Skip to content

Shared Custom SSL Certificates / Centralized Certificate Alias #5736

Description

@estevamota

Is your feature request related to a problem? Please describe.
Managing custom SSL certificates across a large number of proxy hosts (e.g., 200+ sites using purchased certificates) is currently very manual and time-consuming. When a custom SSL certificate expires, it has to be re-uploaded or re-assigned manually across all linked hosts.

This issue will get significantly worse due to the upcoming TLS/SSL validity reductions mandated by the CA/Browser Forum:

  • March 15, 2026: Maximum validity reduced to 200 days (~6 months)
  • March 15, 2027: Maximum validity reduced to 100 days
  • March 15, 2029: Maximum validity reduced to 47 days

Updating hundreds of custom SSL certificates manually every few months (and eventually every month) will create an unsustainable maintenance burden.

Describe the solution you'd like
I would like a centralized custom SSL certificate management system based on unique names/aliases:

  1. Allow uploading/defining custom SSL certificates with a specific identifier or alias name (e.g., domain-a-ssl), stored centrally (e.g., in /data/file_ssl).
  2. Allow multiple proxy hosts to select and link to this single certificate alias (domain-a-ssl).
  3. When it is time to renew, replacing or updating the certificate files under domain-a-ssl should automatically update all proxy hosts linked to that alias, without needing to edit each host individually.

Describe alternatives you've considered

  • Manual editing per host: Editing all 200+ hosts one by one through the UI whenever a certificate is renewed. (Not scalable with shorter certificate lifespans).
  • Symlinking or overwriting files directly in docker volumes: Manually replacing the files inside /data/nginx/dummy or certificate folders on the host machine via terminal/scripts. (Risky, as it bypasses NPM internal state management and UI tracking).

Additional context
This feature would greatly improve NPM for enterprise or large-scale environments that rely on commercial/custom certificates instead of Let's Encrypt / ACME auto-renewals.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions