mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-26 01:45:54 +03:00
[GH-ISSUE #3732] Ability to edit Let's Encrypt certificate DNS challenge options #2465
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#2465
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @esand on GitHub (May 1, 2024).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3732
Is your feature request related to a problem? Please describe.
Yes - there is currently no way to update the DNS challenge provider or options. If you change DNS providers, you would need to update the DNS challenge settings (if used). Since you can't do this, you have to add a new certificate entry (and remove the old one) which creates a new /etc/letsencrypt folder. If you have other services tied to the specific
npm-*folders created (since you can't customize these paths), you would have to update all your other configurations with the new location as well.Describe the solution you'd like
I would like an Edit option for Let's Encrypt SSL certificates along with Renew now/Download/Delete. This would open the same window as when you create the certificate, but existing settings would be shown and could be edited.
Describe alternatives you've considered
I have considered editing the credential files that are generated, however docs state that the credential information is stored in NPM's database as well, so this would not properly solve the issue.
Creating a new certificate entry is not a viable option if you want to avoid having to update paths in other services that are using the certificate.
Additional context
@gratiachristi95 commented on GitHub (May 2, 2024):
As you know dns as well as ssl certification can be hard things to setup and for good reason. It is a good security practice to delete old certificates and get new ones when you switch dns providers due to the keys. You do not want an old key stored on an old dns providers servers. For that reason the current way the project has it set up is the better security practice and adding the feature you described would make this project less secure.
@esand commented on GitHub (May 3, 2024):
@gratiachristi95 I wasn't aware that any SSL keys were stored by the DNS providers in any way at all. From what I understand, using the DNS challenge feature has certbot temporarily create a DNS record so that it can then validate that it exists on the domain, thus proving you actually own the domain, and then after validating you're the owner, it removes the record and issues the certificate.
I was under the impression that the SSL key is stored and generated on my system since that's private info and used to sign (so you don't want others having access to it).
Also, with the ability to edit the certificate's settings (really just toggling DNS challenge, the provider and any settings that go with it such as an API key typically) wouldn't impact the certificate in any way when you do it - it would only update the recorded information and upon renewal would be used instead of what was previously used for the certificate.
If certbot doesn't allow you to modify the info, I can totally understand - and in that case, I'd be just fine with some way to manually specify the "name" of the certificate (npm-1, -2, etc..) so I can replace a previous certificate in /etc/letsencrypt rather than it using whatever the next internal ID is that was generated from the database.
@esand commented on GitHub (May 10, 2024):
To update this feature request, certbot apparently does support changing challenge options. If you want to change challenger choice, you can use the
--preferred-challengesoption to specify which you prefer, and then specify the relevant challenge options as well.If certbot supports it, I don't see why this project couldn't either - and as mentioned, it would be a nice improvement for those of us with certs and then change DNS providers.
@github-actions[bot] commented on GitHub (Dec 27, 2024):
Issue is now considered stale. If you want to keep it open, please comment 👍
@esand commented on GitHub (Dec 27, 2024):
This feature request is still relevant - although changing DNS providers may not be something commonly performed, it's either support changing the challenger, or allow specifying the full path to the SSL certificates generated so that external apps using the certificate paths don't have to be updated (when you delete and re-add the certificate to change the challenger).
@Brandejs commented on GitHub (Feb 25, 2025):
It looks like currently the only option is to update the values in the DB. But I also think that updating settings should be possible in this application.
I understand the concern when changing DNS provider. But what if the dns management api key changes? There should be no need to generate new certificates until they expire. But a new api key must be entered to create a new txt record. Which is currently not possible.
@github-actions[bot] commented on GitHub (Sep 2, 2025):
Issue is now considered stale. If you want to keep it open, please comment 👍
@disfated commented on GitHub (Sep 2, 2025):
👍
@StickyxLemons commented on GitHub (Sep 2, 2025):
👍
@martysl commented on GitHub (Nov 12, 2025):
👍
@brofids commented on GitHub (Jan 31, 2026):
👍