[GH-ISSUE #5301] Getting `Internal Error` When Creating Certificate ECDSA 256 Key Type With Cloudflare

kerem commented

2026-02-26 07:38:00 +03:00

Owner

Originally created by @YTKme on GitHub (Feb 12, 2026).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5301

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
- Yes
Are you sure you're not using someone else's docker image?
- Yes
Have you searched for similar issues (both open and closed)?
- Yes

Describe the bug

Nginx Proxy Manager Version

Version: v2.13.7

To Reproduce
Steps to reproduce the behavior:

Navigate to the Certificates section.
Select Add Certificate → Let's Encrypt via DNS from the dropdown on the right.
On the Add Let's Encrypt via DNS dialog
- Enter the Domain Name
- Select ECDSA 256 for the Key Type
- Select Cloudflare for the DNS Provider
- Enter the correct API Token for Credentials File Content
Clicked Save

Expected behavior

After saving, expect the certificate to be created. (This works fine with RSA 2048).

Screenshots

Operating System

Linux, Debian

Additional context

Getting the following error in log

Error:

[2/12/2026] [3:59:21 PM] [Express  ] › ⚠  warning   nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-20/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-20/fullchain.pem, r) error:10000080:BIO routines::no such file)
nginx: configuration file /etc/nginx/nginx.conf test failed

Originally created by @YTKme on GitHub (Feb 12, 2026). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5301  **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes **Describe the bug**  **Nginx Proxy Manager Version**  Version: v2.13.7 **To Reproduce** Steps to reproduce the behavior: 1. Navigate to the **Certificates** section. 2. Select **Add Certificate** → **Let's Encrypt via DNS** from the dropdown on the right. 3. On the **Add Let's Encrypt via DNS** dialog - Enter the **Domain Name** - Select **ECDSA 256** for the **Key Type** - Select **Cloudflare** for the **DNS Provider** - Enter the correct API Token for **Credentials File Content** 4. Clicked **Save** **Expected behavior**  After saving, expect the certificate to be created. (This works fine with RSA 2048). **Screenshots**  <img width="1100" height="1038" alt="Image" src="https://github.com/user-attachments/assets/9ca16c5f-d9da-4729-b9fc-8f34ba073fd2" /> **Operating System**  Linux, Debian **Additional context**  Getting the following error in log Error: ```text [2/12/2026] [3:59:21 PM] [Express ] › ⚠ warning nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-20/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-20/fullchain.pem, r) error:10000080:BIO routines::no such file) nginx: configuration file /etc/nginx/nginx.conf test failed ```

kerem

2026-02-26 07:38:00 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@YTKme commented on GitHub (Feb 13, 2026):

I tried restarting the container, but seem to be getting a repeating of the following error

❯ Starting nginx ...
nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-20/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-20/fullchain.pem, r) error:10000080:BIO routines::no such file)
❯ Starting nginx ...
nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-20/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-20/fullchain.pem, r) error:10000080:BIO routines::no such file)

@YTKme commented on GitHub (Feb 13, 2026): I tried restarting the container, but seem to be getting a repeating of the following error ```text ❯ Starting nginx ... nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-20/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-20/fullchain.pem, r) error:10000080:BIO routines::no such file) ❯ Starting nginx ... nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/npm-20/fullchain.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/letsencrypt/live/npm-20/fullchain.pem, r) error:10000080:BIO routines::no such file) ```

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@SpasovskiFilip commented on GitHub (Feb 13, 2026):

I get the same message 'Internal Error' when I try to add a proxy host. Either via cloudflare ssl or a local network generated certificate

