[GH-ISSUE #3518] Allow custom ACME servers for certificate generation

kerem commented

2026-02-26 07:35:10 +03:00

Owner

Originally created by @Nathanwoodburn on GitHub (Feb 1, 2024).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3518

Is your feature request related to a problem? Please describe.

It would be really nice to be able to add custom ACME servers to the certificate generation.
For example I have an acme server that generates internal signed certificates and I currently need to upload them every time I update them.

Describe the solution you'd like

Either allow acme servers added via the web interface or maybe a config file?

Describe alternatives you've considered

Additional context

Originally created by @Nathanwoodburn on GitHub (Feb 1, 2024). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3518  **Is your feature request related to a problem? Please describe.**  It would be really nice to be able to add custom ACME servers to the certificate generation. For example I have an acme server that generates internal signed certificates and I currently need to upload them every time I update them. **Describe the solution you'd like**  Either allow acme servers added via the web interface or maybe a config file? **Describe alternatives you've considered**  **Additional context**

kerem added the

enhancement

label

2026-02-26 07:35:10 +03:00

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@Ro-meo commented on GitHub (Feb 22, 2024):

Maybe as an addition :
documentation how to do this manually ?

@Ro-meo commented on GitHub (Feb 22, 2024): Maybe as an addition : documentation how to do this manually ?

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@demonbane commented on GitHub (Mar 1, 2024):

I'd love to see this as well. I was able to connect to the console of the npm container and manually create certificates using certbot with my custom ACME server like this:

certbot certonly -d <domain> --agree-tos --no-eff-email \
--server <server_url> \
--eab-kid <kid> \
--eab-hmac-key <hmac>

But actually using them is kind of a nightmare. I have to get the files out of the container and onto my local machine just to then reupload them through the web UI. I had hoped to at least symlink the certs directly from /etc/letsencrypt to /data/custom_ssl but it looks like the web UI stores the certificates in the database and only writes them out to disk so that nginx can access them so I'm not sure that that would survive a restart. (and even if it did it would still require manually uploading a dummy cert for every domain)

@demonbane commented on GitHub (Mar 1, 2024): I'd love to see this as well. I was able to connect to the console of the npm container and manually create certificates using `certbot` with my custom ACME server like this: ``` certbot certonly -d <domain> --agree-tos --no-eff-email \ --server <server_url> \ --eab-kid <kid> \ --eab-hmac-key <hmac> ``` But actually using them is kind of a nightmare. I have to get the files out of the container and onto my local machine just to then reupload them through the web UI. I had hoped to at least symlink the certs directly from `/etc/letsencrypt` to `/data/custom_ssl` but it looks like the web UI stores the certificates in the database and only writes them out to disk so that nginx can access them so I'm not sure that that would survive a restart. (and even if it did it would still require manually uploading a dummy cert for every domain)

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@demonbane commented on GitHub (Mar 1, 2024):

Looking at the code, it looks like npm creates /etc/letsencrypt.ini by default and it turns out you can just add the config in there and it works! I just added:

server = <url>
eab-kid = <kid>
eab-hmac-key = <hmac>

and then tried using the UI to generate a new certificate and it worked perfectly! I'd still love to see an option added to the UI to manage this, but this actually works right now which is great.

@demonbane commented on GitHub (Mar 1, 2024): Looking at the code, it looks like npm creates `/etc/letsencrypt.ini` by default and it turns out you can just add the config in there and it works! I just added: ``` server = <url> eab-kid = <kid> eab-hmac-key = <hmac> ``` and then tried using the UI to generate a new certificate and it worked perfectly! I'd still love to see an option added to the UI to manage this, but this actually works right now which is great.

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@Nathanwoodburn commented on GitHub (Mar 1, 2024):

Does that allow multiple? For this case I have internal domains (not on a valid tld), and regular public domains. So can I set 2 acme servers?

@Nathanwoodburn commented on GitHub (Mar 1, 2024): Does that allow multiple? For this case I have internal domains (not on a valid tld), and regular public domains. So can I set 2 acme servers?

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@demonbane commented on GitHub (Mar 1, 2024):

You would have to modify it each time (or just create two copies and swap them out between invocations). Fortunately, once the certificate is created, there's a cert-specific .conf file created in /etc/letsencrypt/renewal which does store the server name, so renewals should continue to work even if you've changed the server in the config each time.

@demonbane commented on GitHub (Mar 1, 2024): You would have to modify it each time (or just create two copies and swap them out between invocations). Fortunately, once the certificate is created, there's a cert-specific `.conf` file created in `/etc/letsencrypt/renewal` which does store the server name, so renewals should continue to work even if you've changed the server in the config each time.

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@fbender commented on GitHub (Mar 12, 2024):

See #1054:

I am planning to add configurable CA's to v3.

