mirror of
https://github.com/fosrl/pangolin.git
synced 2026-05-08 05:39:49 -05:00
SSL not working anymore / invalid certificate #752
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/pangolin#752
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @gilluc on GitHub (Nov 1, 2025).
Describe the Bug
since last week i guess, SSL on new containers give me an error in the browser.
Old containers work well.
attached 2 images
Environment
To Reproduce
create a new stack on portainer, like readeck and deploy
version: "3.3"
services:
readeck:
container_name: readeck
image: codeberg.org/readeck/readeck:latest
ports:
- 8280:8000
volumes:
- readeck-data:/readeck
restart: always
volumes:
readeck-data:
then declare a ressource in pangolin, like readeck.mydomain.tld
connect to it with your browser...
Expected Behavior
expected to go to the readeck screen to create a new (first) user
browser says "invalid certificate" error
@gilluc commented on GitHub (Nov 1, 2025):
is it possible that it has something to do with iptables rules i added in DOCKER-USER to prevent connections from "all the world" ??
@hhftechnology commented on GitHub (Nov 1, 2025):
yes that the issue. revert is to root or the previous user
@gilluc commented on GitHub (Nov 2, 2025):
I deleted the DROP line in iptables but still doesn't work.
how to force certificate renewal ?
@AstralDestiny commented on GitHub (Nov 3, 2025):
It'll happen automatically.
@gilluc commented on GitHub (Nov 3, 2025):
yes it works now BUT it does'nt fix the need of a DROP line in iptables.
has anyone any tip for that ?
which IP addresses should I accept or anything else to protect my homelab AND let certificates renewal ??
@AstralDestiny commented on GitHub (Nov 4, 2025):
I'd always suggest dns validation as it doesn't require port 80 to be open. Or any ports for that matter just need to be able to make an api call out to LE and then your DNS provider.
https://docs.fossorial.io/Pangolin/Configuration/wildcard-certs
https://go-acme.github.io/lego/dns/
Oop forgot to mention DNS validation grants you wildcards.. and it also is less information disclosure in the end. as https://crt.sh exists and no you can't opt out of having your certs being listed but you can limit how much is shown.