Unable to perform an HTTP Let's Encrypt certificate request behind Pangolin reverse proxy #1702

New Issue

MrUnknownDE · 2026-04-05T19:39:49+02:00

MrUnknownDE commented

2026-04-05 19:39:49 +02:00

Originally created by @q20 on 3/17/2025

Good day!

I have a Home Assistant installation which requires a local certificate for secure MQTT. Rather than self-sign, I have previously used the Let's Encrypt addon with DNS/API request to cloudflare, allowing me to deploy any certificate of my choosing.

Now, however, I have opted to deploy Pangolin as reverse proxy, negating the need to store those API credentials in plain text on the HA installation, as Pangolin correctly registers a valid cert for its reverse proxy, ha.example.com. This reverse proxy works via Pangolin exactly as expected.

Local MQTT is still an issue, though. When attempting an HTTP certificate request for the same FQDN, ha.example.com, the request errors with the following:

[10:36:18] INFO: Selected http verification
[10:36:18] INFO: Detecting existing certificate type for ha.example.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for ha.example.com
Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems:
  Domain: ha.example.com
  Type:   unauthorized
  Detail: x.x.x.x: Invalid response from http://ha.example.com/.well-known/acme-challenge/xhkbMb_wLRna08hjE0cdcm0jC0fdHK8KIVGHfTp1akI: 404
Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet.
Some challenges have failed.

Let's just assume that it's absolutely necessary Home Assistant is able to deploy its own, managed, Let's Encrypt cert before workarounds are suggested. 😜

I have a hunch this is not working because Pangolin upgrades all requests to HTTPS, so the HTTP challenge, on port 80, fails. But that's just my gut feeling. When I disable SSL for this resource in Pangolin, Let's Encrypt fails with the same error.

Any ideas? How can Pangolin resources successfully request their own certificates?

*Originally created by @q20 on 3/17/2025* Good day! I have a Home Assistant installation which requires a local certificate for secure MQTT. Rather than self-sign, I have previously used the Let's Encrypt addon with DNS/API request to cloudflare, allowing me to deploy any certificate of my choosing. Now, however, I have opted to deploy Pangolin as reverse proxy, negating the need to store those API credentials in plain text on the HA installation, as Pangolin correctly registers a valid cert for its reverse proxy, `ha.example.com`. This reverse proxy works via Pangolin exactly as expected. Local MQTT is still an issue, though. When attempting an HTTP certificate request for the same FQDN, `ha.example.com`, the request errors with the following: ``` [10:36:18] INFO: Selected http verification [10:36:18] INFO: Detecting existing certificate type for ha.example.com Saving debug log to /var/log/letsencrypt/letsencrypt.log Saving debug log to /var/log/letsencrypt/letsencrypt.log Requesting a certificate for ha.example.com Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems: Domain: ha.example.com Type: unauthorized Detail: x.x.x.x: Invalid response from http://ha.example.com/.well-known/acme-challenge/xhkbMb_wLRna08hjE0cdcm0jC0fdHK8KIVGHfTp1akI: 404 Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet. Some challenges have failed. ``` Let's just assume that it's absolutely necessary Home Assistant is able to deploy its own, managed, Let's Encrypt cert before workarounds are suggested. 😜 I have a hunch this is not working because Pangolin upgrades all requests to HTTPS, so the HTTP challenge, on port 80, fails. But that's just my gut feeling. When I disable SSL for this resource in Pangolin, Let's Encrypt fails with the same error. Any ideas? How can Pangolin resources successfully request their own certificates?

MrUnknownDE closed this issue

2026-04-05 19:39:49 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1702