[PR #2045] Added support for proxying with TSLv1.3 encryption. #3527

New issue

Open

opened 2026-02-26 08:30:58 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 08:30:58 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2045
Author: @moritzbeck13
Created: 5/10/2022
Status: 🔄 Open

Base: develop ← Head: proxy-TLSv1.3

📝 Commits (2)

fff07c0 Added support for proxying with TSLv1.3 encryption.
d40a759 Fixed missing semicolon

📊 Changes

1 file changed (+1 additions, -0 deletions)

View changed files

📝 docker/rootfs/etc/nginx/nginx.conf (+1 -0)

📄 Description

After Portainer dropped support for everything but TLSv1.3 in 2.13, it was noticed (https://github.com/portainer/portainer/issues/6902 and https://github.com/portainer/portainer/issues/6900) that NPM seemed to only offer TLSv1.3 for serving, but not for proxying.
This makes sense, since the ssl_protocols flag is manually set to support TLSv1.2 and TSLv1.3 here, but the respective proxy_ssl_protocols flag is unset, meaning it is relied on the default NGINX setting, which enables support for TLSv1, TLSv1.1 and TLSv1.2, but not TLSv1.3.
Please note that I was not able to test this and just wanted to get the fix out as fast as possible. Since I included all the older versions, that are also in the default settings, unlike the ssl_protocols flag, which theoretically drops support for some older version, the functionality should only be enhanced and there should be no compatibility issues. With regards to the age of some of these older protocols, feel free to change this to exclude support for those, though.
I am not 100% sure about the location for this flag, but I think there is no better place for it. The ssl_protocols is only imported for HTTPS connections, but since you can also proxy an HTTP server over an HTTPS connection, I think it should be included in the main config.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2045 **Author:** [@moritzbeck13](https://github.com/moritzbeck13) **Created:** 5/10/2022 **Status:** 🔄 Open **Base:** `develop` ← **Head:** `proxy-TLSv1.3` --- ### 📝 Commits (2) - [`fff07c0`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/fff07c065d26b18c741d14d0085edd20d03d4052) Added support for proxying with TSLv1.3 encryption. - [`d40a759`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/d40a75917c19e9572e7948f99b2d284d5af4b025) Fixed missing semicolon ### 📊 Changes **1 file changed** (+1 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `docker/rootfs/etc/nginx/nginx.conf` (+1 -0) </details> ### 📄 Description After Portainer dropped support for everything but TLSv1.3 in 2.13, it was noticed (https://github.com/portainer/portainer/issues/6902 and https://github.com/portainer/portainer/issues/6900) that NPM seemed to only offer TLSv1.3 for serving, but not for proxying. This makes sense, since the ssl_protocols flag is manually set to support TLSv1.2 and TSLv1.3 [here](https://github.com/NginxProxyManager/nginx-proxy-manager/blob/4db34f5894a2eb86e99683d52e9b7a859dd206a8/docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf#L5), but the respective proxy_ssl_protocols flag is unset, meaning it is relied on the [default NGINX setting](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_protocols), which enables support for TLSv1, TLSv1.1 and TLSv1.2, but not TLSv1.3. Please note that I was not able to test this and just wanted to get the fix out as fast as possible. Since I included all the older versions, that are also in the default settings, unlike the ssl_protocols flag, which theoretically drops support for some older version, the functionality should only be enhanced and there should be no compatibility issues. With regards to the age of some of these older protocols, feel free to change this to exclude support for those, though. I am not 100% sure about the location for this flag, but I think there is no better place for it. The ssl_protocols is only imported for HTTPS connections, but since you can also proxy an HTTP server over an HTTPS connection, I think it should be included in the main config. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem added the

pull-request

label

2026-02-26 08:30:58 +03:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#3527

No description provided.

Rows
Columns