I get this error in the Nginx Proxy Manager logs

[10:42:15 PM] [Express ] › ⚠ warning insert into `proxy_host` (`access_list_id`, `advanced_config`, `allow_websocket_upgrade`, `block_exploits`, `caching_enabled`, `certificate_id`, `created_on`, `domain_names`, `forward_host`, `forward_port`, `forward_scheme`, `hsts_enabled`, `hsts_subdomains`, `http2_support`, `locations`, `meta`, `modified_on`, `owner_user_id`, `ssl_forced`) values (0, '', 1, 1, 1, '6', NOW(), '["my.domain.com"]', '192.168.31.206', 8265, 'http', 1, 1, 1, '[]', '{}', NOW(), 1, 1) - SQLITE_ERROR: no such function: NOW

P.S. I'm using v2.13.7

@SpasovskiFilip commented on GitHub (Feb 13, 2026): I get the same message 'Internal Error' when I try to add a proxy host. Either via cloudflare ssl or a local network generated certificate I get this error in the Nginx Proxy Manager logs ``` [10:42:15 PM] [Express ] › ⚠ warning insert into `proxy_host` (`access_list_id`, `advanced_config`, `allow_websocket_upgrade`, `block_exploits`, `caching_enabled`, `certificate_id`, `created_on`, `domain_names`, `forward_host`, `forward_port`, `forward_scheme`, `hsts_enabled`, `hsts_subdomains`, `http2_support`, `locations`, `meta`, `modified_on`, `owner_user_id`, `ssl_forced`) values (0, '', 1, 1, 1, '6', NOW(), '["my.domain.com"]', '192.168.31.206', 8265, 'http', 1, 1, 1, '[]', '{}', NOW(), 1, 1) - SQLITE_ERROR: no such function: NOW ``` P.S. I'm using v2.13.7

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@YTKme commented on GitHub (Feb 14, 2026):

I dug a little deeper, it like there are some inconsistency between database and the let's encrypt certificates? When I am starting the container, I realized it was trying to look for a certificate that's already deleted?

@YTKme commented on GitHub (Feb 14, 2026): I dug a little deeper, it like there are some inconsistency between database and the let's encrypt certificates? When I am starting the container, I realized it was trying to look for a certificate that's already deleted?

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@SpasovskiFilip commented on GitHub (Feb 15, 2026):

I dug a little deeper, it like there are some inconsistency between database and the let's encrypt certificates? When I am starting the container, I realized it was trying to look for a certificate that's already deleted?

Don't know if this might help you, but it helped me.
https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5284#issuecomment-3867877807

@SpasovskiFilip commented on GitHub (Feb 15, 2026): > I dug a little deeper, it like there are some inconsistency between database and the let's encrypt certificates? When I am starting the container, I realized it was trying to look for a certificate that's already deleted? Don't know if this might help you, but it helped me. https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5284#issuecomment-3867877807

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@YTKme commented on GitHub (Feb 15, 2026):

I dug a little deeper, it like there are some inconsistency between database and the let's encrypt certificates? When I am starting the container, I realized it was trying to look for a certificate that's already deleted?

Don't know if this might help you, but it helped me. #5284 (comment)

hi @SpasovskiFilip, thank you for the info, i'll give it a try, but not sure where to find the config JSON file.

@YTKme commented on GitHub (Feb 15, 2026): > > I dug a little deeper, it like there are some inconsistency between database and the let's encrypt certificates? When I am starting the container, I realized it was trying to look for a certificate that's already deleted? > > Don't know if this might help you, but it helped me. [#5284 (comment)](https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5284#issuecomment-3867877807) hi @SpasovskiFilip, thank you for the info, i'll give it a try, but not sure where to find the config JSON file.

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@SpasovskiFilip commented on GitHub (Feb 15, 2026):

hi @SpasovskiFilip, thank you for the info, i'll give it a try, but not sure where to find the config JSON file.

I host my NPM via docker, so mine is in the root folder.

Here is my docker volume mapping.
It's called production.json in the NPM.

