NginxProxyManager / NginxProxyManager/nginx-proxy-manager
Deleting Active SSL Certificate Breaks All Hosts Using It
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 34.2k
- Forks
- 3.9k
- Avg merge
- 21h 12m
- Merged PRs (30d)
- 20
Description
Checklist
- Have you pulled and found the error with
jc21/nginx-proxy-manager:latestdocker image?- Yes
- Are you sure you're not using someone else's docker image?
- Yes
- Have you searched for similar issues (both open and closed)?
- Yes
Describe the bug
Deleting a certificate that is currently in use sends NPM into a reboot loop. Similar to #3420
Nginx Proxy Manager Version
2.10.4
To Reproduce
Steps to reproduce the behavior:
- Configure a proxy host
- Configure an SSL cert and add it to the above
- Delete the proxy host
- NPM will now return "internal error" for any attempted activities (such as swapping hosts to a new certificate); recreating the container presents the below error, where npm-# is the certificate you just deleted.
[emerg] cannot load certificate "/etc/letsencrypt/live/npm-3/fullchain.pem": BIO_new_file() failed
Expected behavior
Either do not allow an actively used certificate to be deleted, or update the nginx.conf files for all hosts using it prior to resolving the delete request.
Operating System
Docker running on Ubuntu server
Additional context
Upon investigating, I found that the sqlite database reflected the new SSL certificate in the certificate table and the hosts I swapped to the new certificate reflected the correct certificate in the proxy_host table, however the nginx .conf files in /proxy_host/ folder still had the path of the old certificate in them. Manually editing these config files and then restarting the container allowed it to start up as expected.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with the listed proxy-host and certificate steps using the Docker image, then inspect the certificate and proxy_host database records alongside the generated files in /proxy_host/. Compare those records with the nginx.conf paths shown in the startup error. Done means deleting an in-use certificate no longer leaves hosts referencing a missing certificate, either by preventing deletion or updating all affected configurations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, nginx, sqlite, typescript
- Domain
- backend, databases, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100