v0.108.0-b.81 Can't reload TLS certificate (Docker)

[xlionjuan]

Prerequisites

• I have checked the Wiki and Discussions and found no answer

• I have searched other issues and found no duplicates

• I want to report a bug and not ask a question or ask for help

• I have set up AdGuard Home correctly and configured clients to use it. (Use the Discussions for help with installing and configuring clients.)

Platform (OS and CPU architecture)

Linux, AMD64 (aka x86_64)

AMD64 also

Installation

Docker

Setup

On one machine

I have 3 machines, two AMD64, one ARM64

AdGuard Home version

v0.108.0-b.81

Desc.

Related #3962

I'm using Lego's container version to doing the renew cron job periodically.

sudo /usr/bin/docker run --rm -e CLOUDFLARE_DNS_API_TOKEN=blabla -v {SOMEWHERE}/adguard/cert:/cert:z goacme/lego -a --path "/cert" --email xx@xx.com --dns cloudflare -d "*.example.com" -d "example.com" renew --profile shortlived --dynamic --ari-wait-to-renew-duration 50m

This is the Docker compose:

The reason of I'm using tmpfs is because I want the statistic and querylog won't write to the disk.

Same problem exists on both ARM64 and AMD64.

I'll try to remove cap_drop and cap_add to one of the machine to test if this affect. (ChatGPT say it shouldn't related, but I have multiple machines running ADH through.)

services:
  app:
    container_name: adguard
    image: adguard/adguardhome:v0.108.0-b.81
    read_only: true
    tmpfs:
      - /opt/adguardhome/work
    volumes:
      - ./conf:/opt/adguardhome/conf
      #- ./work:/opt/adguardhome/work
      - ./work/data/filters:/opt/adguardhome/work/data/filters
      - ./work/data/sessions.db:/opt/adguardhome/work/data/sessions.db
      - ./cert/certificates:/certificates:ro
    network_mode: host
    restart: always
    healthcheck:
      disable: true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - CHOWN
      - DAC_OVERRIDE
      - SETGID
      - SETUID

[xlionjuan]

cc @EugeneOne1

B2y, will the reload action showing in the log?

Can it triggered by touch commend?(Traefik can doing this trick)

[EugeneOne1]

@xlionjuan, the reload action is logged at the debug level. However, as I mentioned in #3962 (comment), the first version with background certificate refresh support is v0.108.0-b.82, not v0.108.0-b.81, which you mentioned. Have you tried the latest beta?

[xlionjuan]

Oh sorry! I'll let you know the test results with right version.

[xlionjuan]

After used the right version, the #encryption page did show the new expiry date for the new certificate when renewed the certificate, but it is still responding old certificate to the browser, even I tried using different device to open the admin UI, the certificate is still the old one.

[EugeneOne1]

@xlionjuan Could you please set the log to verbose mode, capture it, and send it to devteam@adguard.com for inspection? Also, have you seen any errors related to certificate updates in the log?

[xlionjuan]

I got all the logs that contains tls_manager:

2026/02/11 16:44:17.931023 [info] tls_manager: using default ciphers

2026/02/11 16:44:17.932180 [info] tls_manager: parsing multiple pem certificates num=3

2026/02/11 16:44:17.932755 [info] tls_manager: verifying certificate chain: got an intermediate cert num=2

2026/02/11 16:52:12.286233 [info] tls_manager: certificate file is modified

2026/02/11 16:52:12.286456 [info] tls_manager: parsing multiple pem certificates num=3

2026/02/11 16:52:12.286496 [info] tls_manager: verifying certificate chain: got an intermediate cert num=2

2026/02/11 16:52:12.292927 [error] tls_manager: reloading err="validating certificate pair: certificate-key pair: tls: private key does not match public key"

2026/02/11 16:52:12.293031 [info] tls_manager: certificate file is modified

2026/02/11 16:52:12.293457 [info] tls_manager: parsing multiple pem certificates num=3

2026/02/11 16:52:12.293492 [info] tls_manager: verifying certificate chain: got an intermediate cert num=2

I guess we got the race condition, ADH reload the certificate "too quickly" so the private key and public key didn't match when ACME client overwriting.

  File: _.example.com.key
  Size: 227       	Blocks: 8          IO Block: 4096   regular file
Device: 179,2	Inode: 514714      Links: 1
Access: (0600/-rw-------)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-01-03 00:57:02.209372888 +0800
Modify: 2026-02-12 00:52:12.284417265 +0800
Change: 2026-02-12 00:52:12.284417265 +0800
 Birth: 2026-01-03 00:57:02.209372888 +0800

  File: _.example.com.crt
  Size: 4124      	Blocks: 16         IO Block: 4096   regular file
Device: 179,2	Inode: 514712      Links: 1
Access: (0600/-rw-------)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-01-03 00:57:02.209372888 +0800
Modify: 2026-02-12 00:52:12.280417245 +0800
Change: 2026-02-12 00:52:12.280417245 +0800
 Birth: 2026-01-03 00:57:02.209372888 +0800

[xlionjuan]

The stat for the crt and key file above is from RPi5 with DietPi and SDCard

---

I checked those 3 machines with same ACME client, LEGO, the Modify and Change for both files are identical

• Synology NAS with HDD
• Hetzner ARM64 VPS with SSD
• Hetzner AMD64 VPS with SSD