[GH-ISSUE #1570] Let's Encrypt DST Root CA X3 Expiration fix for DNS Challenge #1183

Closed
opened 2026-02-26 06:36:07 +03:00 by kerem · 0 comments
Owner

Originally created by @binsentsu on GitHub (Nov 6, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1570

Checklist

  • Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
    • Yes / No
  • Are you sure you're not using someone else's docker image?
    • Yes / No
  • Have you searched for similar issues (both open and closed)?
    • Yes / No

Describe the bug

Within issue #1459 a fix was created for the http-challenge only. The DNS challenge command does not use the --config parameter which references the letsencrypt.ini file. I can confirm that adding the --preferred-chain = "ISRG Root X1" directly within the requestLetsEncryptSslWithDnsChallenge method does the trick. Don't know if the same directive would be necessary for the renew command though.

Nginx Proxy Manager Version

2.9.11

To Reproduce

Expected behavior

Screenshots

Operating System

Additional context

Originally created by @binsentsu on GitHub (Nov 6, 2021). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1570 <!-- Are you in the right place? - If you are looking for support on how to get your upstream server forwarding, please consider asking the community on Reddit. - If you are writing code changes to contribute and need to ask about the internals of the software, Gitter is the best place to ask. - If you think you found a bug with NPM (not Nginx, or your upstream server or MySql) then you are in the *right place.* --> **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - **Yes** / No - Are you sure you're not using someone else's docker image? - **Yes** / No - Have you searched for similar issues (both open and closed)? - **Yes** / No **Describe the bug** <!-- A clear and concise description of what the bug is. --> Within issue #1459 a fix was created for the http-challenge only. The DNS challenge command does not use the --config parameter which references the letsencrypt.ini file. I can confirm that adding the `--preferred-chain = "ISRG Root X1"` directly within the requestLetsEncryptSslWithDnsChallenge method does the trick. Don't know if the same directive would be necessary for the renew command though. **Nginx Proxy Manager Version** <!-- What version of Nginx Proxy Manager is reported on the login page? --> 2.9.11 **To Reproduce** **Expected behavior** <!-- A clear and concise description of what you expected to happen. --> **Screenshots** <!-- If applicable, add screenshots to help explain your problem. --> **Operating System** <!-- Please specify if using a Rpi, Mac, orchestration tool or any other setups that might affect the reproduction of this error. --> **Additional context** <!-- Add any other context about the problem here, docker version, browser version, logs if applicable to the problem. Too much info is better than too little. -->
kerem 2026-02-26 06:36:07 +03:00
  • closed this issue
  • added the
    bug
    label
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/nginx-proxy-manager-NginxProxyManager#1183
No description provided.