NginxProxyManager / NginxProxyManager/nginx-proxy-manager

Support for Manual DNS-01 Challenge (Custom _acme-challenge TXT Record)

Open
#4,690 2 comments 10 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement stale
Dominant language
TypeScript
Stars
34.2k
Forks
3.9k
Avg merge
21h 12m
Merged PRs (30d)
20

Description

Hello,
Currently, Nginx Proxy Manager supports issuing SSL certificates via Let's Encrypt using the HTTP challenge and a limited number of DNS providers (via API access). However, it would be very useful to have the option to use the DNS-01 challenge manually, by allowing the user to manually add the required _acme-challenge TXT record in their DNS zone.

This feature is especially important when:

The DNS provider is not supported by NPM;

The user doesn't want to share API credentials with a third-party system;

The domain is hosted in a restricted or enterprise DNS environment.

Many panels like FastPanel already support this feature: during certificate issuance, the system displays the required TXT record, waits for the user to add it, and then proceeds with verification.

Proposed flow:

User selects "Manual DNS Challenge" option.

NPM generates the required TXT record.

NPM pauses and displays the _acme-challenge name and value.

User confirms once the record is added.

NPM verifies and obtains the certificate.

This would make NPM more flexible and usable across a wider range of environments.

Thank you for considering this!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no files or tests. Start by tracing NPM's existing HTTP-01 and DNS-provider certificate issuance flows, then define how the manual DNS-01 state is represented and surfaced. Done means users can view the _acme-challenge TXT name and value, confirm its creation, and complete verification and certificate issuance.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.