mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-04-25 17:35:52 +03:00
[GH-ISSUE #593] Generation of self-signed certificates #496
Labels
No labels
awaiting feedback
bug
cannot reproduce
dns provider request
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
need more info
no certbot plugin available
product-support
pull-request
question
stale
troll
upstream issue
v2
v2
v2
v3
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-proxy-manager-NginxProxyManager#496
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @typoworx-de on GitHub (Sep 3, 2020).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/593
Is your feature request related to a problem? Please describe.
I'm running docker instance in intranet/private-network and require https for some docker-instances (like docker-registry). The private-lan runs on TLD ".lan" so it's not possible to use letsencrypt by routing domain-name over router as letsencrypt only supports domains/tld's reachable from intranet.
Describe the solution you'd like
I noticed nginx-proxy-manager already supports custom-certs which is awesome! I would love to have an additional option in that dropdown in section "SSL Certificates" that could be named "Create self-signed certificate" and then routes this request to f.e. the linux-tool mkcert.
https://blog.filippo.io/mkcert-valid-https-certificates-for-localhost/
Describe alternatives you've considered
I could run mkcert on my local machine and manually upload the cert-files into nginx-proxy-manager.
Additional context
I think I'm not the only user who runs a docker instance in private/lan and think this feature would support/help other users as well.
@typoworx-de commented on GitHub (Sep 3, 2020):
As a short proof-of-concept I've run a shell-console on my nginx-proxy-manager docker instance trying this:
@bitsvital commented on GitHub (Apr 22, 2021):
For now I use minica. It's super easy. Just spin up an ubuntu:20.04 docker. I have all the instructions written out. If you want the instructions just message me and I'll send them over to you.
https://github.com/jsha/minica
@WillJBrown commented on GitHub (May 16, 2021):
I'd be interested in those instructions if it automates the process a little more than what typoworx-de described
@jc21 commented on GitHub (May 16, 2021):
The
mkcertbinary is shipped with the docker image, but it's not used by the software yet. I was planning to add it as an option on the SSL dropdown, but other things have taken more priority. PR's are welcome :)@bitsvital commented on GitHub (May 17, 2021):
Hi @WillJBrown ,
I actually created a docker image that does it for you. I have all the instructions typed out in the repository. You can use the docker image or just spin up a Ubuntu image yourself and the instructions are about the same. If you run into any problems, questions, or need any help just let me know. I’ll be more than happy to help you.
Here is the the docker image.
https://hub.docker.com/r/bitsvital/minica-bv
@WillJBrown commented on GitHub (May 18, 2021):
Thanks for that @bitsvital. I got it working today thanks to your page. you might like to clarify that the cert you have to share to clients is the root minica one whereas the one npm needs is the domain specific one. Also thanks to you @jc21 for npm - It's made all the local proxies I set up today so much easier. I don't know any web dev otherwise I would definitely work on a pull request to get this implemented. My knowledge is more in c#, fortran, python, etc. apologies.
@bitsvital commented on GitHub (May 18, 2021):
@WillJBrown no problem. Thanks for the FYI. I will update that this evening. Feel free to contact me anytime if you need further assistance.
@Albonycal commented on GitHub (Jan 19, 2022):
any updates on this?
@bonelifer commented on GitHub (Jul 27, 2022):
Having mkcert would be awesome as some of my homelab is local only.
@ThomasHineXYZ commented on GitHub (Feb 4, 2023):
Is there any update for this?
@onlineapps-cloud commented on GitHub (Mar 18, 2023):
Any updates?
@tapionx commented on GitHub (Oct 21, 2023):
It would be nice to have this!
@flavienbwk commented on GitHub (Dec 4, 2023):
Indeed it might be nice. It looks like it was possible before. Why was it removed ?
@github-actions[bot] commented on GitHub (Jul 8, 2024):
Issue is now considered stale. If you want to keep it open, please comment 👍
@flavienbwk commented on GitHub (Jul 8, 2024):
Community wants to keep it open
@onlineapps-cloud commented on GitHub (Jul 8, 2024):
agree with you.
@robnewport commented on GitHub (Jul 8, 2024):
Please keep this open and active.
@W1BTR commented on GitHub (Sep 26, 2024):
This is still a much wanted feature! Would love to see this added.
@an0o0nym commented on GitHub (Sep 29, 2024):
I would also love to to see it working with NPM!
@github-actions[bot] commented on GitHub (May 5, 2025):
Issue is now considered stale. If you want to keep it open, please comment 👍
@flavienbwk commented on GitHub (May 5, 2025):
👍
@tapionx commented on GitHub (May 5, 2025):
yes
@huco95 commented on GitHub (May 9, 2025):
👍
@noto10 commented on GitHub (Jun 4, 2025):
👍
@r-nd-m commented on GitHub (Jun 4, 2025):
👍
@alexunderboots commented on GitHub (Jun 11, 2025):
@itzTheMeow commented on GitHub (Aug 26, 2025):
@jc21 is this something I am able to work on? I saw elsewhere you were redoing the frontend in react, would this interfere?
@jc21 commented on GitHub (Aug 26, 2025):
Yeah it might interfere with the react rewrite. Given the explanation on #4525 wouldn't using a separate self-hosted CA be better? the only limitation is that this project doesn't properly support using a specific CA url in the certbot command on a per-certificate basis.
For example, in the test stack, I spin up StepCA container and PowerDNS when I request a cert for
website.example.comit's able to issue a certificate locally. PowerDNS is only required for DNS01 certs. In order for this to work, these env vars are present:If they could be defined on a per-certificate level in NPM, then you'd be set to provision your own stuff.
In my v3 prototype I was working on the principle of having CertificateAuthorities rows that would be selectable when requesting certs.
A little bit off topic but I know this q is going to come up: Instead of pumping a lot of effort finishing v3 I'm trying to backport concepts back into v2 slowly until it is eventually v3. The first thing is React.
@itzTheMeow commented on GitHub (Aug 26, 2025):
The certificate authority table approach seems best. Currently the way I am generating certificates is using openssl, rather than a URL or ACME server.