Latest Image brakes my installation (AttributeError: module 'OpenSSL.crypto' has no attribute 'X509Extension')

[hoppushoppard]

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes
• Are you sure you're not using someone else's docker image?
  • Yes
• Have you searched for similar issues (both open and closed)?
  • Yes

Describe the bug
When upgrading to latest image, nginx-proxy-manager starts to not consistent state and doesn't server requests.
I've got several ssl certificates via provider Let's Encrypt – websupport.

There is a related bug.
#5606
This bug states this error shows during adding a certificate.

My bug has different behaviour, the application will not start (or is in stalled state)

Nginx Proxy Manager Version
latest

To Reproduce
Run latest version

Operating System
linux mint

Additional context

[7/18/2026] [4:52:55 PM] [SSL      ] › ℹ  info      Completed SSL cert renew process
Traceback (most recent call last):
  File "/opt/certbot/bin/certbot", line 3, in <module>
    from certbot.main import main
  File "/opt/certbot/lib/python3.13/site-packages/certbot/main.py", line 6, in <module>
    from certbot._internal import main as internal_main
  File "/opt/certbot/lib/python3.13/site-packages/certbot/_internal/main.py", line 24, in <module>
    from acme import client as acme_client
  File "/opt/certbot/lib/python3.13/site-packages/acme/client.py", line 27, in <module>
    from acme import challenges
  File "/opt/certbot/lib/python3.13/site-packages/acme/challenges.py", line 24, in <module>
    from acme import crypto_util
  File "/opt/certbot/lib/python3.13/site-packages/acme/crypto_util.py", line 504, in <module>
    extensions: Optional[List[crypto.X509Extension]] = None,
                              ^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.13/site-packages/cryptography/utils.py", line 76, in __getattr__
    obj = getattr(self._module, name)
AttributeError: module 'OpenSSL.crypto' has no attribute 'X509Extension'
s6-rc: warning: unable to start service prepare: command exited 1
/run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information.
Traceback (most recent call last):
  File "/opt/certbot/bin/certbot", line 3, in <module>
    from certbot.main import main
  File "/opt/certbot/lib/python3.13/site-packages/certbot/main.py", line 6, in <module>
    from certbot._internal import main as internal_main
  File "/opt/certbot/lib/python3.13/site-packages/certbot/_internal/main.py", line 24, in <module>
    from acme import client as acme_client
  File "/opt/certbot/lib/python3.13/site-packages/acme/client.py", line 27, in <module>
    from acme import challenges
  File "/opt/certbot/lib/python3.13/site-packages/acme/challenges.py", line 24, in <module>
    from acme import crypto_util
  File "/opt/certbot/lib/python3.13/site-packages/acme/crypto_util.py", line 504, in <module>
    extensions: Optional[List[crypto.X509Extension]] = None,
                              ^^^^^^^^^^^^^^^^^^^^
  File "/opt/certbot/lib/python3.13/site-packages/cryptography/utils.py", line 76, in __getattr__
    obj = getattr(self._module, name)
AttributeError: module 'OpenSSL.crypto' has no attribute 'X509Extension'
s6-rc: warning: unable to start service prepare: command exited 1
/run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information.

[smoonlee]

Temporary hotpatch for the Certbot X509Extension / X509Req error

I have encountered the same problem after upgrading to the latest Nginx Proxy Manager image.

Depending on which part of Certbot is loaded, the error may appear as either:

AttributeError: module 'OpenSSL.crypto' has no attribute 'X509Extension'

or:

AttributeError: module 'OpenSSL.crypto' has no attribute 'X509Req'

This appears to be caused by an incompatible pyOpenSSL version being installed inside the Certbot virtual environment.

• pyOpenSSL 26.2.0 removed OpenSSL.crypto.X509Extension.
• pyOpenSSL 26.3.0 removed OpenSSL.crypto.X509Req.
• The Certbot, ACME or Josepy versions currently installed by Nginx Proxy Manager still reference these APIs.

The following temporary hotpatch pins pyOpenSSL to 26.1.0 and keeps cryptography within the supported version range.

Warning

This is an unofficial temporary workaround. It modifies the running container and will be lost if the container is recreated, upgraded or replaced.

