Cert

CADir

• Type: string
• Version：>= v2.0.0-beta.37

When applying for a Let's Encrypt certificate, we use the default CA address of Let's Encrypt. If you need to debug or obtain certificates from other providers, you can set CADir to their address.

TIP

Please note that the address provided by CADir needs to comply with the RFC 8555 standard.

RecursiveNameservers

• Version：>= v2.0.0-beta.37
• Type: []string
• Example: 8.8.8.8:53,1.1.1.1:53

This option is used to set the recursive nameservers used by Nginx UI in the DNS challenge step of applying for a certificate. If this option is not configured, Nginx UI will use the nameservers settings of the operating system.

Deprecated in v3.0.0

The DNS-01 propagation check moved into the DNS-01 plugin, which has a setting of its own. When the plugin is installed on a node for the first time, the value of this option is copied into the plugin settings. Change it there afterwards. The option is no longer shown in the web interface.

CertRenewalInterval

• Version：>= v2.0.0-beta.37
• Type: int
• Default value: 30
• Valid range: 1-90

This option sets the certificate's remaining-validity threshold for automatic renewal. Nginx UI attempts renewal when the remaining validity is less than or equal to the configured number of days. The certificate worker checks every 30 minutes, but a check does not issue a new certificate before the threshold is reached.

The RenewalInterval name is retained for configuration compatibility. Existing configured values are preserved and are interpreted as days of remaining validity after upgrading.

For short-lived ACME certificates, Nginx UI uses the server-provided ACME Renewal Information (ARI) schedule when available. If ARI is unavailable, or if the configured threshold is not shorter than the certificate lifetime, Nginx UI uses the midpoint of the certificate lifetime to avoid an immediate renewal loop.

HTTPChallengePort

• Version：>= v2.0.0-beta.37
• Type: int
• Default: 9180

This option is used to set the port for backend listening in the HTTP01 challenge mode when obtaining Let's Encrypt certificates. The HTTP01 challenge is a domain validation method used by Let's Encrypt to verify that you control the domain for which you're requesting a certificate.

Certificate Discovery

When importing deployed certificates, automatic discovery scans the configured Nginx ssl directory for directories that contain separate certificate and private key files, such as fullchain.pem and privkey.pem.

Combined certificate and private key single-PEM files are not auto-detected. Split them into separate certificate and key files before using discovery.

DNS Domain Management

• Version：>= v2.2.2
• Supported providers: Alibaba Cloud DNS, Azure DNS, Cloudflare, Huawei Cloud DNS, Tencent Cloud DNS

You can now register DNS domains inside Nginx-UI (Certificates → DNS Domains) and bind them to an existing DNS Credential. For every registered domain the UI exposes a full DNS record management experience (list, create, update, delete) that talks directly to the provider's API. This allows you to verify domains for certificate issuance and perform day-to-day DNS maintenance without leaving the dashboard.

Make sure the selected DNS Credential contains the API tokens and permissions required by the provider to edit DNS records.

DNS-01 Challenge

• Version：>= v3.0.0

The DNS providers used to solve the DNS-01 challenge are provided by the official plugin com.nginxui.dns01, not by Nginx UI itself. When a certificate uses DNS-01 and the plugin is missing, Nginx UI installs it automatically, and the official Docker image ships with it. See Plugin and Upgrading to v3.