[GH-ISSUE #564] Cannot specify ciphers?

kerem commented

2026-02-26 06:32:59 +03:00

Owner

Originally created by @sbazzell on GitHub (Aug 17, 2020).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/564

Whenever I try to specify ciphers the way I would normally do using nginx vanilla, the proxy host goes to offline status.

So does

ssl_ciphers 'insert cipher list here';

and

ssl_prefer_server_ciphers on;

not work?

Originally created by @sbazzell on GitHub (Aug 17, 2020). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/564 Whenever I try to specify ciphers the way I would normally do using nginx vanilla, the proxy host goes to offline status. So does > ssl_ciphers 'insert cipher list here'; and > ssl_prefer_server_ciphers on; not work?

kerem added the

stale

label

2026-02-26 06:32:59 +03:00

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@dash74 commented on GitHub (Aug 27, 2020):

It looks like the only was too edit the ciphers would be to edit /etc/nginx/conf.d/include/ssl-ciphers.conf inside the docker container. You can do this by running docker exec -it "docker-name" bash. After editing the file you type exit. You'll have to commit the changes to a new file by running sudo docker commit [CONTAINER_ID] [new_image_name].

@dash74 commented on GitHub (Aug 27, 2020): It looks like the only was too edit the ciphers would be to edit /etc/nginx/conf.d/include/ssl-ciphers.conf inside the docker container. You can do this by running docker exec -it "docker-name" bash. After editing the file you type exit. You'll have to commit the changes to a new file by running sudo docker commit [CONTAINER_ID] [new_image_name].

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Mattie112 commented on GitHub (Sep 7, 2020):

Yes I also want to change the ciphers. Any chance we can have this also exported in a volume just like the (optional) config files.

@Mattie112 commented on GitHub (Sep 7, 2020): Yes I also want to change the ciphers. Any chance we can have this also exported in a volume just like the (optional) config files.

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Mattie112 commented on GitHub (Sep 7, 2020):

I did find a solution / workaround.

Simply create your own cipher file (outside of the container), for example generate it here https://ssl-config.mozilla.org/ but only use the protocols/ciphers part.

Now simply mount this file into the container
/etc/nginx/conf.d/include/ssl-ciphers.conf:/path/to/local/file/myown-custom-ssl-ciphers.conf

And now you have your own ciphers. Downside is that this no longer benefits from updates from the NPM itself. So you might want to check https://github.com/jc21/nginx-proxy-manager/blob/master/docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf from time to time to check your file is up to date.

@Mattie112 commented on GitHub (Sep 7, 2020): I did find a solution / workaround. Simply create your own cipher file (outside of the container), for example generate it here https://ssl-config.mozilla.org/ but only use the protocols/ciphers part. Now simply mount this file into the container `/etc/nginx/conf.d/include/ssl-ciphers.conf:/path/to/local/file/myown-custom-ssl-ciphers.conf` And now you have your own ciphers. Downside is that this no longer benefits from updates from the NPM itself. So you might want to check https://github.com/jc21/nginx-proxy-manager/blob/master/docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf from time to time to check your file is up to date.

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Kopernikus1979 commented on GitHub (Apr 5, 2022):

I did find a solution / workaround.

Simply create your own cipher file (outside of the container), for example generate it here https://ssl-config.mozilla.org/ but only use the protocols/ciphers part.

Now simply mount this file into the container /etc/nginx/conf.d/include/ssl-ciphers.conf:/path/to/local/file/myown-custom-ssl-ciphers.conf

And now you have your own ciphers. Downside is that this no longer benefits from updates from the NPM itself. So you might want to check https://github.com/jc21/nginx-proxy-manager/blob/master/docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf from time to time to check your file is up to date.

@Mattie112

Could you help me mount /etc/nginx/conf.d/include/ssl-ciphers.conf:/path/to/local/file/myown-custom-ssl-ciphers.conf?
I 'm using Unraid and tried it but I only seem to be able to mount a directory not a file.

