ngx_http_acme_module

Projects NGINX
, ,
1

My issue: Never received a certificate from Let’s Encrypt

How I encountered the problem: I never receive a certificate

Solutions I’ve tried: NGINX as container and Bare Metal and both with different configs (based on the official example)

Version of NGINX or NGINX adjacent software (e.g. NGINX Gateway Fabric): nginx:1.31.6-alpine

Deployment environment: Podman

Minimal NGINX config to reproduce your issue

load_module modules/ngx_http_acme_module.so;

events {}

http {
  resolver 9.9.9.9;

  server_tokens off;

  acme_issuer letsencrypt_acme {
    uri https://acme-v02.api.letsencrypt.org/directory;
    state_path /var/lib/nginx/acme-letsencrypt;
    accept_terms_of_service;
  }

  acme_shared_zone zone=ngx_acme_shared:1M;

  server {
    listen 80;

    location / {
      return 404;
    }
  }

  server {
    listen 443 ssl;

    server_name ipv4.xxxx.de;

    acme_certificate letsencrypt_acme;

    ssl_certificate       $acme_certificate;
    ssl_certificate_key   $acme_certificate_key;

    ssl_certificate_cache max=2;

    return 200 $remote_addr;

  }

}

podman run -p 80:80 -p 443:443 -v ./nginx.conf:/etc/nginx/nginx.conf:ro,Z -v acme-data:/var/lib/nginx/acme-letsencrypt docker.io/nginx:1.31.6-alpine

NGINX access/error log: (Tip → You can usually find the logs in the /var/log/nginx directory.)
2026/09/21 21:04:38 [error] 25#25: *17 cannot load certificate “/etc/nginx/”: PEM_read_bio_X509_AUX() failed (SSL: error:0480006C:PEM routines::no start line:Expecting: TRUSTED CERTIFICATE) while SSL handshaking, client: xx.xxx.xxx.xxx, server: 0.0.0.0:443

2

Hi there,

I don’t have a directly-useful answer here; but no-one else has replied yet, so maybe these suggestions will let you push forward with testing things?

Can you try running nginx with extra logging enabled? “error_log” with debug should show a lot of information; but even info might be enough to point at the first problem.

Is the in-container /var/lib/nginx/acme-letsencrypt directory (or the out-of-container acme-data directory) writable by the in-container user that the nginx process is running as?

Can you tcpdump-or-otherwise to see if there is any traffic involving port 443 of acme-v02.api.letsencrypt.org?

The error message you show suggests that the variable $acme_certificate does not have a value at the time it was used; that is “possibly normal” on first run, but should presumably become fixed after the acme challenge completes. Presumably, in your system, it does not complete.

If you can show the logs of what does happen, maybe that will help someone see what it the first thing that should happen but that does not.

Cheers,