fix(certbot): switch the Azure DNS plugin to certbot-dns-azure-modern

[cloudchristoph]

Why

certbot-dns-azure is pinned to ~=2.6.1, and 2.6.1 (the latest upstream release, December 2024) requires certbot<4.0. Against the certbot 5.6.0 in the current image, installing it makes pip downgrade certbot and acme, after which certbot cannot import at all:

before: certbot 5.6.0
$ pip install azure-mgmt-dns==8.2.0 'certbot-dns-azure~=2.6.1'
Successfully installed acme-3.3.0 certbot-3.3.0 certbot-dns-azure-2.6.1 josepy-1.15.0
after:  AttributeError: module 'OpenSSL.crypto' has no attribute 'X509Extension'

acme 3.3.0 still uses OpenSSL.crypto.X509Extension, which pyOpenSSL 26 removed, so every certificate operation in the container fails, not only the Azure ones. This is #5606; the azure row in the pin audit there (#5606 (comment)) lists it as one of the three plugins without a compatible upstream release.

Upstream has no compatible release and has not responded to the fix (terricain/certbot-dns-azure#65, open since February 2026). This PR switches the entry to the maintained fork certbot-dns-azure-modern 2.8.0 (source: https://github.com/cloudchristoph/certbot-dns-azure-modern), which requires certbot>=3.0 with no upper bound. Module certbot_dns_azure, entry point dns-azure, flags and the credentials file format are identical, so full_plugin_name and the credentials template stay as they are and existing credentials and renewal configs keep working.

dependencies becomes empty: the fork declares azure-mgmt-dns>=8.2.0 itself and works with both the 8.x and the 9.x line (9.x changed the DnsManagementClient constructor, which is why the old entry pinned 8.2.0 here).

Verified in jc21/nginx-proxy-manager:2.15.1 and :latest (both certbot 5.6.0):

before: certbot 5.6.0
$ pip install 'certbot-dns-azure-modern~=2.8.0'
Successfully installed PyJWT-2.13.0 azure-common-1.1.28 azure-core-1.41.0 azure-identity-1.25.3 azure-mgmt-core-1.6.0 azure-mgmt-dns-9.0.0 certbot-dns-azure-modern-2.8.0 isodate-0.7.2 msal-1.38.0 msal-extensions-1.3.1
after:  certbot 5.6.0
$ pip check
No broken requirements found.
$ certbot plugins --text | grep -A1 dns-azure
* dns-azure
  Description: Obtain certificates using a DNS TXT record (if you are using Azure for DNS).

Also verified on a running NPM 2.15.1 instance with this exact dns-plugins.json entry: NPM installed the plugin at startup and renewed a wildcard certificate via Azure DNS with certbot 5.6.0, clean log. The same instance did the same renewal earlier with 2.7.0 of the fork, which still resolved azure-mgmt-dns 8.2.0, so both SDK lines have a real issuance behind them.

Second commit: the credentials template is shortened. It was the longest of all 87 entries (1181 characters, nine comment lines, two typos) and carried the upstream example secret that trips GitHub secret scanning. It now shows what a user has to fill in, the service principal and one zone line in the format ZONE_NAME:RESOURCE_GROUP_ID, plus a link to the docs for everything else. The keys are unchanged.

Fixes #5606 for the azure plugin.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• API changes
• Performance improvement
• Test addition or update

AI Usage

• AI was used to write this
• AI was used to review this

[Copilot]

🟢 Approval recommended

The change is a minimal, well-scoped plugin metadata update consistent with existing plugin entries (including empty dependencies) and addresses the documented certbot/acme downgrade failure mode.

Pull request overview

This PR updates Nginx Proxy Manager’s certbot DNS plugin catalog to use a maintained Azure DNS plugin that remains compatible with the certbot version shipped in the current container image, avoiding pip-driven downgrades that can break certbot/acme imports.

Changes:

• Switch Azure DNS plugin package from certbot-dns-azure to certbot-dns-azure-modern.
• Update the Azure plugin version constraint to ~=2.8.0.
• Remove the explicit azure-mgmt-dns==8.2.0 dependency pin (plugin now provides its own dependency requirements).

File summaries

File	Description
backend/certbot/dns-plugins.json	Updates the Azure DNS plugin package/version and removes the explicit SDK dependency pin to keep certbot compatible.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[nginxproxymanagerci]

Docker Image for build 2 is available on DockerHub:

nginxproxymanager/nginx-proxy-manager-dev:pr-5831

Note

Ensure you backup your NPM instance before testing this image! Especially if there are database changes.
This is a different docker image namespace than the official image.

Warning

Changes and additions to DNS Providers require verification by at least 2 members of the community!