NginxProxyManager / NginxProxyManager/nginx-proxy-manager

Saving an existing Proxy Host before the certificate list loads can issue duplicate certificates

Open
#5,704 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
34.2k
Forks
3.9k
Avg merge
21h 12m
Merged PRs (30d)
20

Description

Checklist

  • Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
    • Yes
  • Are you sure you're not using someone else's docker image?
    • Yes
  • Have you searched for similar issues (both open and closed)?
    • Yes

Describe the bug
Saving an existing Proxy Host before the SSL Certificate selector has fully loaded in the background can cause Nginx Proxy Manager to request and issue a new certificate instead of preserving the certificate already assigned to that host.

This can happen when:

  • The user opens the Edit Proxy Host dialog and immediately clicks Save.
  • The browser or computer is slow or under heavy load.
  • The certificate list takes longer than usual to load.

I discovered this after re-saving more than 30 Proxy Hosts to remove the post-v2.12.2 deprecation warnings from the logs. More than 20 hosts received newly issued certificates even though I had not changed or even opened their SSL settings.

For one host, I was unsure whether I had already re-saved it and saved it again. This resulted in two additional certificates being issued for the same domain only a few minutes apart.

Nginx Proxy Manager Version
v2.15.1

To Reproduce
Steps to reproduce the behavior:

  1. Go to the Proxy Hosts page.
  2. Start editing an existing host that already has an SSL certificate assigned.
  3. Click Save immediately, before the SSL Certificate selector has fully loaded in the background.
  4. Open the SSL Certificates page.
  5. Check whether a new certificate was issued for the same domain.

The issue may be timing-dependent and easier to reproduce on a slow or busy computer or browser.

Expected behavior
Saving an existing Proxy Host without changing its SSL settings should preserve the certificate currently assigned to that host.

The application should never request a new certificate merely because the certificate selector has not finished loading or its value was temporarily unavailable.

A new certificate should only be requested when the user explicitly selects Request a new SSL Certificate or otherwise deliberately changes the certificate configuration.

Until all existing host data, including the selected certificate, has loaded successfully, the Save button should either remain disabled or saving should preserve the existing backend value for any field that has not yet loaded.

Additional context
I know this is a minor low priority issue, unless some other deprecations will come to warranty another resaving. But with slow machines/browsers or closing via saving (expecting nothing would change) it is probably still worth fixing.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the edit-and-immediate-save sequence on an existing Proxy Host whose SSL certificate selector is still loading, preferably under slow browser or system conditions. Trace the Proxy Host edit flow and certificate-loading behavior to determine how an unavailable selector value is handled. Done means saving without SSL changes preserves the assigned certificate and does not issue a duplicate certificate.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
backend, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.