Fix nginx reload after certificate renewal

[DoyoDia]

Why

A successful Let's Encrypt renewal updates the certificate files on disk, but nginx continues serving the certificate already loaded in memory until it is reloaded.

The shared certificate renewal path did not reload nginx after Certbot completed. This affects both HTTP and DNS challenge renewals, including Cloudflare.

This change calls the existing nginx reload function immediately after a successful renewal, allowing the renewed certificate to be served without restarting the container or manually reloading nginx.

This restores behavior that was lost when auto-renewal was changed to use the shared renewal function in #3392.

Fixes #3803

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• API changes
• Performance improvement
• Test addition or update

AI Usage

• AI was used to write this
• AI was used to review this

[mews-se]

Can confirm this on 2.15.1 with http-01 renewals: "Renew now" succeeded for several certificates (certbot renewed them and the UI showed the new expiry dates), but nginx kept serving the old — by then expired — certificates until a manual nginx -s reload inside the container. The log shows no "Reloading Nginx" line after the renewals, and internalCertificate.renew in the current backend indeed never calls the reload. This patch does exactly what I had to do by hand.

[nginxproxymanagerci]

Docker Image for build 2 is available on DockerHub:

nginxproxymanager/nginx-proxy-manager-dev:pr-5720

Note

Ensure you backup your NPM instance before testing this image! Especially if there are database changes.
This is a different docker image namespace than the official image.

Warning

Changes and additions to DNS Providers require verification by at least 2 members of the community!

[mews-se]

Tested the pr-5720 dev image today. I stubbed out certbot inside the container so a renew just drops a fresh self-signed cert on disk, then compared the serial nginx actually serves on 443 with the one in /etc/letsencrypt/live. On 2.15.1 the disk gets the new serial while nginx keeps serving the old one, exactly what bit me earlier. With this image the served cert switches right after the renew call, no manual reload needed.