[GH-ISSUE #3732] Ability to edit Let's Encrypt certificate DNS challenge options #2465

Open
opened 2026-02-26 07:35:40 +03:00 by kerem · 11 comments
Owner

Originally created by @esand on GitHub (May 1, 2024).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3732

Is your feature request related to a problem? Please describe.

Yes - there is currently no way to update the DNS challenge provider or options. If you change DNS providers, you would need to update the DNS challenge settings (if used). Since you can't do this, you have to add a new certificate entry (and remove the old one) which creates a new /etc/letsencrypt folder. If you have other services tied to the specific npm-* folders created (since you can't customize these paths), you would have to update all your other configurations with the new location as well.

Describe the solution you'd like

I would like an Edit option for Let's Encrypt SSL certificates along with Renew now/Download/Delete. This would open the same window as when you create the certificate, but existing settings would be shown and could be edited.

Describe alternatives you've considered

I have considered editing the credential files that are generated, however docs state that the credential information is stored in NPM's database as well, so this would not properly solve the issue.
Creating a new certificate entry is not a viable option if you want to avoid having to update paths in other services that are using the certificate.

Additional context

Originally created by @esand on GitHub (May 1, 2024). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3732 <!-- Are you in the right place? - If you are looking for support on how to get your upstream server forwarding, please consider asking the community on Reddit. - If you are writing code changes to contribute and need to ask about the internals of the software, Gitter is the best place to ask. - If you think you found a bug with NPM (not Nginx, or your upstream server or MySql) then you are in the *right place.* --> **Is your feature request related to a problem? Please describe.** <!-- A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] --> Yes - there is currently no way to update the DNS challenge provider or options. If you change DNS providers, you would need to update the DNS challenge settings (if used). Since you can't do this, you have to add a new certificate entry (and remove the old one) which creates a new /etc/letsencrypt folder. If you have other services tied to the specific `npm-*` folders created (since you can't customize these paths), you would have to update all your other configurations with the new location as well. **Describe the solution you'd like** <!-- A clear and concise description of what you want to happen. --> I would like an Edit option for Let's Encrypt SSL certificates along with Renew now/Download/Delete. This would open the same window as when you create the certificate, but existing settings would be shown and could be edited. **Describe alternatives you've considered** <!-- A clear and concise description of any alternative solutions or features you've considered. --> I have considered editing the credential files that are generated, however docs state that the credential information is stored in NPM's database as well, so this would not properly solve the issue. Creating a new certificate entry is not a viable option if you want to avoid having to update paths in other services that are using the certificate. **Additional context** <!-- Add any other context or screenshots about the feature request here. -->
Author
Owner

@gratiachristi95 commented on GitHub (May 2, 2024):

As you know dns as well as ssl certification can be hard things to setup and for good reason. It is a good security practice to delete old certificates and get new ones when you switch dns providers due to the keys. You do not want an old key stored on an old dns providers servers. For that reason the current way the project has it set up is the better security practice and adding the feature you described would make this project less secure.

<!-- gh-comment-id:2090408124 --> @gratiachristi95 commented on GitHub (May 2, 2024): As you know dns as well as ssl certification can be hard things to setup and for good reason. It is a good security practice to delete old certificates and get new ones when you switch dns providers due to the keys. You do not want an old key stored on an old dns providers servers. For that reason the current way the project has it set up is the better security practice and adding the feature you described would make this project less secure.
Author
Owner

@esand commented on GitHub (May 3, 2024):

@gratiachristi95 I wasn't aware that any SSL keys were stored by the DNS providers in any way at all. From what I understand, using the DNS challenge feature has certbot temporarily create a DNS record so that it can then validate that it exists on the domain, thus proving you actually own the domain, and then after validating you're the owner, it removes the record and issues the certificate.

I was under the impression that the SSL key is stored and generated on my system since that's private info and used to sign (so you don't want others having access to it).

Also, with the ability to edit the certificate's settings (really just toggling DNS challenge, the provider and any settings that go with it such as an API key typically) wouldn't impact the certificate in any way when you do it - it would only update the recorded information and upon renewal would be used instead of what was previously used for the certificate.

If certbot doesn't allow you to modify the info, I can totally understand - and in that case, I'd be just fine with some way to manually specify the "name" of the certificate (npm-1, -2, etc..) so I can replace a previous certificate in /etc/letsencrypt rather than it using whatever the next internal ID is that was generated from the database.

