How to Enable HTTPS in Nginx Proxy Manager

The short answer

In Nginx Proxy Manager, you enable HTTPS per proxy host. Open the proxy host for your site, go to its SSL tab, request a new certificate from Let's Encrypt or select one you already have, then turn on Force SSL and save. For this to work, a public domain name must point to the server running Nginx Proxy Manager, and ports 80 and 443 must be reachable from the internet. If your setup cannot meet those conditions, you need the DNS challenge option or your own certificate, both described below.

Button and menu names in this guide reflect the commonly used Nginx Proxy Manager interface. They can differ slightly between versions, so look for the closest equivalent if a label does not match exactly.

Why HTTPS matters for cameras and microphones

Modern browsers only allow web pages to request camera and microphone access in a secure context. In practice, a secure context means the page loads over HTTPS with a certificate the browser trusts. Pages opened directly on the same computer through its local loopback address are treated as an exception. If you self-host a video-call tool, a webcam test page or a similar app and open it over plain HTTP from another device, the browser will typically block the camera and microphone outright or never show the permission prompt.

Enabling HTTPS removes that specific barrier. It does not by itself guarantee that video is actually captured, that the microphone picks up usable sound or that call quality is good. Those depend on the device, the browser permission you grant, the app and the network.

Before you start

• Nginx Proxy Manager is installed and you can sign in to its admin interface, which by default runs on port 81.
• You own a domain or subdomain and have created a DNS record that points it to the public IP address of the server running Nginx Proxy Manager.
• Your router or firewall forwards ports 80 and 443 to that server. Let's Encrypt uses port 80 to verify that you control the domain when you use the standard method.
• The app you want to protect is running and reachable from the Nginx Proxy Manager server, and you know its internal IP address or hostname and port.

Step 1: Create or open the proxy host

• Sign in to the Nginx Proxy Manager admin interface.
• Go to Hosts, then Proxy Hosts.
• Click Add Proxy Host, or open the existing host you want to secure.
• On the Details tab, enter your domain name under Domain Names.
• Set the scheme the app itself uses internally (usually http), the forward hostname or IP address, and the forward port.
• Turn on Websockets Support if the app uses real-time connections. Many video-call and chat apps do, and they may connect but fail to exchange audio or video without it.

Step 2: Request a certificate on the SSL tab

• Switch to the SSL tab of the same proxy host.
• Under SSL Certificate, choose Request a new SSL Certificate.
• Enter the email address Let's Encrypt should use for expiry and account notices, and agree to the Let's Encrypt terms of service.
• Leave the DNS challenge option off unless you need it (see below).
• Save. Nginx Proxy Manager contacts Let's Encrypt, completes the domain check and attaches the certificate to the host.

Step 3: Choose the HTTPS options

Option | What it does | Recommendation

Force SSL | Redirects every plain HTTP request to HTTPS | Turn on, so visitors never land on the insecure version where camera and microphone access are blocked

HTTP/2 Support | Lets browsers use the newer HTTP/2 protocol over HTTPS | Generally safe to turn on

HSTS Enabled | Tells browsers to always use HTTPS for this domain in future visits | Turn on only after you have confirmed HTTPS works, because browsers will remember it and refuse plain HTTP

HSTS Subdomains | Applies the HSTS rule to every subdomain | Turn on only if all subdomains also serve valid HTTPS

If ports 80 and 443 are not reachable

Some home connections block incoming traffic on port 80, and some setups are only meant to be used on a private network. In those cases the standard Let's Encrypt check fails. Nginx Proxy Manager offers a DNS challenge option on the SSL tab: you select your DNS provider and supply an API credential, and the domain is verified through a DNS record instead of an incoming connection. This also allows wildcard certificates that cover every subdomain. Supported providers and the exact credential format depend on your provider and Nginx Proxy Manager version; this guide has no provider-specific details to offer.

If you already have a certificate from another source, you can add it under the SSL Certificates menu using the custom certificate option, then select it on the proxy host's SSL tab. A self-signed certificate will technically enable HTTPS, but browsers will show a warning on every device that has not been set up to trust it, and some browsers may still treat camera and microphone requests differently until the warning is accepted. A trusted certificate avoids this.

Step 4: Verify the result

• Open your domain in a browser using the plain HTTP form. With Force SSL on, it should switch to HTTPS automatically.
• Check the address bar. The browser should show its normal secure-connection indicator with no certificate warning.
• Open the site's certificate details from the address bar and confirm the certificate covers your domain and has not expired.
• In your app, start a camera or microphone test. The browser should now show a permission prompt. Allowing it confirms access is possible; then confirm separately that a live video image appears and that the microphone level moves when you speak.
• If the permission prompt appears but video or audio does not work, the HTTPS setup is likely fine and the issue lies elsewhere, such as browser or operating-system privacy settings, another app holding the camera, or a missing Websockets Support setting.

Common problems

• The certificate request fails: confirm the DNS record points to the correct public IP address, that port 80 is forwarded to Nginx Proxy Manager, and that no other service on the server is using ports 80 or 443.
• The browser shows the wrong certificate or a warning: make sure the domain typed in the browser exactly matches one listed under Domain Names on the proxy host.
• The page loads but the app shows errors: check the forward scheme, hostname and port on the Details tab; using https there when the app only speaks http internally is a frequent mistake.
• The site stops working after you change your mind about HTTPS: if HSTS was enabled, browsers will keep insisting on HTTPS for a period, so restore a working certificate rather than switching back to plain HTTP.

Renewal

Let's Encrypt certificates are short-lived, and Nginx Proxy Manager renews them automatically as long as the same verification method keeps working. If you later close port 80 or change DNS providers, renewal can fail silently until the certificate expires and the browser starts showing warnings again, which would also block camera and microphone access. You can check expiry dates and trigger a manual renewal from the SSL Certificates menu.