NginxProxyManager / NginxProxyManager/nginx-proxy-manager
Setting 'ssl_verify_client: on;' on Advanced tab prevents certificate renewal because 'acme-challenge' requests are redirected to 'https' if "Force SSL" is on
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 34.2k
- Forks
- 3.9k
- Avg merge
- 21h 12m
- Merged PRs (30d)
- 20
Description
I secured some proxy hosts by requiring a valid client certificate ("ssl_verify_client: on;" in the "Advanced" tab) and recently noticed that the Let's Encrypt certificates are no longer being automatically renewed.
In "force-ssl.conf", only a test URL (line 5: $request_uri = /.well-known/acme-challenge/test-challenge) is excluded from being redirected zu https.
However, the correct approach would be to exclude all challenges using:
$request_uri ~* "^/.well-known/acme-challenge/"
This makes it possible to use client certificates as the first line of defense for non-public access areas.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with force-ssl.conf, especially the exception on line 5 for /.well-known/acme-challenge/test-challenge. Update the challenge matching so certificate renewal requests are not redirected to https, then verify that proxy hosts using client certificate verification can renew their Let's Encrypt certificates when Force SSL is enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx
- Domain
- infrastructure
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100