*.domain4.com" ] }, "certificate": "=", "key": "", "Store": "default" }, { "domain": { "main": "domain3.com", "sans": [ "*.domain3.com" ] }, "certificate": "==", "key": "", "Store": "default" }, { "domain": { "main": "domain2.com", "sans": [ "*.domain2.com" ] }, "certificate": "=", "key": "", "Store": "default" }, { "domain": { "main": "domain1.com", "sans": [ "*.domain1.com", "*.customers.domain1.com", "*.internal.domain1.com" ] }, "certificate": "", "key": "", "Store": "default" } ] }, "http": { "Account": null, "Certificates": null } } ``` config/privateconfig.yml ``` acme: acme_json_path: /acme.json resolver: dns ``` config/config.yml ``` domains: domain1: base_domain: domain1.com cert_resolver: dns prefer_wildcard_cert: true domain2: base_domain: domain2.com cert_resolver: dns prefer_wildcard_cert: true domain3: base_domain: domain3.com cert_resolver: dns prefer_wildcard_cert: true domain4: base_domain: domain4.com cert_resolver: dns prefer_wildcard_cert: true ```

GiteaMirror commented

2026-06-15 09:45:38 -05:00

@oschwartz10612 commented on GitHub (Apr 29, 2026):

Hum I wonder if the sans fix in this release did not work. Looking into it now

@oschwartz10612 commented on GitHub (Apr 29, 2026): Hum I wonder if the sans fix in this release did not work. Looking into it now

GiteaMirror commented

2026-06-15 09:45:39 -05:00

@AstralDestiny commented on GitHub (Apr 29, 2026):

Though think I recall Loz mentioning it doesn't look at the sans field.

@AstralDestiny commented on GitHub (Apr 29, 2026): Though think I recall Loz mentioning it doesn't look at the sans field.

GiteaMirror commented

2026-06-15 09:45:40 -05:00

@oschwartz10612 commented on GitHub (Apr 29, 2026):

Thanks for your help @Schnookeuz and @AstralDestiny

@oschwartz10612 commented on GitHub (Apr 29, 2026): Thanks for your help @Schnookeuz and @AstralDestiny

GiteaMirror commented

2026-06-15 09:45:40 -05:00

@AstralDestiny commented on GitHub (Apr 29, 2026):

Or maybe is it because we're both using p384 over RSA4096?

@AstralDestiny commented on GitHub (Apr 29, 2026): Or maybe is it because we're both using p384 over RSA4096?

GiteaMirror commented

2026-06-15 09:45:40 -05:00

@Schnookeuz commented on GitHub (Apr 29, 2026):

Oh, interesting.

I created a new private ressource to check if they are also affected. Here the certificate stays on "Pending"

Logs:

pangolin  | 2026-04-29T23:25:27+00:00 [warn]: No valid certificate found for SSL site resource 4 with domain speedtester.obfuscated.de
pangolin  | 2026-04-29T23:25:27+00:00 [info]: Created site resource 4 for org zorg
pangolin  | 2026-04-29T23:26:15+00:00 [info]: Checking Docker socket for site 3 with Newt b8nifb5ex1sx15p
pangolin  | 2026-04-29T23:26:15+00:00 [info]: Checking Docker socket for site 2 with Newt f8sr7mehn6i06al
pangolin  | 2026-04-29T23:26:15+00:00 [info]: Checking Docker socket for site 4 with Newt yjj3ns0ihszfyi4
pangolin  | 2026-04-29T23:26:15+00:00 [info]: Checking Docker socket for site 6 with Newt uux5x7ogi0ux56l
pangolin  | 2026-04-29T23:26:15+00:00 [info]: Triggering fetch containers for site 3 with Newt b8nifb5ex1sx15p
pangolin  | 2026-04-29T23:26:15+00:00 [info]: Triggering fetch containers for site 2 with Newt f8sr7mehn6i06al
pangolin  | 2026-04-29T23:26:48+00:00 [info]: Certificate already exists for domain speedpublic.obfuscated.de

Then i also created a new public ressource. In that moment ALL public ressources switched to the status "Pending"

Nothing to mention in the logs of pangolin or traefik for the public ressource.