<!-- gh-comment-id:2092057823 --> @esand commented on GitHub (May 3, 2024): @gratiachristi95 I wasn't aware that any SSL keys were stored by the DNS providers in any way at all. From what I understand, using the DNS challenge feature has certbot temporarily create a DNS record so that it can then validate that it exists on the domain, thus proving you actually own the domain, and then after validating you're the owner, it removes the record and issues the certificate. I was under the impression that the SSL key is stored and generated on my system since that's private info and used to sign (so you don't want others having access to it). Also, with the ability to edit the certificate's settings (really just toggling DNS challenge, the provider and any settings that go with it such as an API key typically) wouldn't impact the certificate in any way when you do it - it would only update the recorded information and upon renewal would be used instead of what was previously used for the certificate. If certbot doesn't allow you to modify the info, I can totally understand - and in that case, I'd be just fine with some way to manually specify the "name" of the certificate (npm-1, -2, etc..) so I can replace a previous certificate in /etc/letsencrypt rather than it using whatever the next internal ID is that was generated from the database.
Author
Owner

@esand commented on GitHub (May 10, 2024):

To update this feature request, certbot apparently does support changing challenge options. If you want to change challenger choice, you can use the --preferred-challenges option to specify which you prefer, and then specify the relevant challenge options as well.

If certbot supports it, I don't see why this project couldn't either - and as mentioned, it would be a nice improvement for those of us with certs and then change DNS providers.

<!-- gh-comment-id:2103785760 --> @esand commented on GitHub (May 10, 2024): To update this feature request, certbot apparently **does** support changing challenge options. If you want to change challenger choice, you can use the `--preferred-challenges` option to specify which you prefer, and then specify the relevant challenge options as well. If certbot supports it, I don't see why this project couldn't either - and as mentioned, it would be a nice improvement for those of us with certs and then change DNS providers.
Author
Owner

@github-actions[bot] commented on GitHub (Dec 27, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

<!-- gh-comment-id:2563234732 --> @github-actions[bot] commented on GitHub (Dec 27, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:
Author
Owner

@esand commented on GitHub (Dec 27, 2024):

This feature request is still relevant - although changing DNS providers may not be something commonly performed, it's either support changing the challenger, or allow specifying the full path to the SSL certificates generated so that external apps using the certificate paths don't have to be updated (when you delete and re-add the certificate to change the challenger).

<!-- gh-comment-id:2563261962 --> @esand commented on GitHub (Dec 27, 2024): This feature request is still relevant - although changing DNS providers may not be something commonly performed, it's either support changing the challenger, or allow specifying the full path to the SSL certificates generated so that external apps using the certificate paths don't have to be updated (when you delete and re-add the certificate to change the challenger).
Author
Owner

@Brandejs commented on GitHub (Feb 25, 2025):

It looks like currently the only option is to update the values in the DB. But I also think that updating settings should be possible in this application.

I understand the concern when changing DNS provider. But what if the dns management api key changes? There should be no need to generate new certificates until they expire. But a new api key must be entered to create a new txt record. Which is currently not possible.

<!-- gh-comment-id:2682552667 --> @Brandejs commented on GitHub (Feb 25, 2025): It looks like currently the only option is to update the values in the DB. But I also think that updating settings should be possible in this application. I understand the concern when changing DNS provider. But what if the dns management api key changes? There should be no need to generate new certificates until they expire. But a new api key must be entered to create a new txt record. Which is currently not possible.
Author
Owner

@github-actions[bot] commented on GitHub (Sep 2, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

<!-- gh-comment-id:3243568776 --> @github-actions[bot] commented on GitHub (Sep 2, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:
Author
Owner

@disfated commented on GitHub (Sep 2, 2025):

👍

<!-- gh-comment-id:3243759746 --> @disfated commented on GitHub (Sep 2, 2025): 👍
Author
Owner

@StickyxLemons commented on GitHub (Sep 2, 2025):

👍

<!-- gh-comment-id:3244238765 --> @StickyxLemons commented on GitHub (Sep 2, 2025): 👍
Author
Owner

@martysl commented on GitHub (Nov 12, 2025):

👍

<!-- gh-comment-id:3523981969 --> @martysl commented on GitHub (Nov 12, 2025): 👍
Author
Owner

@brofids commented on GitHub (Jan 31, 2026):

👍

<!-- gh-comment-id:3829085010 --> @brofids commented on GitHub (Jan 31, 2026): 👍
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/nginx-proxy-manager-NginxProxyManager#2465
No description provided.