Automated hotpatch

Save the following as npm-certbot-hotpatch.sh:

#!/usr/bin/env bash

set -Eeuo pipefail

CONTAINER="${1:-}"

if ! command -v docker >/dev/null 2>&1; then
    echo "Error: Docker was not found."
    exit 1
fi

# Automatically locate the Nginx Proxy Manager container when no name is given.
if [[ -z "$CONTAINER" ]]; then
    mapfile -t CONTAINERS < <(
        docker ps \
            --format '{{.Names}} {{.Image}}' |
            awk '$2 ~ /^jc21\/nginx-proxy-manager:/ {print $1}'
    )

    if [[ ${#CONTAINERS[@]} -eq 0 ]]; then
        echo "Error: No running Nginx Proxy Manager container was found."
        echo "Pass the container name explicitly:"
        echo "  $0 <container-name>"
        exit 1
    fi

    if [[ ${#CONTAINERS[@]} -gt 1 ]]; then
        echo "Error: Multiple Nginx Proxy Manager containers were found:"
        printf '  %s\n' "${CONTAINERS[@]}"
        echo
        echo "Pass the required container name explicitly:"
        echo "  $0 <container-name>"
        exit 1
    fi

    CONTAINER="${CONTAINERS[0]}"
fi

if ! docker inspect "$CONTAINER" >/dev/null 2>&1; then
    echo "Error: Container '$CONTAINER' does not exist."
    exit 1
fi

if [[ "$(docker inspect --format '{{.State.Running}}' "$CONTAINER")" != "true" ]]; then
    echo "Error: Container '$CONTAINER' is not currently running."
    exit 1
fi

echo "Applying Certbot compatibility hotpatch to: $CONTAINER"

docker exec --user 0 "$CONTAINER" \
    /opt/certbot/bin/pip install \
    --no-cache-dir \
    --upgrade \
    --force-reinstall \
    'pyOpenSSL==26.1.0' \
    'cryptography>=46,<48'

echo
echo "Checking installed Python packages..."

docker exec "$CONTAINER" /opt/certbot/bin/pip check

echo
echo "Verifying Certbot, ACME and Josepy imports..."

docker exec -i "$CONTAINER" /opt/certbot/bin/python - <<'PY'
import cryptography
import OpenSSL
from OpenSSL import crypto

assert hasattr(crypto, "X509Extension"), \
    "OpenSSL.crypto.X509Extension is still unavailable"

assert hasattr(crypto, "X509Req"), \
    "OpenSSL.crypto.X509Req is still unavailable"

import josepy
from acme import crypto_util
from certbot import main

print(f"pyOpenSSL:    {OpenSSL.__version__}")
print(f"cryptography: {cryptography.__version__}")
print("X509Extension: available")
print("X509Req:       available")
print("Certbot imports: OK")
PY

echo
echo "Hotpatch completed successfully."
echo
echo "Do not recreate or upgrade the container until an upstream fix is available."
echo "You can now retry the failed certificate request or renewal."

Make it executable and run it:

chmod +x npm-certbot-hotpatch.sh
sudo ./npm-certbot-hotpatch.sh

A specific container name can also be supplied:

sudo ./npm-certbot-hotpatch.sh nginx-proxy-manager

Quick one-liner

Replace nginx-proxy-manager with the name of the NPM container:

docker exec --user 0 nginx-proxy-manager \
  /opt/certbot/bin/pip install \
  --no-cache-dir \
  --upgrade \
  --force-reinstall \
  'pyOpenSSL==26.1.0' \
  'cryptography>=46,<48'

Verify the fix:

docker exec -i nginx-proxy-manager /opt/certbot/bin/python - <<'PY'
import cryptography
import OpenSSL
from OpenSSL import crypto

assert hasattr(crypto, "X509Extension")
assert hasattr(crypto, "X509Req")

import josepy
from acme import crypto_util
from certbot import main

print(f"pyOpenSSL: {OpenSSL.__version__}")
print(f"cryptography: {cryptography.__version__}")
print("Certbot imports: OK")
PY

Expected output should include:

pyOpenSSL: 26.1.0
X509Extension: available
X509Req: available
Certbot imports: OK

After applying the hotpatch, retry the certificate request or renewal and monitor the container logs:

docker logs --since 5m --follow nginx-proxy-manager

Persistence

A normal docker restart should retain the change because it uses the existing container filesystem.

The hotpatch will be lost after operations that recreate the container, including:

docker compose up --force-recreate
docker compose down
docker pull

It may also be removed by automated container update tools such as Watchtower.

A permanent upstream fix should update the affected Certbot, ACME or Josepy dependencies rather than relying on the deprecated pyOpenSSL APIs.

Reference

• [pyOpenSSL changelog](https://www.pyopenssl.org/en/latest/changelog.html)

[setrin]

I have created new Pull request which fixes this issue.
#5788
If you are running NPM in Docker, you can temporarily pull nginxproxymanager/nginx-proxy-manager-dev:pr-5788 image until it gets merged and released