mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-26 01:45:54 +03:00
[GH-ISSUE #2251] Auto renew ssl cert #1605
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#1605
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @JS-E on GitHub (Sep 5, 2022).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2251
Describe the solution you'd like
A button or toggle switch that sets up a cron job to renew an certificate a few days before ssl cert expiry
Describe alternatives you've considered
I was going to set up my own one but i think it would be nice as an extra feature
@the1ts commented on GitHub (Sep 5, 2022):
@JS-E as standard it does this, indeed you can't stop it as far as I know, if its not renewing for you, there is a bug currently that stops the renew if Force SSL is ticked, untick and it can renew, then retick the Force SSL.
@JS-E commented on GitHub (Sep 6, 2022):
Okay, this isn't very clear when setting up an SSL cert. Would be cool if it was mentioned that it would auto renew and maybe give a date when it's planned to renew.
@the1ts commented on GitHub (Sep 6, 2022):
From the main page on the homepage
Free SSL
Built in Let’s Encrypt support allows you to secure your Web services at no cost to you. The certificates even renew themselves!
@JS-E commented on GitHub (Sep 7, 2022):
@the1ts - Didn't see that, thanks for pointing that out. Could this perhaps be shown on the actual SSL page as i still don't know what day the SSL cert will actually renew.
@the1ts commented on GitHub (Sep 8, 2022):
From my very amateur reading of the backend certificate code in NPM and the log files created, the renewal time isn't handled by NPM. NPM simply calls certbot on a 1 hour timer and certbot runs against all current certs, certbot tries a renew of the cert if certbots own renewal time has been met. I think the certbot renewal time is currently at 30 days before expiry. So you get a 90 day cert and after 60 days it will renew. The reason we use NPM and automated letsencrypt in general, is so we don't have to worry about renewal times any longer.
Some of this is not much better than guess work, but you can see in the logs when you do a manual renewal, a single cert is attempted in the certbot commandline and certbot will complain about not ready for renewal without reaching out to letsencrypt, when its the hourly renewal no cert is pointed to and not ready for renewal messaging is seen again from certbot but for all known certs.
Of note, I've not seen the automated, "your cert is about to expire" email that you get from letsencrypt at about 2 weeks to expiry since moving to NPM, but there is currently an issue around this which is waiting a new build so keep your container up to date.
In short we are automating so we don't need to worry about when the cert is renewed. If you have to know when a cert is renewed for some cert pinning problem perhaps NPM and lets encrypt in general isn't the tool you need.
@JS-E commented on GitHub (Nov 8, 2022):
After checking now and upgrading, i can see this automatically upgrading the cert so i'm happy to close