starred/nginx-proxy-manager-NginxProxyManager
1
0
Fork 0
mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 17:35:52 +03:00
Code Issues 937 Projects Releases 10 Packages Wiki Activity

[GH-ISSUE #2081] When adding a new (http:80) proxy I get a SSL error in the log #1498

New issue
Open
opened 2026-02-26 07:31:19 +03:00 by kerem · 11 comments
kerem commented 2026-02-26 07:31:19 +03:00
Owner
Copy link

Originally created by @jicho on GitHub (May 30, 2022).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2081

Checklist

  • Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
    • Yes
  • Are you sure you're not using someone else's docker image?
    • Yes
  • Have you searched for similar issues (both open and closed)?
    • Yes

Describe the bug
When I add a new proxy, without SSL, I get the following error in my docker console output:

today at 08:51:44[5/30/2022] [8:51:44 AM] [Express  ] › ⚠  warning   Command failed: /usr/sbin/nginx -t -g "error_log off;"
today at 08:51:44nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-1/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/npm-1/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
today at 08:51:44nginx: configuration file /etc/nginx/nginx.conf test failed

The fact that NPM can't find the fullchain.pem in the given folder (and the folder) is correct since this certificate isn't available anymore. I've deleted that certificate yesterday using the NPM GUI.

Nginx Proxy Manager Version
v2.9.18

To Reproduce
Steps I did before:

  1. Create a LE-certificate (wildcard)
  2. Add proxies
  3. Create a new LE-certificate (wildcard) with a new DNS provider
  4. Change the existing certificates for the proxies already created
  5. Delete the certificate from step 1

The result is that I now have /etc/letsencrypt/live/npm-2/* and /etc/letsencrypt/live/npm-1/ isn't on disk anymore

Steps to reproduce the behavior:

  1. Login to NPM
  2. Go tho Hosts
  3. Press Add Proxy Host
  4. Enter domain name
  5. Fill in the IP + port
  6. Press save
  7. On screen I get an Internal Error warning:
image

And on the docker CLI I get the error:

today at 09:04:55[5/30/2022] [9:04:55 AM] [Express  ] › ⚠  warning   Command failed: /usr/sbin/nginx -t -g "error_log off;"
today at 09:04:55nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-1/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/npm-1/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
today at 09:04:55nginx: configuration file /etc/nginx/nginx.conf test failed
today at 09:04:55

Expected behavior
I would expect that NPM created the proxy without any issues

Operating System

  • Synology NAS with the latest Docker software
  • Browser: Safari 15.5

Additional context
I'm using NPM in combination with SQLite.

A little addition... I just thought about restarting the container, when I do that I get the following in the logs:

today at 09:09:41❯ Enabling IPV6 in hosts: /etc/nginx/conf.d
today at 09:09:41  ❯ /etc/nginx/conf.d/include/assets.conf
today at 09:09:41  ❯ /etc/nginx/conf.d/include/block-exploits.conf
today at 09:09:41  ❯ /etc/nginx/conf.d/include/force-ssl.conf
today at 09:09:41  ❯ /etc/nginx/conf.d/include/ip_ranges.conf
today at 09:09:41  ❯ /etc/nginx/conf.d/include/letsencrypt-acme-challenge.conf
today at 09:09:41  ❯ /etc/nginx/conf.d/include/proxy.conf
today at 09:09:41  ❯ /etc/nginx/conf.d/include/ssl-ciphers.conf
today at 09:09:41  ❯ /etc/nginx/conf.d/include/resolvers.conf
today at 09:09:41  ❯ /etc/nginx/conf.d/default.conf
today at 09:09:41  ❯ /etc/nginx/conf.d/production.conf
today at 09:09:41❯ Enabling IPV6 in hosts: /data/nginx
today at 09:09:41  ❯ /data/nginx/default_host/site.conf
today at 09:09:41  ❯ /data/nginx/proxy_host/8.conf
today at 09:09:41  ❯ /data/nginx/proxy_host/4.conf
today at 09:09:41  ❯ /data/nginx/proxy_host/9.conf
today at 09:09:41  ❯ /data/nginx/proxy_host/6.conf
today at 09:09:41  ❯ /data/nginx/proxy_host/3.conf
today at 09:09:41  ❯ /data/nginx/proxy_host/5.conf
today at 09:09:41  ❯ /data/nginx/proxy_host/2.conf
today at 09:09:41  ❯ /data/nginx/redirection_host/1.conf
today at 09:09:41nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-1/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/npm-1/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
Originally created by @jicho on GitHub (May 30, 2022). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2081 **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes **Describe the bug** When I add a new proxy, without SSL, I get the following error in my docker console output: ``` today at 08:51:44[5/30/2022] [8:51:44 AM] [Express ] › ⚠ warning Command failed: /usr/sbin/nginx -t -g "error_log off;" today at 08:51:44nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-1/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/npm-1/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file) today at 08:51:44nginx: configuration file /etc/nginx/nginx.conf test failed ``` The fact that NPM can't find the fullchain.pem in the given folder (and the folder) is correct since this certificate isn't available anymore. I've deleted that certificate yesterday using the NPM GUI. **Nginx Proxy Manager Version** v2.9.18 **To Reproduce** Steps I did before: 1. Create a LE-certificate (wildcard) 2. Add proxies 3. Create a new LE-certificate (wildcard) with a new DNS provider 4. Change the existing certificates for the proxies already created 5. Delete the certificate from step 1 The result is that I now have `/etc/letsencrypt/live/npm-2/*` and `/etc/letsencrypt/live/npm-1/` isn't on disk anymore Steps to reproduce the behavior: 1. Login to NPM 2. Go tho Hosts 3. Press Add Proxy Host 4. Enter domain name 5. Fill in the IP + port 6. Press save 7. On screen I get an Internal Error warning: <img width="206" alt="image" src="https://user-images.githubusercontent.com/610740/170935925-8abbd303-d6ab-456b-8c04-4d85444e4026.png"> And on the docker CLI I get the error: ``` today at 09:04:55[5/30/2022] [9:04:55 AM] [Express ] › ⚠ warning Command failed: /usr/sbin/nginx -t -g "error_log off;" today at 09:04:55nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-1/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/npm-1/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file) today at 09:04:55nginx: configuration file /etc/nginx/nginx.conf test failed today at 09:04:55 ``` **Expected behavior** I would expect that NPM created the proxy without any issues **Operating System** * Synology NAS with the latest Docker software * Browser: Safari 15.5 **Additional context** I'm using NPM in combination with SQLite. A little addition... I just thought about restarting the container, when I do that I get the following in the logs: ``` today at 09:09:41❯ Enabling IPV6 in hosts: /etc/nginx/conf.d today at 09:09:41 ❯ /etc/nginx/conf.d/include/assets.conf today at 09:09:41 ❯ /etc/nginx/conf.d/include/block-exploits.conf today at 09:09:41 ❯ /etc/nginx/conf.d/include/force-ssl.conf today at 09:09:41 ❯ /etc/nginx/conf.d/include/ip_ranges.conf today at 09:09:41 ❯ /etc/nginx/conf.d/include/letsencrypt-acme-challenge.conf today at 09:09:41 ❯ /etc/nginx/conf.d/include/proxy.conf today at 09:09:41 ❯ /etc/nginx/conf.d/include/ssl-ciphers.conf today at 09:09:41 ❯ /etc/nginx/conf.d/include/resolvers.conf today at 09:09:41 ❯ /etc/nginx/conf.d/default.conf today at 09:09:41 ❯ /etc/nginx/conf.d/production.conf today at 09:09:41❯ Enabling IPV6 in hosts: /data/nginx today at 09:09:41 ❯ /data/nginx/default_host/site.conf today at 09:09:41 ❯ /data/nginx/proxy_host/8.conf today at 09:09:41 ❯ /data/nginx/proxy_host/4.conf today at 09:09:41 ❯ /data/nginx/proxy_host/9.conf today at 09:09:41 ❯ /data/nginx/proxy_host/6.conf today at 09:09:41 ❯ /data/nginx/proxy_host/3.conf today at 09:09:41 ❯ /data/nginx/proxy_host/5.conf today at 09:09:41 ❯ /data/nginx/proxy_host/2.conf today at 09:09:41 ❯ /data/nginx/redirection_host/1.conf today at 09:09:41nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-1/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/npm-1/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file) ```
kerem commented 2026-02-26 07:31:19 +03:00
Author
Owner
Copy link

@jicho commented on GitHub (May 30, 2022):

I have some more info :)

I've looked into the configuration files and discovered that /data/nginx/redirection_host/1.conf still had a link to the old certificate.