Thx

@Kopernikus1979 commented on GitHub (Apr 5, 2022): > I did find a solution / workaround. > > Simply create your own cipher file (outside of the container), for example generate it here https://ssl-config.mozilla.org/ but only use the protocols/ciphers part. > > Now simply mount this file into the container `/etc/nginx/conf.d/include/ssl-ciphers.conf:/path/to/local/file/myown-custom-ssl-ciphers.conf` > > And now you have your own ciphers. Downside is that this no longer benefits from updates from the NPM itself. So you might want to check https://github.com/jc21/nginx-proxy-manager/blob/master/docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf from time to time to check your file is up to date. @Mattie112 Could you help me mount /etc/nginx/conf.d/include/ssl-ciphers.conf:/path/to/local/file/myown-custom-ssl-ciphers.conf? I 'm using Unraid and tried it but I only seem to be able to mount a directory not a file. Thx

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Mattie112 commented on GitHub (Apr 5, 2022):

You should be able to just type it in :)

@Mattie112 commented on GitHub (Apr 5, 2022): ![image](https://user-images.githubusercontent.com/662896/161726289-880b8bd5-7985-4866-ad65-8da1e8481ace.png) You should be able to just type it in :)

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Kopernikus1979 commented on GitHub (Apr 5, 2022):

You should be able to just type it in :)

Hi,

Tried it, but I get this error in my docker log:

If I go to /etc/nginx/conf.d/include/ssl-ciphers.conf I see it's my new modded file, however settings are not loaded when doing cryptcheck.fr for my domain

@Kopernikus1979 commented on GitHub (Apr 5, 2022): > ![image](https://user-images.githubusercontent.com/662896/161726289-880b8bd5-7985-4866-ad65-8da1e8481ace.png) > > You should be able to just type it in :) Hi, Tried it, but I get this error in my docker log: ![Schermafbeelding 2022-04-05 153922](https://user-images.githubusercontent.com/53930186/161767121-7febcca0-7e75-4df4-9c23-e673aab6f034.jpg) If I go to /etc/nginx/conf.d/include/ssl-ciphers.conf I see it's my new modded file, however settings are not loaded when doing cryptcheck.fr for my domain

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Mattie112 commented on GitHub (Apr 5, 2022):

Can you run docker inspect NginxProxyManager

And check the following part:

        "HostConfig": {
            "Binds": [
                "/mnt/user/appdata/NginxProxyManager/matthijs-custom-ssl-ciphers.conf:/etc/nginx/conf.d/include/ssl-ciphers.conf:rw",
                "/mnt/user/appdata/NginxProxyManager:/config:rw"
            ],

You can see how I have it and that does work. Does it look different for you?

@Mattie112 commented on GitHub (Apr 5, 2022): Can you run `docker inspect NginxProxyManager` And check the following part: ``` "HostConfig": { "Binds": [ "/mnt/user/appdata/NginxProxyManager/matthijs-custom-ssl-ciphers.conf:/etc/nginx/conf.d/include/ssl-ciphers.conf:rw", "/mnt/user/appdata/NginxProxyManager:/config:rw" ], ``` You can see how I have it and that does work. Does it look different for you?

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Kopernikus1979 commented on GitHub (Apr 5, 2022):

I got this:

"Mounts": [
           {
               "Type": "bind",
               "Source": "/tmp/Nginx-Proxy-Manager-Official/var/log",
               "Destination": "/var/log",
               "Mode": "rw",
               "RW": true,
               "Propagation": "rprivate"
           },
           {
               "Type": "bind",
               "Source": "/mnt/user/appdata/Nginx-Proxy-Manager-Official/custom-ssl-ciphers.conf",
               "Destination": "/etc/nginx/conf.d/include/ssl-ciphers.conf",
               "Mode": "rw",
               "RW": true,
               "Propagation": "rprivate"
           },
           {
               "Type": "bind",
               "Source": "/mnt/user/appdata/Nginx-Proxy-Manager-Official/data",
               "Destination": "/data",
               "Mode": "rw",
               "RW": true,
               "Propagation": "rprivate"
           },
           {
               "Type": "bind",
               "Source": "/mnt/user/appdata/Nginx-Proxy-Manager-Official/letsencrypt",
               "Destination": "/etc/letsencrypt",
               "Mode": "rw",
               "RW": true,
               "Propagation": "rprivate"

