starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-26 09:55:51 +03:00

[GH-ISSUE #456] Let's encrypt wildcard certificate #384

New issue

Closed

opened 2026-02-26 06:32:38 +03:00 by kerem · 7 comments

kerem commented

2026-02-26 06:32:38 +03:00

Owner

Originally created by @collunz on GitHub (Jun 10, 2020).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/456

Checklist

Please read the setup instructions
Please read the FAQ

What is troubling you?
Not being able to create a wildcard certificate, but i was wondering if i create one manually on the server, would it show up in the GUI? Or can i move it to a directory so it would show up?

Thank you in advance :)

Clear and concise description of what you're trying to do and what isn't working for you

Originally created by @collunz on GitHub (Jun 10, 2020). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/456 **Checklist** - Please read the [setup instructions](https://nginxproxymanager.com/setup/) - Please read the [FAQ](https://nginxproxymanager.com/faq/) **What is troubling you?** Not being able to create a wildcard certificate, but i was wondering if i create one manually on the server, would it show up in the GUI? Or can i move it to a directory so it would show up? Thank you in advance :) _Clear and concise description of what you're trying to do and what isn't working for you_

kerem

2026-02-26 06:32:38 +03:00

closed this issue
added the
product-support
label

kerem commented

2026-02-26 06:32:38 +03:00

Author

Owner

@redtripleAAA commented on GitHub (Jul 2, 2020):

You may use this online service to create a quick wildcard cert:

https://www.shieldsigned.com/

@redtripleAAA commented on GitHub (Jul 2, 2020): You may use this online service to create a quick wildcard cert: [https://www.shieldsigned.com/](url)

kerem commented

2026-02-26 06:32:38 +03:00

Author

Owner

@bobvmierlo commented on GitHub (Jul 2, 2020):

Using that website will force the user to manually renew the certificate every 90 days. While Nginx proxy manager does that for you. I would love to see this wildcard possibility build in aswell.

@bobvmierlo commented on GitHub (Jul 2, 2020): Using that website will force the user to manually renew the certificate every 90 days. While Nginx proxy manager does that for you. I would love to see this wildcard possibility build in aswell.

kerem commented

2026-02-26 06:32:39 +03:00

Author

Owner

@redtripleAAA commented on GitHub (Jul 2, 2020):

Yeah, that would be nice to have it build-in and you can export it from the proxy manager, but, yeah that would just a workaround to help in the meantime @bobvmierlo

@redtripleAAA commented on GitHub (Jul 2, 2020): Yeah, that would be nice to have it build-in and you can export it from the proxy manager, but, yeah that would just a workaround to help in the meantime @bobvmierlo

kerem commented

2026-02-26 06:32:39 +03:00

Author

Owner

@TWhidden commented on GitHub (Jul 8, 2020):

I haven't studied the NPM API, but @jc21 in another thread said we could maybe curl the updated cert info into it. I am using another container for google cloud dns / letsencrypt (adferrand/letsencrypt-dns ), and it updates regularly the past several years (wildcard cert) - it has the hooks post-update, which could then maybe execute a shell script, to push the new certs into the API. This container is much nicer than having a directory full of nginx conf files, requiring shell access to edit, so the DNS challenge is the only thing missing. Our provider blocks port 80 :( Major one too.

If anyone has some examples of how to throw the /live/somedomain.com/{cert.pem,chain.pem,fullchain.pem,privkey.pem} certs into the API with a simple shell command, I could settle for that ;)

@TWhidden commented on GitHub (Jul 8, 2020): I haven't studied the NPM API, but @jc21 in another thread said we could maybe `curl` the updated cert info into it. I am using another container for google cloud dns / letsencrypt (`adferrand/letsencrypt-dns `), and it updates regularly the past several years (wildcard cert) - it has the hooks post-update, which could then maybe execute a shell script, to push the new certs into the API. This container is much nicer than having a directory full of nginx conf files, requiring shell access to edit, so the DNS challenge is the only thing missing. Our provider blocks port 80 :( Major one too. If anyone has some examples of how to throw the `/live/somedomain.com/{cert.pem,chain.pem,fullchain.pem,privkey.pem}` certs into the API with a simple shell command, I could settle for that ;)

kerem commented

2026-02-26 06:32:39 +03:00

Author

Owner

@buffcode commented on GitHub (Aug 10, 2020):

I managed to install and update an wildcard certificate with the following steps:

Setup proxy host in NPM (Nginx Proxy Manager) for both domain and wildcard subdomain
Setup SSL certificate for just the domain (wildcard input is currently not possible).