Funny thing is that I've never added a certificate to that redirect. This is a www.example.com redirect to example.com.

So I assume that after deleting the npm-1 certificate this redirect wasn't updates/changed. Or some checks didn't discover this change?

I've changed the config file by hand, restarted the container.
After that my the warnings on the CLI where gone for the certificate and the GUI allowed to add a new proxy (as expected)

<!-- gh-comment-id:1140792896 --> @jicho commented on GitHub (May 30, 2022): I have some more info :) I've looked into the configuration files and discovered that `/data/nginx/redirection_host/1.conf` still had a link to the old certificate. Funny thing is that I've never added a certificate to that redirect. This is a www.example.com redirect to example.com. So I assume that after deleting the `npm-1` certificate this redirect wasn't updates/changed. Or some checks didn't discover this change? I've changed the config file by hand, restarted the container. After that my the warnings on the CLI where gone for the certificate and the GUI allowed to add a new proxy (as expected)
kerem commented 2026-02-26 07:31:19 +03:00
Author
Owner
Copy link

@the1ts commented on GitHub (May 30, 2022):

I know of this issue having seen it myself. I'm not sure that software can fix this without human intervention since there are a few options that could be called a fix for the SSL cert removal from a current host:

  1. New cert created by letsencrypt for replacement
  2. New cert to be uploaded for replacement
  3. Replace with an existing cert that covers the host
  4. No cert and going back to http only.

At the moment, there doesn't appear to be any logic behind the warning dialogue, I get the same warning if the Cert is unused or used. I guess a nice way to fix would be some more logic behind that dialogue.

The flow could be:

If SSL cert is used in one or more hosts:

  1. Dialogue with links to the hosts that would be affected by the deletion for human fixes
  2. A refresh button to hit after fixes are manually completed
  3. Refresh button turns into a delete button when all links to the cert have been removed and shows warning of permanent deletion

If SSL cert is not used in any hosts:

  1. Dialogue with delete button warning of permanent deletion

Any chance you can change the label to Enhancement?

<!-- gh-comment-id:1140979429 --> @the1ts commented on GitHub (May 30, 2022): I know of this issue having seen it myself. I'm not sure that software can fix this without human intervention since there are a few options that could be called a fix for the SSL cert removal from a current host: 1. New cert created by letsencrypt for replacement 2. New cert to be uploaded for replacement 3. Replace with an existing cert that covers the host 4. No cert and going back to http only. At the moment, there doesn't appear to be any logic behind the warning dialogue, I get the same warning if the Cert is unused or used. I guess a nice way to fix would be some more logic behind that dialogue. The flow could be: If SSL cert is used in one or more hosts: 1. Dialogue with links to the hosts that would be affected by the deletion for human fixes 2. A refresh button to hit after fixes are manually completed 3. Refresh button turns into a delete button when all links to the cert have been removed and shows warning of permanent deletion If SSL cert is not used in any hosts: 1. Dialogue with delete button warning of permanent deletion Any chance you can change the label to Enhancement?
kerem commented 2026-02-26 07:31:19 +03:00
Author
Owner
Copy link

@jicho commented on GitHub (May 30, 2022):

@the1ts happy to "hear" that I'm not the only one experiencing this. Your proposal sounds like a nice upgrade to the logic!