@Kopernikus1979 commented on GitHub (Apr 5, 2022): I got this: ``` "Mounts": [ { "Type": "bind", "Source": "/tmp/Nginx-Proxy-Manager-Official/var/log", "Destination": "/var/log", "Mode": "rw", "RW": true, "Propagation": "rprivate" }, { "Type": "bind", "Source": "/mnt/user/appdata/Nginx-Proxy-Manager-Official/custom-ssl-ciphers.conf", "Destination": "/etc/nginx/conf.d/include/ssl-ciphers.conf", "Mode": "rw", "RW": true, "Propagation": "rprivate" }, { "Type": "bind", "Source": "/mnt/user/appdata/Nginx-Proxy-Manager-Official/data", "Destination": "/data", "Mode": "rw", "RW": true, "Propagation": "rprivate" }, { "Type": "bind", "Source": "/mnt/user/appdata/Nginx-Proxy-Manager-Official/letsencrypt", "Destination": "/etc/letsencrypt", "Mode": "rw", "RW": true, "Propagation": "rprivate" ```

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Kopernikus1979 commented on GitHub (Apr 5, 2022):

Just found something strange seems in the lastest version of NPM the ciphers are already compliant with the latest mozilla recommends, however when doing a check it still uses old ciphers, can you do a cryptcheck to see your result?

@Kopernikus1979 commented on GitHub (Apr 5, 2022): Just found something strange seems in the lastest version of NPM the ciphers are already compliant with the latest mozilla recommends, however when doing a check it still uses old ciphers, can you do a cryptcheck to see your result?

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Mattie112 commented on GitHub (Apr 5, 2022):

Ah yeah might be fair to say I use this repo:

https://github.com/Mattie112/docker-nginx-proxy-manager (and that is a fork of https://github.com/jlesage/docker-nginx-proxy-manager)

I think it uses / used to use this project but yeah that was a while ago..... So it could be that here the paths are changed, sorry can't keep track on what repo I use exactly :p

Anyway, my file:

ssl_session_timeout 5m;
ssl_session_cache shared:SSL:50m;

# intermediate configuration. tweak to your needs.
    # intermediate configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

I always use https://www.ssllabs.com/ssltest/ for checking (A+ for me) but here is the output from your site:

@Mattie112 commented on GitHub (Apr 5, 2022): Ah yeah might be fair to say I use this repo: https://github.com/Mattie112/docker-nginx-proxy-manager (and that is a fork of https://github.com/jlesage/docker-nginx-proxy-manager) I think it uses / used to use this project but yeah that was a while ago..... So it could be that here the paths are changed, sorry can't keep track on what repo I use exactly :p Anyway, my file: ``` ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; # intermediate configuration. tweak to your needs. # intermediate configuration ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; ``` I always use https://www.ssllabs.com/ssltest/ for checking (A+ for me) but here is the output from your site: ![image](https://user-images.githubusercontent.com/662896/161817981-3552ea58-345a-49e5-9d63-5ae30113b505.png)

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Kopernikus1979 commented on GitHub (Apr 7, 2022):

@Mattie112

Hi,

I found the problem.
See my bug report:

https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1982

@Kopernikus1979 commented on GitHub (Apr 7, 2022): @Mattie112 Hi, I found the problem. See my bug report: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1982

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Mattie112 commented on GitHub (Apr 7, 2022):

Yeah I'm doing that manually from time to time XD Have to look into github pipelines (or whatever it is called) at some point.

I just pushed mattie112/docker-nginx-proxy-manager:latest (and :master and :v1.26.0) to be up-to-date with jlesage again :)

(And the reason I made my own fork because I kinda liked the all-in-one solution but I needed 80/443 so yeah I just choose this solution).

edit:
You can always drop me a message if you need some changes to be merged just open an issue on my fork :)

@Mattie112 commented on GitHub (Apr 7, 2022): Yeah I'm doing that manually from time to time XD Have to look into github pipelines (or whatever it is called) at some point. I just pushed `mattie112/docker-nginx-proxy-manager:latest` (and `:master` and `:v1.26.0`) to be up-to-date with jlesage again :) (And the reason I made my own fork because I kinda liked the all-in-one solution but I needed 80/443 so yeah I just choose this solution). edit: You can always drop me a message if you need some changes to be merged just open an issue on my fork :)

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Mar 26, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Mar 26, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@Xyz00777 commented on GitHub (Dec 13, 2024):

this is as far as i know still not working :(
when does these can be fixed?

@Xyz00777 commented on GitHub (Dec 13, 2024): this is as far as i know still not working :( when does these can be fixed?

kerem commented

2026-02-26 06:32:59 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jun 22, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Jun 22, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:

Rows
Columns

[GH-ISSUE #564] Cannot specify ciphers? #472