Certificate renewal not working

[q-wertz]

Hi,

maybe someone has a hint or the same problem:

OS: Ubuntu 24.04
WikiJS: 2.5.314
Node: 22.23.1 (installed as snap package)

Installed according to https://docs.requarks.io/install/linux

Currently (after some days offline) our WikiJS instance does not start due to a failed certificate renewal and I didn't manage to find out the issue.

Log

2026-08-31T08:38:06.791Z [MASTER] info: =======================================
2026-08-31T08:38:06.794Z [MASTER] info: = Wiki.js 2.5.314 =====================
2026-08-31T08:38:06.794Z [MASTER] info: =======================================
2026-08-31T08:38:06.794Z [MASTER] info: Initializing...
2026-08-31T08:38:07.547Z [MASTER] info: Using database driver pg for postgres [ OK ]
2026-08-31T08:38:07.551Z [MASTER] info: Connecting to database...
(node:2718) [DEP0174] DeprecationWarning: Calling promisify on a function that returns a Promise is likely a mistake.
(Use `node --trace-deprecation ...` to show where the warning was created)
2026-08-31T08:38:07.599Z [MASTER] info: Database Connection Successful [ OK ]
2026-08-31T08:38:08.529Z [MASTER] info: Loading GraphQL Schema...
2026-08-31T08:38:09.754Z [MASTER] info: GraphQL Schema: [ OK ]
2026-08-31T08:38:10.189Z [MASTER] info: HTTP Server on port: [ 80 ]
2026-08-31T08:38:10.233Z [MASTER] info: (LETSENCRYPT) Certificate is about to or has expired, requesting a new one...
2026-08-31T08:38:10.234Z [MASTER] info: (LETSENCRYPT) Initializing Let's Encrypt client...
2026-08-31T08:38:10.252Z [MASTER] info: HTTP Server: [ RUNNING ]
(node:2718) [DEP0174] DeprecationWarning: Calling promisify on a function that returns a Promise is likely a mistake.
(node:2718) [DEP0174] DeprecationWarning: Calling promisify on a function that returns a Promise is likely a mistake.
(node:2718) [DEP0174] DeprecationWarning: Calling promisify on a function that returns a Promise is likely a mistake.
(node:2718) [DEP0174] DeprecationWarning: Calling promisify on a function that returns a Promise is likely a mistake.
2026-08-31T08:38:10.669Z [MASTER] info: (LETSENCRYPT) Generating certificate signing request (CSR)...
2026-08-31T08:38:10.678Z [MASTER] info: (LETSENCRYPT) CSR generated successfully [ OK ]
2026-08-31T08:38:10.678Z [MASTER] info: (LETSENCRYPT) Requesting certificate from Let's Encrypt...
2026-08-31T08:38:10.682Z [MASTER] info: (LETSENCRYPT) Setting HTTP challenge for wiki.someurl.fun: [ READY ]
2026-08-31T08:38:10.683Z [MASTER] info: (LETSENCRYPT) Waiting for challenge to complete...
2026-08-31T08:38:15.696Z [MASTER] info: (LETSENCRYPT) Received valid challenge request. [ ACCEPTED ]
2026-08-31T08:38:15.698Z [MASTER] info: (LETSENCRYPT) Removing HTTP challenge: [ OK ]
2026-08-31T08:38:15.699Z [MASTER] debug: certificate_order: {"account":{"key":{"kid":"https://acme-v02.api.letsencrypt.org/acme/acct/accno"}},"subject":"wiki.someurl.fun","altnames":["wiki.someurl.fun"],"challengeTypes":["http-01"]}
2026-08-31T08:38:16.782Z [MASTER] debug: challenge_select: {"altname":"wiki.someurl.fun","type":"http-01","keyAuthorization":"part1.part2"}
2026-08-31T08:38:16.782Z [MASTER] debug: _challenge_select: {"altname":"wiki.someurl.fun","type":"http-01","challenge":{"identifier":{"type":"dns","value":"wiki.someurl.fun"},"status":"pending","expires":"2026-09-07T08:38:16Z","challenges":[{"type":"tls-alpn-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/accno/770274375165/sgAXmA","status":"pending","token":"part1"},{"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/accno/770274375165/zC8tIA","status":"pending","token":"part1"},{"type":"http-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/accno/770274375165/LJ81Ig","status":"pending","token":"part1"}],"type":"http-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/accno/770274375165/LJ81Ig","token":"part1","hostname":"wiki.someurl.fun","altname":"wiki.someurl.fun","thumbprint":"part2","keyAuthorization":"part1.part2","challengeUrl":"http://wiki.someurl.fun/.well-known/acme-challenge/part1"}}
2026-08-31T08:38:16.782Z [MASTER] info: (LETSENCRYPT) Setting HTTP challenge for wiki.someurl.fun: [ READY ]
2026-08-31T08:38:16.782Z [MASTER] info: (LETSENCRYPT) Waiting for challenge to complete...
2026-08-31T08:38:21.789Z [MASTER] info: (LETSENCRYPT) Received valid challenge request. [ ACCEPTED ]
2026-08-31T08:38:22.248Z [MASTER] debug: challenge_status: {"status":"pending","type":"http-01","altname":"wiki.someurl.fun"}
2026-08-31T08:38:23.288Z [MASTER] info: (LETSENCRYPT) Received valid challenge request. [ ACCEPTED ]
2026-08-31T08:38:23.403Z [MASTER] debug: challenge_status: {"status":409,"type":"http-01","altname":"wiki.someurl.fun"}
2026-08-31T08:38:23.403Z [MASTER] info: (LETSENCRYPT) Removing HTTP challenge: [ OK ]
2026-08-31T08:38:23.404Z [MASTER] warn: (LETSENCRYPT) Error: [ACME.js] (E_STATE_UKN) challenge state for 'wiki.someurl.fun': '409'
2026-08-31T08:38:23.404Z [MASTER] error: [ACME.js] (E_STATE_UKN) challenge state for 'wiki.someurl.fun': '409'