@SpasovskiFilip commented on GitHub (Feb 15, 2026): > > hi @SpasovskiFilip, thank you for the info, i'll give it a try, but not sure where to find the config JSON file. I host my NPM via docker, so mine is in the root folder. Here is my docker volume mapping. It's called production.json in the NPM. ![Screenshot_2026-02-15-08-40-48-10_3aea4af51f236e4932235fdada7d1643.jpg](https://github.com/user-attachments/assets/4262a8c4-11df-454d-acb5-1b0a42ed65ee)

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@YTKme commented on GitHub (Feb 15, 2026):

hi @SpasovskiFilip, thank you for the info, i'll give it a try, but not sure where to find the config JSON file.

I host my NPM via docker, so mine is in the root folder.

Here is my docker volume mapping. It's called production.json in the NPM.

hmmm, i don't see porduction.json? Is it sqlite-test-db.json?

[root@docker-a13e87e84c83:/app]# cd config/
[root@docker-a13e87e84c83:/app/config]# ls -al
total 20
drwxr-xr-x 2 root root 4096 Feb  5 21:12 .
drwxr-xr-x 1 root root 4096 Feb  5 21:25 ..
-rw-r--r-- 1 root root   87 Feb  5 21:12 README.md
-rw-r--r-- 1 root root  144 Feb  5 21:12 default.json
-rw-r--r-- 1 root root  678 Feb  5 21:12 sqlite-test-db.json
[root@docker-a13e87e84c83:/app/config]#

@YTKme commented on GitHub (Feb 15, 2026): > > hi [@SpasovskiFilip](https://github.com/SpasovskiFilip), thank you for the info, i'll give it a try, but not sure where to find the config JSON file. > > I host my NPM via docker, so mine is in the root folder. > > Here is my docker volume mapping. It's called production.json in the NPM. ![Screenshot_2026-02-15-08-40-48-10_3aea4af51f236e4932235fdada7d1643.jpg](https://github.com/user-attachments/assets/4262a8c4-11df-454d-acb5-1b0a42ed65ee) hmmm, i don't see `porduction.json`? Is it `sqlite-test-db.json`? ```shell [root@docker-a13e87e84c83:/app]# cd config/ [root@docker-a13e87e84c83:/app/config]# ls -al total 20 drwxr-xr-x 2 root root 4096 Feb 5 21:12 . drwxr-xr-x 1 root root 4096 Feb 5 21:25 .. -rw-r--r-- 1 root root 87 Feb 5 21:12 README.md -rw-r--r-- 1 root root 144 Feb 5 21:12 default.json -rw-r--r-- 1 root root 678 Feb 5 21:12 sqlite-test-db.json [root@docker-a13e87e84c83:/app/config]# ```

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@SpasovskiFilip commented on GitHub (Feb 15, 2026):

hmmm, i don't see porduction.json? Is it sqlite-test-db.json?

Could be, either that. Or the default.json
Dont know what's in that.

@SpasovskiFilip commented on GitHub (Feb 15, 2026): >hmmm, i don't see porduction.json? Is it sqlite-test-db.json? Could be, either that. Or the default.json Dont know what's in that.

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@YTKme commented on GitHub (Feb 15, 2026):

hmmm, i don't see porduction.json? Is it sqlite-test-db.json?

Could be, either that. Or the default.json Dont know what's in that.

don't think is default.json

{
  "database": {
    "engine": "mysql2",
    "host": "db",
    "name": "npm",
    "user": "npm",
    "password": "npm",
    "port": 3306
  }
}

@YTKme commented on GitHub (Feb 15, 2026): > > hmmm, i don't see porduction.json? Is it sqlite-test-db.json? > > Could be, either that. Or the default.json Dont know what's in that. don't think is `default.json` ```json { "database": { "engine": "mysql2", "host": "db", "name": "npm", "user": "npm", "password": "npm", "port": 3306 } } ```

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@BartD-Y commented on GitHub (Feb 15, 2026):

I have this setup (by default) with the "better-sqlite3", but still the same error on both ECDSA 256 and RSA 2048.