@Schnookeuz commented on GitHub (Apr 29, 2026): Oh, interesting. I created a new private ressource to check if they are also affected. Here the certificate stays on "Pending" <img width="1058" height="152" alt="Image" src="https://github.com/user-attachments/assets/e9e75b3b-c4f9-4a8d-8237-615305fb1edf" /> Logs: ``` pangolin | 2026-04-29T23:25:27+00:00 [warn]: No valid certificate found for SSL site resource 4 with domain speedtester.obfuscated.de pangolin | 2026-04-29T23:25:27+00:00 [info]: Created site resource 4 for org zorg pangolin | 2026-04-29T23:26:15+00:00 [info]: Checking Docker socket for site 3 with Newt b8nifb5ex1sx15p pangolin | 2026-04-29T23:26:15+00:00 [info]: Checking Docker socket for site 2 with Newt f8sr7mehn6i06al pangolin | 2026-04-29T23:26:15+00:00 [info]: Checking Docker socket for site 4 with Newt yjj3ns0ihszfyi4 pangolin | 2026-04-29T23:26:15+00:00 [info]: Checking Docker socket for site 6 with Newt uux5x7ogi0ux56l pangolin | 2026-04-29T23:26:15+00:00 [info]: Triggering fetch containers for site 3 with Newt b8nifb5ex1sx15p pangolin | 2026-04-29T23:26:15+00:00 [info]: Triggering fetch containers for site 2 with Newt f8sr7mehn6i06al pangolin | 2026-04-29T23:26:48+00:00 [info]: Certificate already exists for domain speedpublic.obfuscated.de ``` Then i also created a new public ressource. In that moment ALL public ressources switched to the status "Pending" <img width="1110" height="688" alt="Image" src="https://github.com/user-attachments/assets/e6470c90-36b5-4219-b53e-9972be9c6aed" /> Nothing to mention in the logs of pangolin or traefik for the public ressource.

GiteaMirror commented

2026-06-15 09:45:41 -05:00

@oschwartz10612 commented on GitHub (Apr 29, 2026):

Okay I think I know whats happening here. In 1.18.0 we were not detecting the sans field in the acme.json. We are detecting it now in the 1.18.1 update. But because you had already inserted domains from the previous update and the cert has not changed it is not updating the database to reflect the now detected wildcard option. There was another issue with the 1.18.1 we are patching over it. I will let you know when you can pull and try again.

It is triggering pending because it thinks you dont already have a cert saved in the database that matches.

You can resolve this probably by running:

sqlite3 config/db/db.sqlite
> delete from certificates;

@oschwartz10612 commented on GitHub (Apr 29, 2026): Okay I think I know whats happening here. In 1.18.0 we were not detecting the sans field in the acme.json. We are detecting it now in the 1.18.1 update. But because you had already inserted domains from the previous update and the cert has not changed it is not updating the database to reflect the now detected wildcard option. There was another issue with the 1.18.1 we are patching over it. I will let you know when you can pull and try again. It is triggering pending because it thinks you dont already have a cert saved in the database that matches. You can resolve this probably by running: ``` sqlite3 config/db/db.sqlite > delete from certificates; ```

GiteaMirror commented

2026-06-15 09:45:41 -05:00

@Schnookeuz commented on GitHub (Apr 29, 2026):

Yep, that fixed it!

sqlite> select domain,domainId,wildcard,status from certificates;
obfuscated.de|domain1|1|valid

@Schnookeuz commented on GitHub (Apr 29, 2026): Yep, that fixed it! ``` sqlite> select domain,domainId,wildcard,status from certificates; obfuscated.de|domain1|1|valid ``` <img width="1105" height="665" alt="Image" src="https://github.com/user-attachments/assets/ed1f6919-bf3b-45a1-a6cd-b31d7791fb52" /> <img width="1065" height="149" alt="Image" src="https://github.com/user-attachments/assets/fed71fd5-2b9f-4ddb-8162-c8b54132ee66" />

GiteaMirror commented

2026-06-15 09:45:42 -05:00

@oschwartz10612 commented on GitHub (Apr 29, 2026):

Okay great thanks for confirming and helping to pin down the issue! A patch for 1.18.1 is going out now so I will mark this as resolved.

@oschwartz10612 commented on GitHub (Apr 29, 2026): Okay great thanks for confirming and helping to pin down the issue! A patch for 1.18.1 is going out now so I will mark this as resolved.

Sign in to join this conversation.

Branches Tags

main

dependabot/docker/docker-dependencies-4faa477378

dependabot/npm_and_yarn/body-parser-2.3.0

refactor/batch-status-requests

dependabot/npm_and_yarn/npm-dependencies-8b2d4a9f3a

dependabot/go_modules/install/go-install-dependencies-3804ca7238

dev

dependabot/npm_and_yarn/axios-1.18.0

crowdin_dev

fix/labels-dropdown-flicker

dependabot/github_actions/github-actions-dependencies-2ee11778c9

feat/remember-last-idp-on-smart-login-form

dependabot/npm_and_yarn/multi-5f1280885e

fix/non-semver-version-error

private-resource-page

resource-launcher

backhaul

exit-node-reconnect

feat/command-palette

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#32336