Shared Custom SSL Certificates / Centralized Certificate Alias

Is your feature request related to a problem? Please describe.
Managing custom SSL certificates across a large number of proxy hosts (e.g., 200+ sites using purchased certificates) is currently very manual and time-consuming. When a custom SSL certificate expires, it has to be re-uploaded or re-assigned manually across all linked hosts.

This issue will get significantly worse due to the upcoming TLS/SSL validity reductions mandated by the CA/Browser Forum:

• March 15, 2026: Maximum validity reduced to 200 days (~6 months)
• March 15, 2027: Maximum validity reduced to 100 days
• March 15, 2029: Maximum validity reduced to 47 days

Updating hundreds of custom SSL certificates manually every few months (and eventually every month) will create an unsustainable maintenance burden.

Describe the solution you'd like
I would like a centralized custom SSL certificate management system based on unique names/aliases:

1. Allow uploading/defining custom SSL certificates with a specific identifier or alias name (e.g., domain-a-ssl), stored centrally (e.g., in /data/file_ssl).
2. Allow multiple proxy hosts to select and link to this single certificate alias (domain-a-ssl).
3. When it is time to renew, replacing or updating the certificate files under domain-a-ssl should automatically update all proxy hosts linked to that alias, without needing to edit each host individually.

Describe alternatives you've considered

• Manual editing per host: Editing all 200+ hosts one by one through the UI whenever a certificate is renewed. (Not scalable with shorter certificate lifespans).
• Symlinking or overwriting files directly in docker volumes: Manually replacing the files inside /data/nginx/dummy or certificate folders on the host machine via terminal/scripts. (Risky, as it bypasses NPM internal state management and UI tracking).

Additional context
This feature would greatly improve NPM for enterprise or large-scale environments that rely on commercial/custom certificates instead of Let's Encrypt / ACME auto-renewals.

Begin by tracing how custom certificates are uploaded and assigned to proxy hosts in the UI and backend, with attention to the proposed /data/file_ssl location and the existing /data/nginx/dummy certificate paths. Done means one named certificate can be linked to multiple hosts and replacing it updates every linked host without per-host editing.