I can't change the label into Enhancement, but I assume the project owner can do for us 🤞

<!-- gh-comment-id:1141220648 --> @jicho commented on GitHub (May 30, 2022): @the1ts happy to "hear" that I'm not the only one experiencing this. Your proposal sounds like a nice upgrade to the logic! I can't change the label into Enhancement, but I assume the project owner can do for us 🤞
kerem commented 2026-02-26 07:31:19 +03:00
Author
Owner
Copy link

@scob7 commented on GitHub (Nov 18, 2022):

There is definitely a serious bug here. After initial setup I created a wild-card lets encrypt cert with no issue. Then I deleted the wildcard as I wanted to replace it. Boom! Proxy manager errors on any operation that attempts to edit the nginx conf files.

Based on the hint from @jicho I ssh'd into the Proxy manager docker instance and deleted old references from the nginx conf files. Normal uses would be totally stuck and need to reinstall proxy manager.

<!-- gh-comment-id:1319518421 --> @scob7 commented on GitHub (Nov 18, 2022): There is definitely a serious bug here. After initial setup I created a wild-card lets encrypt cert with no issue. Then I deleted the wildcard as I wanted to replace it. Boom! Proxy manager errors on any operation that attempts to edit the nginx conf files. Based on the hint from @jicho I ssh'd into the Proxy manager docker instance and deleted old references from the nginx conf files. Normal uses would be totally stuck and need to reinstall proxy manager.
kerem commented 2026-02-26 07:31:19 +03:00
Author
Owner
Copy link

@tajnymag commented on GitHub (Jan 23, 2023):

Can confirm having the same problem even now on the latest image tag (2.9.19)

For me, the old references were not in /data/nginx/redirection_host/1.conf but instead in /data/nginx/proxy_host/1.conf

<!-- gh-comment-id:1400458203 --> @tajnymag commented on GitHub (Jan 23, 2023): Can confirm having the same problem even now on the latest image tag (2.9.19) For me, the old references were not in `/data/nginx/redirection_host/1.conf` but instead in `/data/nginx/proxy_host/1.conf`
kerem commented 2026-02-26 07:31:19 +03:00
Author
Owner
Copy link

@WisManue commented on GitHub (Jan 19, 2024):

I can confirm the Bug too. I use the latest Image 2.10.4. :(

In my case the old reference were in /data/nginx/proxy_host/3.conf and in /data/nginx/proxy_host/13.conf.

In both conf-Files there are my Proxy-Hosts, on those i had configured the SSL-Certificate i have removed later. It seems so, that NPM deletes the global DNS-SSL but not the SSL-Certificates on the hosts...

<!-- gh-comment-id:1900985929 --> @WisManue commented on GitHub (Jan 19, 2024): I can confirm the Bug too. I use the latest Image 2.10.4. :( In my case the old reference were in /data/nginx/proxy_host/3.conf and in /data/nginx/proxy_host/13.conf. In both conf-Files there are my Proxy-Hosts, on those i had configured the SSL-Certificate i have removed later. It seems so, that NPM deletes the global DNS-SSL but not the SSL-Certificates on the hosts...
kerem commented 2026-02-26 07:31:19 +03:00
Author
Owner
Copy link

@IsaacShoebottom commented on GitHub (Jun 14, 2024):

Affecting me here, clearing out and SSL cert in the webui does not remove it from proxy hosts actual config files. Needed to remove manually and then restart container

<!-- gh-comment-id:2168568466 --> @IsaacShoebottom commented on GitHub (Jun 14, 2024): Affecting me here, clearing out and SSL cert in the webui does not remove it from proxy hosts actual config files. Needed to remove manually and then restart container
kerem commented 2026-02-26 07:31:19 +03:00
Author
Owner
Copy link

@CoolDouble commented on GitHub (Jun 19, 2024):

Me too.

