starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-26 01:45:54 +03:00

[GH-ISSUE #663] Not possible to import custom certificate key using elliptic curve instead of rsa #559

New issue

Closed

opened 2026-02-26 06:33:23 +03:00 by kerem · 3 comments

kerem commented

2026-02-26 06:33:23 +03:00

Owner

Originally created by @mkochenough on GitHub (Oct 16, 2020).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/663

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?

Yes

Are you sure you're not using someone else's docker image?

Yes

If having problems with Lets Encrypt, have you made absolutely sure your site is accessible from outside of your network?

I'm not using Lets Encrypt. This is for network internal usage.

Describe the bug

I used Nginx Proxy Manager v2.6.1.

I tried to add a custom certificate. I gave it a name and added its key and the certificate itself. After clicking "Save" the an error message is displayed:

Upload failed: Certificate Key is not valid (Command failed: openssl rsa -in /tmp/9c58b1f7-db1a-4806-bc91-fb6ee547fb32/tmp -check -noout 140620246457672:error:0607907F:digital envelope routines:EVP_PKEY_get0_RSA:expecting an rsa key:crypto/evp/p_lib.c:469: )

This is understandable is the key uses an elliptic curve instead of rsa. The problem is in backend/internal/certificate.js in the checkPrivateKey method. There an external command is executed with "openssl rsa -in ....".

Executing the same command locally on the key shows the same error. Exchanging "rsa" with "ec" solves the problem locally.

Somehow NPM should detect if an RSA or an EC key is used an use the proper command. Or just check EC if RSA failed before.

Originally created by @mkochenough on GitHub (Oct 16, 2020). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/663 **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? Yes - Are you sure you're not using someone else's docker image? Yes - If having problems with Lets Encrypt, have you made absolutely sure your site is accessible from outside of your network? I'm not using Lets Encrypt. This is for network internal usage. **Describe the bug** I used Nginx Proxy Manager v2.6.1. I tried to add a custom certificate. I gave it a name and added its key and the certificate itself. After clicking "Save" the an error message is displayed: Upload failed: Certificate Key is not valid (Command failed: openssl rsa -in /tmp/9c58b1f7-db1a-4806-bc91-fb6ee547fb32/tmp -check -noout 140620246457672:error:0607907F:digital envelope routines:EVP_PKEY_get0_RSA:expecting an rsa key:crypto/evp/p_lib.c:469: ) This is understandable is the key uses an elliptic curve instead of rsa. The problem is in backend/internal/certificate.js in the checkPrivateKey method. There an external command is executed with "openssl rsa -in ....". Executing the same command locally on the key shows the same error. Exchanging "rsa" with "ec" solves the problem locally. Somehow NPM should detect if an RSA or an EC key is used an use the proper command. Or just check EC if RSA failed before.

kerem

2026-02-26 06:33:23 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-26 06:33:24 +03:00

Author

Owner

@MarceloLagos commented on GitHub (Oct 17, 2020):

The check is easy, but for some reason the validation of the result is empty (when I test) if ec is used in the openssl check.
let key_type = private_key.includes('-BEGIN RSA') ? 'rsa' : 'ec';
return utils.exec('openssl '+key_type+' -in ' + filepath + ' -check -noout')
.then((result) => {

The RSA check output is one line:
RSA key ok
while the EC check output is 2 lines:
read EC key
EC Key valid.

Whenever I check result when using ec, it's empty.
Any ideas?

Edit:
Just to clarify, I used the code above and then verified the error with the line below in the meantime:
if (!result.toLowerCase().includes('key ok') && !(result==="") ) {

@MarceloLagos commented on GitHub (Oct 17, 2020): The check is easy, but for some reason the validation of the result is empty (when I test) if ec is used in the openssl check. `let key_type = private_key.includes('-BEGIN RSA') ? 'rsa' : 'ec';` `return utils.exec('openssl '+key_type+' -in ' + filepath + ' -check -noout')` `.then((result) => {` The RSA check output is one line: `RSA key ok` while the EC check output is 2 lines: `read EC key` `EC Key valid.` Whenever I check `result` when using ec, it's empty. Any ideas? Edit: Just to clarify, I used the code above and then verified the error with the line below in the meantime: ` if (!result.toLowerCase().includes('key ok') && !(result==="") ) {`

kerem commented

2026-02-26 06:33:24 +03:00

Author

Owner

@MarceloLagos commented on GitHub (Oct 18, 2020):

The problem was openssl command was throwing the EC validation output as error (even though is successful).
Adding 2>&1 at the end of the command will put error output in standard output and therefore the output will be captured either way. Also, the following string validation needs an additional condition since the message for EC keys doesn't contain "key ok".
I've created Pull #666 with these changes.

@MarceloLagos commented on GitHub (Oct 18, 2020): The problem was openssl command was throwing the EC validation output as error (even though is successful). Adding 2>&1 at the end of the command will put error output in standard output and therefore the output will be captured either way. Also, the following string validation needs an additional condition since the message for EC keys doesn't contain "key ok". I've created Pull #666 with these changes.

kerem commented

2026-02-26 06:33:24 +03:00

Author

Owner

@mkochenough commented on GitHub (Oct 18, 2020):

@MarceloLagos You are right. Tested your branch and it works perfectly. Closing my pull request.

@mkochenough commented on GitHub (Oct 18, 2020): @MarceloLagos You are right. Tested your branch and it works perfectly. Closing my pull request.

kerem referenced this issue

2026-02-26 07:38:40 +03:00

[PR #559] [MERGED] Removed the hardcoded --webroot certbot argument to better support DNS challenge #3265

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#559

No description provided.

Rows
Columns