starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 17:35:52 +03:00

[GH-ISSUE #2108] Certificate Assocation lost after ACL is edited #1519

New issue

Closed

opened 2026-02-26 07:31:24 +03:00 by kerem · 3 comments

kerem commented

2026-02-26 07:31:24 +03:00

Owner

Originally created by @aaronbolton on GitHub (Jun 13, 2022).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2108

When editing an ACL Subnet list associated with a proxy host with an SSL Cert the cert becomes unassigned and reverts back to the localhost cert

Originally created by @aaronbolton on GitHub (Jun 13, 2022). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2108 When editing an ACL Subnet list associated with a proxy host with an SSL Cert the cert becomes unassigned and reverts back to the localhost cert

kerem

2026-02-26 07:31:24 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-26 07:31:24 +03:00

Author

Owner

@pmoon00 commented on GitHub (Jun 20, 2022):

+1 I am also experiencing this.

@pmoon00 commented on GitHub (Jun 20, 2022): +1 I am also experiencing this.

kerem commented

2026-02-26 07:31:24 +03:00

Author

Owner

@jeanpaulrh commented on GitHub (Jun 20, 2022):

me too, but it seems that to select the certificate again fixes it also for all other hosts (at least to me but I've been trying all sort of stuff thinking I had messed up something so maybe YMMV)

@jeanpaulrh commented on GitHub (Jun 20, 2022): me too, but it seems that to select the certificate again fixes it also for all other hosts (at least to me but I've been trying all sort of stuff thinking I had messed up something so maybe YMMV)

kerem commented

2026-02-26 07:31:24 +03:00

Author

Owner

@mvnmgrx commented on GitHub (Jan 8, 2023):

+1 the same problem here. When editing an ACL, all assigned hosts with LetsEncrypt Certificates will loose their SSL configuration.

To recreate:

Createn an ACL with one or more allow xxx.xxx.xxx.xxx and one deny all entry
Create a proxy host with its own LetsEncrypt SSL certificate
Assign it to said ACL
Verify that everything works as expected
Edit and save the ACL
SSL is now broken on said proxy host

NPM version: v2.9.19
Deployment: Docker container managed with docker-compose on Debian Bullseye
Docker engine version: 20.10.22
docker-compose version: v2.14.2

A proxy host configuration before editing the ACL:

# ------------------------------------------------------------
# <REDACTED>.mydomain.tld
# ------------------------------------------------------------

server {
  set $forward_scheme http;
  set $server         "<REDACTED_proxy_host>.mydomain.tld";
  set $port           6012;

  listen 80;
  listen [::]:80;

  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  server_name <REDACTED>.mydomain.tld;

  # Let's Encrypt SSL
  include conf.d/include/letsencrypt-acme-challenge.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-22/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-22/privkey.pem;

  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security "max-age=63072000; preload" always;

  # Force SSL
  include conf.d/include/force-ssl.conf;

  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $http_connection;
  proxy_http_version 1.1;

  access_log /data/logs/proxy-host-11_access.log proxy;
  error_log /data/logs/proxy-host-11_error.log warn;

  location / {

    # Access Rules
    allow 10.0.0.0/8;
    allow 127.0.0.1/32;
    allow 172.16.0.0/12;
    deny all;

    # Access checks must...
    satisfy all;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
    add_header Strict-Transport-Security "max-age=63072000; preload" always;

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

Same config after editing the ACL:

# ------------------------------------------------------------
# <REDACTED>.mydomain.tld
# ------------------------------------------------------------

server {
  set $forward_scheme http;
  set $server         "<REDACTED_proxy_host>.mydomain.tld";
  set $port           6012;

  listen 80;
  listen [::]:80;

  server_name <REDACTED>.mydomain.tld;

  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $http_connection;
  proxy_http_version 1.1;

  access_log /data/logs/proxy-host-11_access.log proxy;
  error_log /data/logs/proxy-host-11_error.log warn;

  location / {

    # Access Rules
    allow 10.0.0.0/8;
    allow 127.0.0.1/32;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    deny all;

    # Access checks must...
    satisfy all;

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

Screenshots:

@mvnmgrx commented on GitHub (Jan 8, 2023): +1 the same problem here. When editing an ACL, all assigned hosts with LetsEncrypt Certificates will loose their SSL configuration. **To recreate:** 1. Createn an ACL with one or more `allow xxx.xxx.xxx.xxx` and one `deny all` entry 2. Create a proxy host with its own LetsEncrypt SSL certificate 3. Assign it to said ACL 4. Verify that everything works as expected 5. Edit and save the ACL 6. SSL is now broken on said proxy host NPM version: v2.9.19 Deployment: Docker container managed with docker-compose on Debian Bullseye Docker engine version: 20.10.22 docker-compose version: v2.14.2 A proxy host configuration before editing the ACL: ``` # ------------------------------------------------------------ # <REDACTED>.mydomain.tld # ------------------------------------------------------------ server { set $forward_scheme http; set $server "<REDACTED_proxy_host>.mydomain.tld"; set $port 6012; listen 80; listen [::]:80; listen 443 ssl http2; listen [::]:443 ssl http2; server_name <REDACTED>.mydomain.tld; # Let's Encrypt SSL include conf.d/include/letsencrypt-acme-challenge.conf; include conf.d/include/ssl-ciphers.conf; ssl_certificate /etc/letsencrypt/live/npm-22/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/npm-22/privkey.pem; # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years) add_header Strict-Transport-Security "max-age=63072000; preload" always; # Force SSL include conf.d/include/force-ssl.conf; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; access_log /data/logs/proxy-host-11_access.log proxy; error_log /data/logs/proxy-host-11_error.log warn; location / { # Access Rules allow 10.0.0.0/8; allow 127.0.0.1/32; allow 172.16.0.0/12; deny all; # Access checks must... satisfy all; # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years) add_header Strict-Transport-Security "max-age=63072000; preload" always; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; # Proxy! include conf.d/include/proxy.conf; } # Custom include /data/nginx/custom/server_proxy[.]conf; } ``` Same config after editing the ACL: ``` # ------------------------------------------------------------ # <REDACTED>.mydomain.tld # ------------------------------------------------------------ server { set $forward_scheme http; set $server "<REDACTED_proxy_host>.mydomain.tld"; set $port 6012; listen 80; listen [::]:80; server_name <REDACTED>.mydomain.tld; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; access_log /data/logs/proxy-host-11_access.log proxy; error_log /data/logs/proxy-host-11_error.log warn; location / { # Access Rules allow 10.0.0.0/8; allow 127.0.0.1/32; allow 172.16.0.0/12; allow 192.168.0.0/16; deny all; # Access checks must... satisfy all; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; # Proxy! include conf.d/include/proxy.conf; } # Custom include /data/nginx/custom/server_proxy[.]conf; } ``` Screenshots: ![grafik](https://user-images.githubusercontent.com/99667992/211211814-916a6c4f-626f-4ac9-83af-c32fcb04b902.png) ![grafik](https://user-images.githubusercontent.com/99667992/211211887-776481d1-c2ea-41c0-abe1-e4735a62b4eb.png) ![grafik](https://user-images.githubusercontent.com/99667992/211211899-05405068-f84d-4b1b-b8ba-1c425438b910.png)

kerem referenced this issue

2026-02-26 08:30:41 +03:00

[PR #1519] [MERGED] Updates proxy paths #3448

kerem referenced this issue

2026-02-26 08:30:42 +03:00

[PR #1528] [MERGED] v2.9.11 #3450

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#1519

No description provided.

Rows
Columns