no resolver defined to resolve r3.o.lencr.org ...

[GuidoDr]

Hi everyone,

I do see a lot of warnings in our docker-compose nginx logs on our linux server.

nginx_1        | nginx.1     | 2022/02/26 15:19:01 [warn] 56#56: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/chat.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:19:01 [warn] 57#57: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/wekan.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:19:01 [warn] 58#58: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/wekan.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:19:01 [warn] 59#59: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/chat.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:19:01 [warn] 60#60: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/chat.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:20:18 [warn] 561#561: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/wolke.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:20:25 [warn] 565#565: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/piwik.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:20:47 [warn] 567#567: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/wolke.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:20:52 [warn] 560#560: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/chat.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:20:52 [warn] 562#562: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/chat.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:20:55 [warn] 561#561: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/chat.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:21:05 [warn] 560#560: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:21:51 [warn] 560#560: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/wolke.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:22:03 [warn] 562#562: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:23:15 [warn] 562#562: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/mail.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:23:16 [warn] 562#562: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/wiki.bewegung.jetzt.crt"
nginx_1        | nginx.1     | 2022/02/26 15:23:28 [warn] 562#562: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/etc/nginx/certs/wolke.bewegung.jetzt.crt"

I tried already a couple of things in order to get rid of these warnings but somehow I am not able to find the correct solution.
All containers are running fine, do have correct valid letsencrypt certificates, the certificates are reissued after 2 months and the containers are reachable from outside. So it is "just" that I cannot get rid of these warnings.
Our server is reachable on his IPv4 and IPv6 networks. IPv6 is also enabled in docker and the ufw does allow port 53 for udp and tcp.

This is how my /etc/docker/daemon.json does look like:

{
  "userland-proxy": false,
  "ipv6": true,
  "fixed-cidr-v6": "fd00:dead:beef:c0::/80",
  "experimental": true,
  "ip6tables": true,
  "dns": ["81.169.148.34","85.214.7.22","8.8.8.8","8.8.4.4"]
}

the /etc/resolv.conf inside the nginx-proxy container does have this content:

search stratoserver.net
nameserver 127.0.0.11
options ndots:0

I also modified the nginx.tmpl but still these warnings do appear:

#{{ if $.Env.RESOLVERS }}
#resolver {{ $.Env.RESOLVERS }};
#{{ end }}
resolver 8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844] valid=60s;

Am I missing something in my configurations?
Any help is appreciated.

best regards
Guido

[JanMalte]

I'm having a similar/related issue. The corresponding error log:

nginx-proxy    | nginx.1     | 2022/04/30 18:05:40 [crit] 63019#63019: connect() to [2a02:26f0:3500:e::1732:835c]:80 failed (99: Address not available) while requesting certificate status, responder: r3.o.lencr.org, peer: [2a02:26f0:3500:e::1732:835c]:80, certificate: "/etc/nginx/certs/gws-netzwerk.de.crt"

[olifur]

Setting RESOLVER environment variable solved the issue for me, see here

e.g.

docker run --detach \
    --name nginx-proxy \
    --publish 80:80 \
    --publish 443:443 \
    --volume certs:/etc/nginx/certs \
    --volume vhost:/etc/nginx/vhost.d \
    --volume html:/usr/share/nginx/html \
    --volume /var/run/docker.sock:/tmp/docker.sock:ro \
    --env "RESOLVERS=8.8.8.8" \
    --network=nginx-proxy \
    nginxproxy/nginx-proxy

[fliespl]

In my case it behaved really strange.

If I didn't set resolvers it didn't have internal ip set as pointed out here: #1256 (comment)

Once i added:

  nginx-proxy:
    image: nginxproxy/nginx-proxy
    container_name: nginx-proxy
    environment:
      RESOLVERS: "8.8.8.8 1.1.1.1"

Resolvers env it falled back to:

#     the http block, so it is always fully resolved for every request -- even
resolver 127.0.0.11;

[GuidoDr]

since I am working with the docker compose setup I solved the problem by adding the resolver to the environment part to the docker-compose.yml file. (I do have a dual mode docker setup with IPv4 and IPv6 active)

    environment:
      - ENABLE_IPV6=true
      - SHA1_UPSTREAM_NAME=true
      - TRUST_DOWNSTREAM_PROXY=false
      - RESOLVERS=8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844] valid=300s ipv6=on;