Allow NPM to upload custom certs from a Docker volume defined in the compose file

[cubemin]

Is your feature request related to a problem? Please describe.

My NAS has its own SSL certificate which auto-renews every few months. I prefer to use the same cert in NPM, so after each renewal I import it as a custom cert to use with my proxy hosts.

Problem: Since custom certs must be uploaded through the web portal, it's a pain to export my NAS cert files to my PC, then upload them to NPM. This is also a bit of a security concern.

Describe the solution you'd like

Make it so that NPM can use a volume path defined in its Docker compose file to import cert files from, in addition to web uploads. I could then simply mirror my NAS cert to that volume path and forgo the export altogether.

services:
  app:
    image: 'jc21/nginx-proxy-manager'

 [ ... ]

volumes:
      - path_to_my_server_cert/cer_and_key_files:/cert_import_folder:ro

[ ... ]

Then, in NPM, have the option to select /cert_import_folder as the location to upload a custom certificate from.

Describe alternatives you've considered

Can't really think of any alternatives.

Additional context

To take this a step further, perhaps NPM could monitor the cert import folder for any changes (to the NAS cert) and automatically update the custom cert (within NPM) without having to create a new one, switching proxy hosts to the new one, then deleting the old expired custom cert. But that's for another day...

[Justmie]

I fixed it by using the custom nginx config instead of the SSL tab for each host:

listen 443 ssl;
listen [::]:443 ssl;

ssl_certificate /etc/custom_ssl/docker.pem;
ssl_certificate_key /etc/custom_ssl/docker.key;

# Force SSL redirection
if ($scheme = http) {
    return 301 https://$host$request_uri;
}

Then in the docker compose file I have this under volumes:
- /opt/docker/ssl:/etc/custom_ssl:ro

After changing the certs you'll just have to run:
docker exec nginx-proxy-manager nginx -s reload
to reload the certificates.

[cubemin]

That ... is a really clever solution. Your nginx-fu is strong - unlike mine.

I have questions, though - this is only a per-proxy-host solution, not a per-certificate solution, right?
And does the custom config only replace what's on the SSL tab, or all of the proxy host's settings?

I think I'd still prefer a way to keep a given certificate (and by extension, any proxy hosts using it) up to date, even if it's just by loading it from a Docker volume path instead of through the web.

[Justmie]

That ... is a really clever solution. Your nginx-fu is strong - unlike mine.

I have questions, though - this is only a per-proxy-host solution, not a per-certificate solution, right? And does the custom config only replace what's on the SSL tab, or all of the proxy host's settings?

I think I'd still prefer a way to keep a given certificate (and by extension, any proxy hosts using it) up to date, even if it's just by loading it from a Docker volume path instead of through the web.

Per proxy host unfortunately, and you can change most settings I believe, although I haven't tried or even looked into. I needed a way to use my own wildcard certificate, and this was something that worked.

And I agree that it would be nice to be able to select your own certificate from the webinterface. Also having the acme.sh script instead of the bulky certbot would be nice I think. Then again, that's not my decision. I just deal with what we get, as I don't have the ability to make it myself :)

[cubemin]

I've come to notice that NPM simply saves custom SSL cert files in its data folder under custom_ssl/npm-#, where # is a number that increases by 1 with each new custom cert created.

I could simply copy my host cert into that folder (by script triggered whenever it renews), overwriting fullchain.pem and privkey.pem in the process, then restart the Docker container. I'll try that soon.

Thanks for your insights and giving me this idea. 🙂

[fatmalama]

And I agree that it would be nice to be able to select your own certificate from the webinterface.

ha I was going to file a feature request for this yesterday as I have some internal only web services that are self signed from a CA (self-signed) root cert I deploy via GPO to the Windows
machines, good I'm seeing this and didn't file a duplicate