[GH-ISSUE #768] Add client certificate support

kerem commented

2026-02-26 06:33:51 +03:00

Owner

Originally created by @Likqez on GitHub (Dec 11, 2020).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/768

Implement client certificates

Is your feature request related to a problem? Please describe.
I am securing my web applications with Cloudflare access. I did all the proxing through manual configuration of a nginx server.
But because I am running more and more applications, I wanted to have a nice GUI like this from npm.
As long npm does not support client certificates, I can not protect my website from unwanted access.

Describe the solution you'd like
I would like a feature to upload an SSL Cert without a key. Which is currently not possible. And then use it inside a proxy host, to verify the clients certificate.

Originally created by @Likqez on GitHub (Dec 11, 2020). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/768 ### Implement client certificates **Is your feature request related to a problem? Please describe.** I am securing my web applications with Cloudflare access. I did all the proxing through manual configuration of a nginx server. But because I am running more and more applications, I wanted to have a nice GUI like this from npm. As long npm does not support client certificates, I can not protect my website from unwanted access. **Describe the solution you'd like** I would like a feature to upload an SSL Cert without a key. Which is currently not possible. And then use it inside a proxy host, to verify the clients certificate.

kerem added the

enhancement

label

2026-02-26 06:33:51 +03:00

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@dmwilson1990 commented on GitHub (Sep 5, 2021):

With a bit of a workaround it is possible to do this. For whatever reason you're very limited in what you can add to the Edit Proxy Host >> Advance >> Custom Nginx Configuration section. However, you can put include. I wanted to authenticate with my smart card so I added two read only binds to the docker-compose stack:

      - /docker/proxy/DoD_CAs.pem:/etc/ssl/certs/DoD_CAs.pem:ro
      - /docker/proxy/cac_auth.conf:/etc/nginx/conf.d/include/cac_auth.conf:ro

Inside the custom nginx configuration section I added include conf.d/include/cac_auth.conf;

You should be able to add any custom nginx config using this method that would otherwise be unsupported in NPM. Here's what is inside my cac_auth.conf.

ssl_client_certificate /etc/ssl/certs/DoD_CAs.pem;
ssl_verify_client on;
if ($ssl_client_s_dn !~ "CN=YOURCERTCOMMONNAMEHERE") {
  return 403;
}

@dmwilson1990 commented on GitHub (Sep 5, 2021): With a bit of a workaround it is possible to do this. For whatever reason you're very limited in what you can add to the Edit Proxy Host >> Advance >> Custom Nginx Configuration section. However, you can put **include**. I wanted to authenticate with my smart card so I added two read only binds to the docker-compose stack: ``` - /docker/proxy/DoD_CAs.pem:/etc/ssl/certs/DoD_CAs.pem:ro - /docker/proxy/cac_auth.conf:/etc/nginx/conf.d/include/cac_auth.conf:ro ``` Inside the custom nginx configuration section I added `include conf.d/include/cac_auth.conf;` You should be able to add any custom nginx config using this method that would otherwise be unsupported in NPM. Here's what is inside my cac_auth.conf. ``` ssl_client_certificate /etc/ssl/certs/DoD_CAs.pem; ssl_verify_client on; if ($ssl_client_s_dn !~ "CN=YOURCERTCOMMONNAMEHERE") { return 403; } ```

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@Likqez commented on GitHub (Sep 5, 2021):

Thanks for the tip!
Native support would be awesome tho :)

@Likqez commented on GitHub (Sep 5, 2021): Thanks for the tip! Native support would be awesome tho :)

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@ybizeul commented on GitHub (Nov 4, 2023):

Tried @dmwilson1990 recommendation :

Command failed: /usr/sbin/nginx -t -g "error_log off;" nginx: [emerg] invalid condition "!~" in /etc/nginx/conf.d/include/client_cert.conf:3 nginx: configuration file /etc/nginx/nginx.conf test failed

That's the file content :

ssl_client_certificate /data/custom_ssl/tynsoe_ca.pem;
ssl_verify_client on;
if ($ssl_client_s_dn !~ "CN=yann") {
  return 403;
}

EDIT: It might have been that I didn't have Safari sending the certificate, because I didn't have it in my keychain yet. I removed the block totally though, as I'm assuming it'll trust any CA generated certificate in that case

@ybizeul commented on GitHub (Nov 4, 2023): Tried @dmwilson1990 recommendation : ``` Command failed: /usr/sbin/nginx -t -g "error_log off;" nginx: [emerg] invalid condition "!~" in /etc/nginx/conf.d/include/client_cert.conf:3 nginx: configuration file /etc/nginx/nginx.conf test failed ``` That's the file content : ``` ssl_client_certificate /data/custom_ssl/tynsoe_ca.pem; ssl_verify_client on; if ($ssl_client_s_dn !~ "CN=yann") { return 403; } ``` EDIT: It might have been that I didn't have Safari sending the certificate, because I didn't have it in my keychain yet. I removed the block totally though, as I'm assuming it'll trust any CA generated certificate in that case

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (May 19, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (May 19, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@CsBigDataHub commented on GitHub (Aug 15, 2024):

Yes this is a desired feature.

