starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 09:25:55 +03:00

[GH-ISSUE #3862] NPM is not parsing CN from custom certificate correctly #2536

New issue

Open

opened 2026-02-26 07:35:56 +03:00 by kerem · 4 comments

kerem commented

2026-02-26 07:35:56 +03:00

Owner

Originally created by @MarcoWel on GitHub (Jul 8, 2024).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3862

getCertificateInfoFromFile() function does not parse cert subject correctly.

github.com/NginxProxyManager/nginx-proxy-manager@63d06da8a8/backend/internal/certificate.js (L734)

It expects the CN as first item (by reading match[1]), which is not always the case.

Example:
openssl x509 -in cert.crt -subject -noout
Output: subject=C = DE, ST = State, L = City, O = MyOrg, OU = -, CN = *.example.com

When loading such a certificate in NPM it seems to work, but accessing the Proxy leads to a ERR_SSL_UNRECOGNIZED_NAME_ALERT error in the browser.

Fix: Make subject parsing regex more robust.
This one should be working:

const regex = /(?:subject=)?CN\s*=\s*(\S+)/gim;

Originally created by @MarcoWel on GitHub (Jul 8, 2024). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3862 getCertificateInfoFromFile() function does not parse cert subject correctly. https://github.com/NginxProxyManager/nginx-proxy-manager/blob/63d06da8a8591e7a9b2a1873eb91ce1c42b2b0f9/backend/internal/certificate.js#L734 It expects the CN as first item (by reading `match[1]`), which is not always the case. **Example:** `openssl x509 -in cert.crt -subject -noout` Output: `subject=C = DE, ST = State, L = City, O = MyOrg, OU = -, CN = *.example.com` When loading such a certificate in NPM it seems to work, but accessing the Proxy leads to a ERR_SSL_UNRECOGNIZED_NAME_ALERT error in the browser. **Fix:** Make subject parsing regex more robust. This one should be working: ```js const regex = /(?:subject=)?CN\s*=\s*(\S+)/gim; ```

kerem added the

stale

bug

labels

2026-02-26 07:35:56 +03:00

kerem commented

2026-02-26 07:35:56 +03:00

Author

Owner

@MarcoWel commented on GitHub (Jul 8, 2024):

Alternative Solution:
Add -nameopt RFC2253 parameter to this line:
github.com/NginxProxyManager/nginx-proxy-manager@63d06da8a8/backend/internal/certificate.js (L731)

Result:

return utils.exec('openssl x509 -in ' + certificate_file + ' -subject -noout -nameopt RFC2253')

This ensures the standardized order of the subject fields where CN is always the first in order.

@MarcoWel commented on GitHub (Jul 8, 2024): **Alternative Solution:** Add `-nameopt RFC2253` parameter to this line: https://github.com/NginxProxyManager/nginx-proxy-manager/blob/63d06da8a8591e7a9b2a1873eb91ce1c42b2b0f9/backend/internal/certificate.js#L731 Result: ```js return utils.exec('openssl x509 -in ' + certificate_file + ' -subject -noout -nameopt RFC2253') ``` This ensures the standardized order of the subject fields where CN is always the first in order.

kerem commented

2026-02-26 07:35:56 +03:00

Author

Owner

@SirWobbyTheFirst commented on GitHub (Aug 19, 2024):

Hi @MarcoWel,

Could this expain why my Exchange Server has just started popping up an ERR_SSL_UNRECOGNIZED _NAME_ALERT error message recently? It's proxied through NPM and has only recently started doing it today.

@SirWobbyTheFirst commented on GitHub (Aug 19, 2024): Hi @MarcoWel, Could this expain why my Exchange Server has just started popping up an ERR_SSL_UNRECOGNIZED _NAME_ALERT error message recently? It's proxied through NPM and has only recently started doing it today.

kerem commented

2026-02-26 07:35:57 +03:00

Author

Owner

@SteveBattista commented on GitHub (Jan 8, 2025):

You cant use the RFC2253 option as the regex's work with spaces not commas. I have tried a bunch of REGEX This should work but it does not work:
/(?:subject=)?CN\s*=\s*([*[a-z.0-9A-Z]+)

This is what my subject line looks like:
subject=O = schmoocon, OU = schmooball, CN = *.meathead.fun.tld

Any ideas?

@SteveBattista commented on GitHub (Jan 8, 2025): You cant use the RFC2253 option as the regex's work with spaces not commas. I have tried a bunch of REGEX This should work but it does not work: /(?:subject=)?CN\s*=\s*([\*[a-z\.0-9A-Z]+) This is what my subject line looks like: subject=O = schmoocon, OU = schmooball, CN = *.meathead.fun.tld Any ideas?

kerem commented

2026-02-26 07:35:57 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jul 30, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Jul 30, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#2536

No description provided.

Rows
Columns