ssl part of `config.yml`

ssl:
  enabled: true
  port: 443

  # Provider to use, possible values: custom, letsencrypt
  provider: letsencrypt

  # ++++++ For custom only ++++++
  # Certificate format, either 'pem' or 'pfx':
  # format: pem
  # Using PEM format:
  # key: path/to/key.pem
  # cert: path/to/cert.pem
  # Using PFX format:
  # pfx: path/to/cert.pfx
  # Passphrase when using encrypted PEM / PFX keys (default: null):
  # passphrase: null
  # Diffie Hellman parameters, with key length being greater or equal
  # to 1024 bits (default: null):
  # dhparam: null

  # ++++++ For letsencrypt only ++++++
  domain: wiki.someurl.fun
  subscriberEmail: server@someurl.fun

Tested/considering:

• I ran certbot and it was able to get a certificate (so I assume no network/port issues)
• I do not understand, why there are also dns-01 challenges performed (or multiple in general)
• As far as I understand (not a JS developer) the issue happens somewhere here

  wiki/server/core/letsencrypt.js

  Lines 90 to 122 in 6f042e9

  	WIKI.logger.info(`(LETSENCRYPT) Requesting certificate from Let's Encrypt...`)
  	const certResp = await this.acme.certificates.create({
  	account: WIKI.config.letsencrypt.account,
  	accountKey: WIKI.config.letsencrypt.accountKeypair.private,
  	csr,
  	domains,
  	challenges: {
  	'http-01': {
  	init () {},
  	set (data) {
  	WIKI.logger.info(`(LETSENCRYPT) Setting HTTP challenge for ${data.challenge.hostname}: [ READY ]`)
  	WIKI.config.letsencrypt.challenge = data.challenge
  	WIKI.logger.info(`(LETSENCRYPT) Waiting for challenge to complete...`)
  	return null // <- this is needed, cannot be undefined
  	},
  	get (data) {
  	return WIKI.config.letsencrypt.challenge
  	},
  	async remove (data) {
  	WIKI.logger.info(`(LETSENCRYPT) Removing HTTP challenge: [ OK ]`)
  	WIKI.config.letsencrypt.challenge = null
  	return null // <- this is needed, cannot be undefined
  	}
  	}
  	}
  	})
  	WIKI.logger.info(`(LETSENCRYPT) New certificate received successfully: [ COMPLETED ]`)
  	WIKI.config.letsencrypt.payload = certResp
  	WIKI.config.letsencrypt.domain = WIKI.config.ssl.domain
  	await WIKI.configSvc.saveToDb(['letsencrypt'])
  	} catch (err) {
  	WIKI.logger.warn(`(LETSENCRYPT) ${err}`)
  	throw err

• Could it be, that the Letsencryp spec changed and the acme lib is outdated?
  (I also did not get why yarn, from which I assume the package is downloaded, lists v3.0.3 as latest but the yarn.lock
  

  wiki/yarn.lock

  Lines 3495 to 3504 in 6f042e9

  	"@root/acme@^3.0.2":
  	version "3.0.9"
  	resolved "https://registry.yarnpkg.com/@root/acme/-/acme-3.0.9.tgz#437f4b46015e70587fb50119807889c944370388"
  	integrity sha512-/FgJF6RUrkqNpLmxqjktHaWMsLOwma6D+e4EBoxKtTjTAI+dBqW8Z8cH38feUsiIBR5LimPeYmBo/oqU3oMkKQ==
  	dependencies:
  	"@root/encoding" "^1.0.1"
  	"@root/keypairs" "^0.9.0"
  	"@root/pem" "^1.0.4"
  	"@root/request" "^1.3.11"
  	"@root/x509" "^0.7.2"

  
  resolves to 3.0.9 😅 )

[NGPixel]

I would suggest using your own reverse proxy (e.g. nginx) in front of Wiki.js to handle SSL certs, rather than Wiki.js.

[q-wertz]

Thanks, already considering the switch.

Can this feature be considered broken, or is it just me doing something wrong in my configuration? 😅
Just curious, because nobody else reported that problem (yet).