certbot-dns-cloudflare no longer installed

[mochman]

Starting with 2.6.0 and also on 2.6.1, I get an error on startup and any time I try to renew my let's encrypt certs.

[10/16/2020] [10:54:23 AM] [SSL      ] › ✖  error     Error: Command failed: /usr/bin/certbot renew --non-interactive --quiet --config "/etc/letsencrypt.ini" --preferred-challenges "dns,http" --disable-hook-validation  ,
Renewal configuration file /etc/letsencrypt/renewal/npm-3.conf (cert: npm-3) produced an unexpected error: 'Namespace' object has no attribute 'dns_cloudflare_credentials'. Skipping.,
Renewal configuration file /etc/letsencrypt/renewal/npm-4.conf (cert: npm-4) produced an unexpected error: 'Namespace' object has no attribute 'dns_cloudflare_credentials'. Skipping.,
Renewal configuration file /etc/letsencrypt/renewal/npm-5.conf (cert: npm-5) produced an unexpected error: 'Namespace' object has no attribute 'dns_cloudflare_credentials'. Skipping.,
0 renew failure(s), 3 parse failure(s),
    at ChildProcess.exithandler (child_process.js:308:12),
    at ChildProcess.emit (events.js:314:20),
    at maybeClose (internal/child_process.js:1051:16),
    at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5),

Running pip3 list | grep certbot in the docker image shows that only certbot is installed.
It looks like the certbot-dns-cloudflare module isn't installed.

I can run pip3 install certbot-dns-cloudflare in the docker image and the error goes away. I am now able to automatically & manually renew my certs.

Going through the diffs between 2.5.0 and 2.6.0, it looks like the this change to the Dockerfile is causing the problem.

I'm guessing that this is to handle the change to allow for multiple DNS providers.

---

For those that have the same problem, running docker exec -it PROXY_APP_NAME pip3 install certbot-dns-cloudflare should fix the issue.

[jc21]

@chaptergy is this related to #635 ?

[mochman]

Yeah, the change to the Dockerfile was made in that pull request.

I tried creating new certs in 2.6.1 using the new system, but I still got the same error as before (after a fresh docker pull). I'll look more through the new DNS challenge updates to see if it's just something strange on my end.

[mochman]

Alright, I think I got it figured out. The issue is in /backend/internal/certificate.js.
The function called requestLetsEncryptSslWithDnsChallenge will install the correct module based on what the user selects for their DNS provider. The issue is that function is only called on a new certificate creation, not on startup or renewal.
After a new cert is created, everything works normally through container restarts.

[chaptergy]

renewLetsEncryptSslWithDnsChallenge will also install the correct module. This means these is a second different renew function somewhere, which is not specific for a single certificate but renews all of them. I'll start looking for that.

[chaptergy]

Okay, the issue is in processExpiringHosts, where a non-certificate-specific renew is called and no plugins are installed prior. I'll get to fixing the issue. So as a workaround for now klicking on the three dots next to the certificate and then on "renew now" should work too.

[chaptergy]

Fixed by #664, can be closed @jc21