Up until here you should have SSL working for the domain, but not the subdomains.

If using Docker, ensure that /etc/letsencrypt is mounted to your host
Modify /etc/letsencrypt/renewal/npm-<id>.conf and update the section [renewalparams]:

authenticator = manual
manual_public_ip_logging_ok = True
manual_auth_hook = /etc/letsencrypt/custom-auth.sh
manual_cleanup_hook = /etc/letsencrypt/custom-cleanup.sh

Extend the certificate (replace <domain>):

# if using docker prepend with eg. `docker-compose exec nginx-proxy-manager`
certbot certonly --manual --cert-name npm-<id> \
  --expand -d <domain>,*.<domain> \ 
  --manual-auth-hook=/etc/letsencrypt/custom-auth.sh \
  --manual-cleanup-hook=/etc/letsencrypt/custom-cleanup.sh

Now the two scripts custom-auth.sh and custom-cleanup.sh will be triggered before and after a certificate renewal.

In my case I used GoDaddy to update the DNS configuration. Renewal and NPM backend modifications are working fine so far.

@buffcode commented on GitHub (Aug 10, 2020): I managed to install and update an wildcard certificate with the following steps: 1. Setup proxy host in NPM (Nginx Proxy Manager) for both domain and wildcard subdomain 2. Setup SSL certificate for just the domain (wildcard input is currently not possible). Up until here you should have SSL working for the domain, but not the subdomains. 3. If using Docker, ensure that `/etc/letsencrypt` is mounted to your host 4. Modify `/etc/letsencrypt/renewal/npm-<id>.conf` and update the section `[renewalparams]`: ```ini authenticator = manual manual_public_ip_logging_ok = True manual_auth_hook = /etc/letsencrypt/custom-auth.sh manual_cleanup_hook = /etc/letsencrypt/custom-cleanup.sh ``` 5. Extend the certificate (replace `<domain>`): ``` # if using docker prepend with eg. `docker-compose exec nginx-proxy-manager` certbot certonly --manual --cert-name npm-<id> \ --expand -d <domain>,*.<domain> \ --manual-auth-hook=/etc/letsencrypt/custom-auth.sh \ --manual-cleanup-hook=/etc/letsencrypt/custom-cleanup.sh ``` Now the two scripts `custom-auth.sh` and `custom-cleanup.sh` will be triggered [before and after a certificate renewal](https://certbot.eff.org/docs/using.html#pre-and-post-validation-hooks). In my case I used GoDaddy to update the DNS configuration. Renewal and NPM backend modifications are working fine so far.

kerem commented

2026-02-26 06:32:39 +03:00

Author

Owner

@lauer commented on GitHub (Apr 5, 2021):

I was trying this approach, until I found out, that I could just add the *.domain.tld as a new let's encrypt certificate using the web UI. That works without problems.

So I guess this issue can be closed?

@lauer commented on GitHub (Apr 5, 2021): I was trying this approach, until I found out, that I could just add the *.domain.tld as a new let's encrypt certificate using the web UI. That works without problems. So I guess this issue can be closed?

kerem commented

2026-02-26 06:32:39 +03:00

Author

Owner

@chaptergy commented on GitHub (May 9, 2021):

Yes, this is possible with the dns challenge since the end of 2020.

@chaptergy commented on GitHub (May 9, 2021): Yes, this is possible with the dns challenge since the end of 2020.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#384

No description provided.

Rows
Columns