<!-- gh-comment-id:2178491835 --> @CoolDouble commented on GitHub (Jun 19, 2024): Me too.
kerem commented 2026-02-26 07:31:19 +03:00
Author
Owner
Copy link

@github-actions[bot] commented on GitHub (Jan 27, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

<!-- gh-comment-id:2614723138 --> @github-actions[bot] commented on GitHub (Jan 27, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:
kerem commented 2026-02-26 07:31:19 +03:00
Author
Owner
Copy link

@IsaacShoebottom commented on GitHub (Jan 28, 2025):

Bump

<!-- gh-comment-id:2617719791 --> @IsaacShoebottom commented on GitHub (Jan 28, 2025): Bump
kerem commented 2026-02-26 07:31:19 +03:00
Author
Owner
Copy link

@github-actions[bot] commented on GitHub (Oct 12, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

<!-- gh-comment-id:3393838713 --> @github-actions[bot] commented on GitHub (Oct 12, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
develop
dependabot/npm_and_yarn/backend/liquidjs-10.25.7
dependabot/npm_and_yarn/frontend/prod-minor-updates-2a16bf3987
dependabot/npm_and_yarn/frontend/dev-patch-updates-754666cf41
dependabot/npm_and_yarn/backend/basic-ftp-5.3.0
dependabot/npm_and_yarn/test/follow-redirects-1.16.0
dependabot/npm_and_yarn/test/axios-1.15.0
dependabot/npm_and_yarn/frontend/lodash-4.18.1
dependabot/npm_and_yarn/backend/lodash-4.18.1
dependabot/npm_and_yarn/test/lodash-4.18.1
dependabot/npm_and_yarn/frontend/vite-7.3.2
dependabot/npm_and_yarn/backend/prod-minor-updates-5ec19a7f21
dependabot/npm_and_yarn/frontend/lodash-es-4.18.1
dependabot/npm_and_yarn/frontend/happy-dom-20.8.9
dependabot/npm_and_yarn/backend/path-to-regexp-8.4.0
dependabot/npm_and_yarn/frontend/picomatch-4.0.4
dependabot/npm_and_yarn/backend/picomatch-2.3.2
dependabot/npm_and_yarn/frontend/yaml-1.10.3
dependabot/npm_and_yarn/test/flatted-3.4.2
dependabot/npm_and_yarn/test/tar-7.5.11
dependabot/npm_and_yarn/frontend/immutable-5.1.5
master
dependabot/npm_and_yarn/test/glob-10.5.0
dependabot/npm_and_yarn/frontend/mdast-util-to-hast-13.2.1
dependabot/npm_and_yarn/test/form-data-4.0.4
v3-abandoned
bump-freedns
openidc
ssl-passthrough-hosts
static-content
v2.14.0
v2.13.7
v2.13.6
v2.13.5
v2.13.4
v2.13.3
v2.13.2
v2.13.1
v2.13.0
v2.12.6
v2.12.5
v2.12.4
v2.12.3
v2.12.2
v2.12.1
v2.12.0
v2.11.3
v2.11.2
v2.11.1
v2.11.0
v2.10.4
v2.10.3
v2.10.2
v2.10.1
v2.10.0
v2.9.22
v2.9.21
v2.9.20
v2.9.19
v2.9.18
v2.9.17
v2.9.16
v2.9.15
v2.9.14
v2.9.13
v2.9.12
v2.9.11
v2.9.10
v2.9.9
v2.9.8
v2.9.7
v2.9.6
v2.9.5
v2.9.4
v2.9.3
v2.9.2
v2.9.1
v2.9.0
v2.8.1
v2.8.0
v2.7.3
v2.7.2
v2.7.1
v2.7.0
v2.6.2
v2.6.1
v2.6.0
v2.5.0
v2.4.0
v2.3.1
v2.3.0
v2.2.4
v2.2.3
v2.2.2
v2.2.1
v2.2.0
v2.1.2
v2.1.1
v2.1.0
2.0.14
2.0.13
2.0.12
2.0.11
2.0.10
2.0.9
2.0.8
2.0.7
2.0.6
2.0.5
2.0.4
2.0.3
2.0.2
2.0.0
v2.0.0
1.1.2
1.1.1
1.0.1
Labels
Clear labels   
awaiting feedback

   
bug

   
cannot reproduce

   
dns provider request

   
duplicate

   
enhancement

   
enhancement

   
enhancement

   
good first issue

   
help wanted

   
invalid

   
need more info

   
no certbot plugin available

   
product-support

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
stale

   
troll

   
upstream issue

   
v2

   
v2

   
v2

   
v3

   
wontfix
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/nginx-proxy-manager-NginxProxyManager#1498
No description provided.