MIAB unable to renew certificates after an Ubuntu update

Maintenance
1

Hello,

After doing some updates on my box as usual, it fails at renewing certificates, here is the trace I get :

Traceback (most recent call last): File "/usr/lib/python3/dist-packages/requests_toolbelt/_compat.py", line 48, in <module> from requests.packages.urllib3.contrib import appengine as gaecontrib ImportError: cannot import name 'appengine' from 'requests.packages.urllib3.contrib' (/usr/local/lib/python3.10/dist-packages/urllib3/contrib/__init__.py) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/bin/certbot", line 33, in <module> sys.exit(load_entry_point('certbot==1.21.0', 'console_scripts', 'certbot')()) File "/usr/bin/certbot", line 25, in importlib_load_entry_point return next(matches).load() File "/usr/lib/python3.10/importlib/metadata/__init__.py", line 171, in load module = import_module(match.group('module')) File "/usr/lib/python3.10/importlib/__init__.py", line 126, in import_module return _bootstrap._gcd_import(name[level:], package, level) File "<frozen importlib._bootstrap>", line 1050, in _gcd_import File "<frozen importlib._bootstrap>", line 1027, in _find_and_load File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked File "<frozen importlib._bootstrap>", line 688, in _load_unlocked File "<frozen importlib._bootstrap_external>", line 883, in exec_module File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed File "/usr/lib/python3/dist-packages/certbot/main.py", line 2, in <module> from certbot._internal import main as internal_main File "/usr/lib/python3/dist-packages/certbot/_internal/main.py", line 28, in <module> from certbot._internal import account File "/usr/lib/python3/dist-packages/certbot/_internal/account.py", line 19, in <module> from acme.client import ClientBase # pylint: disable=unused-import File "/usr/lib/python3/dist-packages/acme/client.py", line 34, in <module> from requests_toolbelt.adapters.source import SourceAddressAdapter File "/usr/lib/python3/dist-packages/requests_toolbelt/__init__.py", line 12, in <module> from .adapters import SSLAdapter, SourceAddressAdapter File "/usr/lib/python3/dist-packages/requests_toolbelt/adapters/__init__.py", line 12, in <module> from .ssl import SSLAdapter File "/usr/lib/python3/dist-packages/requests_toolbelt/adapters/ssl.py", line 16, in <module> from .._compat import poolmanager File "/usr/lib/python3/dist-packages/requests_toolbelt/_compat.py", line 50, in <module> from urllib3.contrib import appengine as gaecontrib ImportError: cannot import name 'appengine' from 'urllib3.contrib' (/usr/local/lib/python3.10/dist-packages/urllib3/contrib/__init__.py)

Just in case, I relauched the MIAB installer, but it did not fix anything. Reading the trace it seems to be caused by either the requests package or urllib3, I tried searching around but didn’t find anything recent.

On the MIAB console, I don’t see any unusual check failing (the failed one are because some of my domains are externaly hosted).

Did anyone else got a similar issue ? I only have one domain expiring in 10 days and it’s not used, the other one still have 58 days left so nothing that need to be fixed this instant.

Thank you and have a nice weekend :slight_smile:

2

Can you run the certbot command at all? E.g. certbot --version?
When did you run the mailinabox setup last before this issue occurred?

3

certbot --version throw the same trace so it seems to be a certbot related issue, I tried uninstalling it, doing an autoremove and a reinstall and the issue persist, I’m gonna dig a bit to see if anyone else had issue with certbot.

Last time I launched the mailboxsetup before I encountered the issue seems to be on the 17th of July (Based on my alerts, I don’t really keep track on when I launch the installer to be honest)

4

Well, following this post : community.letsencrypt(dot)org/t/certbot-error-cannot-import-name-appengine/235887

I removed certbot installed by apt and installed the snap one, it fixed the issue for now, but I guess that when I will run the MIAB installer next time, it will install certbot from the apt repo again and it will be back to square one.

5

I think like the problem is not MIAB itself but a Python package conflict. The error suggests Certbot is loading urllib3 from /usr/local/lib/python3.10 instead of Ubuntu’s packaged version in /usr/lib, which usually happens after installing packages with pip. check whether you have a user-installed urllib3 or requests_toolbelt overriding the system packages (pip3 show urllib3 requests_toolbelt). If so, removing those and reinstalling the Ubuntu packages often fixes Certbot. You can also verify by running certbot --version and python3 -c "import urllib3; print(urllib3.__file__)" to see which copy is being used.

1 Like
6

Looks like the recent Ubuntu updates may have caused a compatibility issue with urllib3 and requests toolbelt. Hopefully there’s an easy fix for this. Thanks for sharing the details.