{
  "database": {
    "engine": "knex-native",
    "knex": {
      "client": "better-sqlite3",
      "connection": {
        "filename": "/data/database.sqlite"
      },
      "useNullAsDefault": true
    }
  }
}

@BartD-Y commented on GitHub (Feb 15, 2026): I have this setup (by default) with the "better-sqlite3", but still the same error on both ECDSA 256 and RSA 2048. ``` { "database": { "engine": "knex-native", "knex": { "client": "better-sqlite3", "connection": { "filename": "/data/database.sqlite" }, "useNullAsDefault": true } } } ```

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@YTKme commented on GitHub (Feb 15, 2026):

I have this setup (by default) with the "better-sqlite3", but still the same error on both ECDSA 256 and RSA 2048.
{
  "database": {
    "engine": "knex-native",
    "knex": {
      "client": "better-sqlite3",
      "connection": {
        "filename": "/data/database.sqlite"
      },
      "useNullAsDefault": true
    }
  }
}

This is interesting, I switched mine over to better-sqlite3 and they seem to work for me? I am using Cloudflare. Maybe there's a deeper root cause. Do you know what error your log is giving?

@YTKme commented on GitHub (Feb 15, 2026): > I have this setup (by default) with the "better-sqlite3", but still the same error on both ECDSA 256 and RSA 2048. > > ``` > { > "database": { > "engine": "knex-native", > "knex": { > "client": "better-sqlite3", > "connection": { > "filename": "/data/database.sqlite" > }, > "useNullAsDefault": true > } > } > } > ``` This is interesting, I switched mine over to `better-sqlite3` and they seem to work for me? I am using Cloudflare. Maybe there's a deeper root cause. Do you know what error your log is giving?

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@SpasovskiFilip commented on GitHub (Feb 15, 2026):

I too use cloudflare... If that's any help

Edit:
Also I don't know if the is related or not, but I got 6 emails in the past 3 days from cloudflare titled Your domain or one of its subdomains has been issued a new SSL/TLS certificate

I usually get one of these emails every 3 months....

@SpasovskiFilip commented on GitHub (Feb 15, 2026): I too use cloudflare... If that's any help Edit: Also I don't know if the is related or not, but I got 6 emails in the past 3 days from cloudflare titled `Your domain or one of its subdomains has been issued a new SSL/TLS certificate` I usually get one of these emails every 3 months....

kerem commented

2026-02-26 07:38:00 +03:00

Author

Owner

@SpasovskiFilip commented on GitHub (Feb 15, 2026):

I have this setup (by default) with the "better-sqlite3", but still the same error on both ECDSA 256 and RSA 2048.
{
  "database": {
    "engine": "knex-native",
    "knex": {
      "client": "better-sqlite3",
      "connection": {
        "filename": "/data/database.sqlite"
      },
      "useNullAsDefault": true
    }
  }
}

For me I don't have the "useNullAsCode" line

{
  "database": {
    "engine": "knex-native",
    "knex": {
      "client": "better-sqlite3",
      "connection": {
        "filename": "/data/database.sqlite"
      }
    }
  }
}

@SpasovskiFilip commented on GitHub (Feb 15, 2026): > I have this setup (by default) with the "better-sqlite3", but still the same error on both ECDSA 256 and RSA 2048. > > ``` > { > "database": { > "engine": "knex-native", > "knex": { > "client": "better-sqlite3", > "connection": { > "filename": "/data/database.sqlite" > }, > "useNullAsDefault": true > } > } > } > ``` For me I don't have the "useNullAsCode" line ``` { "database": { "engine": "knex-native", "knex": { "client": "better-sqlite3", "connection": { "filename": "/data/database.sqlite" } } } } ```

kerem referenced this issue

2026-02-26 08:31:30 +03:00

[PR #3194] [MERGED] certbot-dns-tencentcloud should be 2.0.2 or above. #3667

Rows
Columns

[GH-ISSUE #5301] Getting Internal Error When Creating Certificate ECDSA 256 Key Type With Cloudflare #3164

[GH-ISSUE #5301] Getting `Internal Error` When Creating Certificate ECDSA 256 Key Type With Cloudflare #3164