Originally posted by @jc21 in https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1054#issuecomment-870213956

@fbender commented on GitHub (Mar 12, 2024): See #1054: > I am planning to add configurable CA's to v3. _Originally posted by @jc21 in https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1054#issuecomment-870213956_

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Oct 29, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Oct 29, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@vshaev commented on GitHub (Oct 29, 2024):

+1

@vshaev commented on GitHub (Oct 29, 2024): +1

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@mikeleord commented on GitHub (Nov 6, 2024):

+1

@mikeleord commented on GitHub (Nov 6, 2024): +1

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@potatoru commented on GitHub (Nov 12, 2024):

+1

@potatoru commented on GitHub (Nov 12, 2024): +1

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@68656c6c commented on GitHub (Dec 15, 2024):

+1

@68656c6c commented on GitHub (Dec 15, 2024): +1

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@littlejackal commented on GitHub (Jan 7, 2025):

+1

@littlejackal commented on GitHub (Jan 7, 2025): +1

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@reyist commented on GitHub (Jan 28, 2025):

+1

@reyist commented on GitHub (Jan 28, 2025): +1

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@N-Hertstein commented on GitHub (Jan 31, 2025):

Looking at the code, it looks like npm creates /etc/letsencrypt.ini by default and it turns out you can just add the config in there and it works! I just added:
server = <url>
eab-kid = <kid>
eab-hmac-key = <hmac>
and then tried using the UI to generate a new certificate and it worked perfectly! I'd still love to see an option added to the UI to manage this, but this actually works right now which is great.

what did you do in the gui? did you use a dns challenge? Which one?

@N-Hertstein commented on GitHub (Jan 31, 2025): > Looking at the code, it looks like npm creates `/etc/letsencrypt.ini` by default and it turns out you can just add the config in there and it works! I just added: > > ``` > server = <url> > eab-kid = <kid> > eab-hmac-key = <hmac> > ``` > > and then tried using the UI to generate a new certificate and it worked perfectly! I'd still love to see an option added to the UI to manage this, but this actually works right now which is great. what did you do in the gui? did you use a dns challenge? Which one?

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@cgfm commented on GitHub (Mar 1, 2025):

Would be awesome. Additionaly it would be great to define some bash for post processing to copy the received certificate to an other location (in my case a container volume)

@cgfm commented on GitHub (Mar 1, 2025): Would be awesome. Additionaly it would be great to define some bash for post processing to copy the received certificate to an other location (in my case a container volume)

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@robinmalik commented on GitHub (Mar 10, 2025):

The workaround for me was to register the provider within the nginx-proxy-manager container (of course you could build this into your deployment processes with env variables). After this, requesting certs via the UI worked just fine with the default options.

Example syntax:
certbot register --email email@domain.com --server https://acme.provider.com --eab-kid kid --eab-hmac-key key

@robinmalik commented on GitHub (Mar 10, 2025): The workaround for me was to register the provider within the nginx-proxy-manager container (of course you could build this into your deployment processes with env variables). After this, requesting certs via the UI worked just fine with the default options. Example syntax: `certbot register --email email@domain.com --server https://acme.provider.com --eab-kid kid --eab-hmac-key key`

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@BulldozerPete commented on GitHub (Nov 28, 2025):

+1

@BulldozerPete commented on GitHub (Nov 28, 2025): +1

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@Ro-meo commented on GitHub (Dec 1, 2025):

+1

@Ro-meo commented on GitHub (Dec 1, 2025): +1

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@BulldozerPete commented on GitHub (Dec 2, 2025):

The workaround for me was to register the provider within the nginx-proxy-manager container (of course you could build this into your deployment processes with env variables). After this, requesting certs via the UI worked just fine with the default options.

Example syntax: certbot register --email email@domain.com --server https://acme.provider.com --eab-kid kid --eab-hmac-key key

Can you please share a simple how-to guide please?
I still don’t know what to configure in my docket compose file. Afterwards I don’t know where to finde the certificates and how to integrate them into NPM.
Thank you

@BulldozerPete commented on GitHub (Dec 2, 2025): > The workaround for me was to register the provider within the nginx-proxy-manager container (of course you could build this into your deployment processes with env variables). After this, requesting certs via the UI worked just fine with the default options. > > Example syntax: `certbot register --email email@domain.com --server https://acme.provider.com --eab-kid kid --eab-hmac-key key` Can you please share a simple how-to guide please? I still don’t know what to configure in my docket compose file. Afterwards I don’t know where to finde the certificates and how to integrate them into NPM. Thank you

kerem commented

2026-02-26 07:35:11 +03:00

Author

Owner

@kuandai commented on GitHub (Feb 19, 2026):

+1

@kuandai commented on GitHub (Feb 19, 2026): +1

Rows
Columns

[GH-ISSUE #3518] Allow custom ACME servers for certificate generation #2343