Troubleshoot排障

ARM64, DNS env, nginx mounts, WeChat errors, logs.ARM64、DNS 变量、nginx 挂载、小程序报错、日志。

ARM64 / Apple Silicon: Illegal instructionARM64 / Apple Silicon：Illegal instruction

ECC keygen can fail under x86 images on ARM hosts. v1.2.0 prefers RSA for compatibility. Force with:在 ARM 宿主机跑 x86 镜像时，ECC 生成密钥可能失败。v1.2.0 会倾向 RSA 以提高兼容性。也可强制：

$ docker exec -e ACME_KEY_TYPE=rsa acme-ssl-manager \
  /scripts/cert-manager.sh generate example.com

DNS API: missing DP_Id / Ali_KeyDNS API：提示缺少 DP_Id / Ali_Key

• Confirm dns_provider on the domain matches an ID in dns-providers.yml.确认域名上的 dns_provider 和 dns-providers.yml 里的 ID 一致。
• Confirm env_vars names are exactly what acme.sh expects (Ali_Key, DP_Id, …).确认 env_vars 名称正是 acme.sh 要求的（如 Ali_Key、DP_Id）。
• Remount/restart after editing YAML: config is volume-mounted.改完 YAML 后如未生效，重启容器；配置是卷挂载的。

Deployed but browser still shows old cert部署了但浏览器还是旧证书

• Check nginx is reading the mounted host path you wrote to.确认 nginx 读的是你写入的宿主机挂载路径。
• docker inspect the nginx container mounts.用 docker inspect 看 nginx 容器挂载。
• Confirm reload command actually ran.确认 reload 命令确实执行成功。

WeChat Mini Program certificate error微信小程序证书错误

$ docker exec acme-ssl-manager /scripts/cert-manager.sh verify-chains
$ echo | openssl s_client -servername 你的域名 -connect 你的域名:443 -showcerts 2>/dev/null \
  | grep -c 'BEGIN CERTIFICATE'

If count is 1, redeploy with fullchain and reload nginx.如果只有 1 段，用完整证书链重新部署并 reload nginx。

Origin renewed, CDN still old源站换了，CDN 还是旧证

• Same wildcard renew does not push to CDN consoles. Mark those hosts manual, download the pack, upload PEM, then curl -I the CDN hostname.泛域名续期不会自动推到 CDN 控制台。这些主机标 manual，下包装 PEM 上传，再用 curl -I 验 CDN 主机名。
• See Deploy · Pattern B and the monthly checklist.见证书部署 · 模式 B与每月换证。

Logs看日志

$ tail -f data/logs/cert-manager.log
$ tail -f data/logs/error.log
$ tail -f data/logs/cron.log
$ docker logs -f acme-ssl-manager