@CsBigDataHub commented on GitHub (Aug 15, 2024): Yes this is a desired feature.

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@kintoxo commented on GitHub (Sep 9, 2024):

Please add built-in support for using user certificates in nginx-proxy-manager.

@kintoxo commented on GitHub (Sep 9, 2024): Please add built-in support for using user certificates in nginx-proxy-manager.

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@GregTheHun commented on GitHub (Sep 13, 2024):

I would also like this as well

@GregTheHun commented on GitHub (Sep 13, 2024): I would also like this as well

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@metahertz commented on GitHub (Sep 24, 2024):

Please add your support for a working PR for this feature w/full UI support by @wrouesnel here: https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2956

@metahertz commented on GitHub (Sep 24, 2024): Please add your support for a working PR for this feature w/full UI support by @wrouesnel here: https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2956

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@xpire commented on GitHub (Dec 7, 2024):

How can we support this PR further? Do you mean take over the PR and fix the broken tests?

@xpire commented on GitHub (Dec 7, 2024): How can we support this PR further? Do you mean take over the PR and fix the broken tests?

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@lerra commented on GitHub (Dec 8, 2024):

I would also like to see the support for client certificate, I would then be able to use resources directly out in the public internet instead of having it behind my vpn, I would implement the workaround mean while :)

Btw thanks for a great open source project

@lerra commented on GitHub (Dec 8, 2024): I would also like to see the support for client certificate, I would then be able to use resources directly out in the public internet instead of having it behind my vpn, I would implement the workaround mean while :) Btw thanks for a great open source project

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@kylmp commented on GitHub (Jan 7, 2025):

Will also +1 support for this feature. This application seems like it is well made, but that's a feature I need so for me I will switch to regular old nginx for now. I don't really see the point in figuring out work arounds thru this app when the regular old config files way exists.

@kylmp commented on GitHub (Jan 7, 2025): Will also +1 support for this feature. This application seems like it is well made, but that's a feature I need so for me I will switch to regular old nginx for now. I don't really see the point in figuring out work arounds thru this app when the regular old config files way exists.

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@cgfrost commented on GitHub (Mar 16, 2025):

I'd love to see support for this. Sorry to see a great PR exists but has been ignored. https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2956

@cgfrost commented on GitHub (Mar 16, 2025): I'd love to see support for this. Sorry to see a great PR exists but has been ignored. https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2956

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Sep 21, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Sep 21, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@lerra commented on GitHub (Sep 21, 2025):

I still see a big value to get this feature

@lerra commented on GitHub (Sep 21, 2025): I still see a big value to get this feature

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@StoyanBorisovBG commented on GitHub (Oct 13, 2025):

If that becomes a feature, it'd be awesome!

@StoyanBorisovBG commented on GitHub (Oct 13, 2025): If that becomes a feature, it'd be awesome!

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@Psantos commented on GitHub (Oct 14, 2025):

+1

@Psantos commented on GitHub (Oct 14, 2025): +1

kerem commented

2026-02-26 06:33:51 +03:00

Author

Owner

@RonarPS commented on GitHub (Oct 23, 2025):

+1 - would love such a feature via Webgui

@RonarPS commented on GitHub (Oct 23, 2025): +1 - would love such a feature via Webgui

kerem commented

2026-02-26 06:33:52 +03:00

Author

Owner

@Drakulos commented on GitHub (Nov 21, 2025):

Please implement that feature. Would love it.

@Drakulos commented on GitHub (Nov 21, 2025): Please implement that feature. Would love it.

kerem commented

2026-02-26 06:33:52 +03:00

Author

Owner

@Rukkrym commented on GitHub (Jan 6, 2026):

+1

@Rukkrym commented on GitHub (Jan 6, 2026): +1

kerem commented

2026-02-26 06:33:52 +03:00

Author

Owner

@andreasalbertmail-arch commented on GitHub (Jan 8, 2026):

+1

@andreasalbertmail-arch commented on GitHub (Jan 8, 2026): +1

kerem commented

2026-02-26 06:33:52 +03:00

Author

Owner

@kar-vi-nen commented on GitHub (Jan 27, 2026):

+1

@kar-vi-nen commented on GitHub (Jan 27, 2026): +1

kerem commented

2026-02-26 06:33:52 +03:00

Author

Owner

@RonarPS commented on GitHub (Jan 27, 2026):

+1
Go for it! such feature would be really nice!

@RonarPS commented on GitHub (Jan 27, 2026): +1 Go for it! such feature would be really nice!

kerem referenced this issue

2026-02-26 07:38:42 +03:00

[PR #653] [MERGED] Pass/Don't Pass Auth Header #3275

Rows
Columns

[GH-ISSUE #768] Add client certificate support #653

Implement client certificates