3.0.147: Initial LetsEncrypt cert worked. Can't refresh it though.

[quarky42]

No matter what I did, I couldn't get a backup to restore in the previous version. So, yet again, I setup UISP from scratch with 14 devices.

I brought it down, made a backup, and brought it backup.

Now the cert that is loaded is expired in March. No idea why.

This is the error I get when click Refresh Certificate button.

Last refresh of SSL certificate had failed.

Timestamp: Today at 22:33
Error: Missing command line flag or config entry for this setting:
Please choose an account
Choices: ['uisp.<my-site-redacted>.com@2025-03-24T07:16:52Z (511f)', 'uisp.<mysite>.com@2025-11-16T01:55:43Z (d403)']
Failed to generate or update Let's Encrypt certificate.

Seeing how this is a fresh install, not sure what I did that caused this. Did some troubkleshooting and figured out that there were 2 accounts in: config/cert/accounts/acme-v02.api.letsencrypt.org/directory/ and there should only be one.

The one that was in there had files dated from March 2025 called 511fd96eb70221fff948b1a1a3ef1ea3. After removing the old directory and restarting uisp, I was able to run the Refresh Certificate successfully. Is this 511fd96eb70221fff948b1a1a3ef1ea3 account directory something that is coming from the original docker image? Seeing the date on it, maybe that directory should be removed on the docker hub image?

[quarky42]

Nope. 511fd96eb70221fff948b1a1a3ef1ea3 was not present in my backup file. That directory had to have been created on the next boot of uisp.

So that's weird... it doesn't appear to be part of the default image, but it shows up on a reboot? That stinks.

[chicheng]

caused by missing /etc/ssl/certs/ca-certificates.crt

apk update
apk add --no-check-certificate ca-certificates
update-ca-certificates

won't fix it due to 0 size /etc/ssl/certs/ca-certificates.crt generated

what works for me:

ln -sf /usr/share/ca-certificates/mozilla/* /etc/ssl/certs/
cat /usr/share/ca-certificates/mozilla/*.crt > /etc/ssl/certs/ca-certificates.crt
# following maybe not needed
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt

[Nico640]

I just checked and /etc/ssl/certs/ca-certificates.crt does exist in the image, at least on amd64. What system are you running the container on? ARM? I also tested the commands in the first code block and it seemed to correctly generate the ca-certificates.crt file for me (size was not 0).

[chicheng]

@Nico640 Thanks for the reply. I'm not sure why /etc/ssl/certs/ca-certificates.crt became 0 size later in the container, maybe an issue with Synology container manager, I'll keep you posted if I find out more.