NginxProxyManager/nginx-proxy-manager · error · Error

Unknown DNS provider '${certificate.meta.dns_provider}'

Error message

Unknown DNS provider '${certificate.meta.dns_provider}'

What it means

During automated renewal of a Let's Encrypt certificate via DNS-01 challenge, internal/certificate.js looks up certificate.meta.dns_provider in the dnsPlugins registry. If the provider slug stored in the certificate metadata has no matching plugin entry, renewal aborts with this Error before contacting Let's Encrypt.

Source

Thrown at backend/internal/certificate.js:977

		const adds = internalCertificate.getAdditionalCertbotArgs(certificate.id, certificate.meta.dns_provider);
		args.push(...adds.args);

		logger.info(`Command: ${certbotCommand} ${args ? args.join(" ") : ""}`);

		const result = await utils.execFile(certbotCommand, args, adds.opts);
		logger.info(result);
		return result;
	},

	/**
	 * @param   {Object}  certificate   the certificate row
	 * @returns {Promise}
	 */
	renewLetsEncryptSslWithDnsChallenge: async (certificate) => {
		const dnsPlugin = dnsPlugins[certificate.meta.dns_provider];
		if (!dnsPlugin) {
			throw Error(`Unknown DNS provider '${certificate.meta.dns_provider}'`);
		}

		logger.info(
			`Renewing LetsEncrypt certificates via ${dnsPlugin.name} for Cert #${certificate.id}: ${certificate.domain_names.join(", ")}`,
		);

		const args = [
			"renew",
			"--force-renewal",
			"--config",
			letsencryptConfig,
			"--work-dir",
			certbotWorkDir,
			"--logs-dir",
			certbotLogsDir,
			"--cert-name",
			`npm-${certificate.id}`,
			"--preferred-challenges",

View on GitHub (pinned to 934a3fafe5)

Solutions

1. Inspect the certificate row (GET /api/nginx/certificates/:id) and compare meta.dns_provider against the keys in backend/internal/dns-plugins.js of the running version
2. If it's a typo/rename, recreate the certificate via the UI/API with the correct provider slug (metadata is not safely editable in place)
3. If the provider legitimately doesn't exist in your build, upgrade NPM to a version that supports the provider, or re-issue the certificate using a supported provider or HTTP challenge
4. As a stopgap for a custom build, add the provider entry to dns-plugins and rebuild the container

Example fix

// before: certificate.meta = { dns_provider: 'aws' } // not a registered slug
Error("Unknown DNS provider 'aws'")

// after: recreate cert with a registered slug, e.g.
// POST /api/nginx/certificates
{
  "provider": "letsencrypt",
  "domain_names": ["example.com"],
  "meta": { "dns_provider": "digitalocean", "dns_provider_credentials": "..." }
}

import dnsPlugins from './internal/dns-plugins.js';

const providerSupported = (provider: string) =>
  Object.prototype.hasOwnProperty.call(dnsPlugins, provider);

// before triggering renewal:
if (!providerSupported(certificate.meta.dns_provider)) {
  logger.warn(`Cert #${certificate.id}: provider '${certificate.meta.dns_provider}' unsupported; skipping renewal`);
  return;
}

const isSupportedDnsProvider = (name: unknown): name is keyof typeof dnsPlugins =>
  typeof name === 'string' && Object.prototype.hasOwnProperty.call(dnsPlugins, name);

try {
  await internalCertificate.renewLetsEncryptSslWithDnsChallenge(certificate);
} catch (e) {
  if (e instanceof Error && e.message.startsWith('Unknown DNS provider')) {
    // mark cert for re-creation with a valid provider; alert the owner, do not blind-retry
  }
  throw e;
}

When it happens

Trigger: A certificate was created with a dns_provider value that the current build no longer (or never did) recognize — e.g. metadata says 'route53' but dnsPlugins lacks that key, custom/misspelled provider names inserted via API, or certificates created on an older NPM version being renewed after an upgrade/downgrade that changed the dns-plugins list.

Common situations: NPM version changes that renamed or removed DNS providers, certificates migrated between instances with different plugin sets, manually edited certificate rows in the database, or renewal jobs (cron) failing repeatedly and silently because the stored metadata is bad.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Plugin not found
• Database config does not exist! Please read the instructions
• No 2FA challenge pending
• No files were uploaded

AI-assisted analysis of NginxProxyManager/nginx-proxy-manager@934a3fafe5 (2026-08-27). Data as JSON: /api/errors/4c61661626f68300. Report an issue: GitHub.