Dynamic SSL configuration and nginx broken in latest debian ce package

Installation Issues
1

Checklist
I have read intro post: https://community.passbolt.com/t/about-the-installation-issues-category/12
I have read the tutorials, help and searched for similar issues
I provide relevant information about my server (component names and versions, etc.)
I provide a copy of my logs and healthcheck
I describe the steps I have taken to trouble shoot the problem
I describe the steps on how to reproduce the issue

Hi, i just noticed that my ssl certificate expired in 10 July on passbolt.
It did seem strange because, I manage auto ssl certificate renew with a certbot renew crontab.
So I ran again “dpkg-reconfigure passbolt-ce-server” which produces a new /etc/passbolt/nginx-ssl.conf

I have two issues :

  • That file is broken, see nginx logs here
    ```
    root@fsi-password:/etc/nginx# nginx -T
    2026/07/13 11:55:36 [warn] 1686323#1686323: the “listen … http2” directive is deprecated, use the “http2” directive instead in /etc/nginx/sites-enabled/nginx-passbolt.conf:7
    2026/07/13 11:55:36 [warn] 1686323#1686323: the “listen … http2” directive is deprecated, use the “http2” directive instead in /etc/passbolt/nginx-ssl.conf:11
    2026/07/13 11:55:36 [warn] 1686323#1686323: the “listen … http2” directive is deprecated, use the “http2” directive instead in /etc/passbolt/nginx-ssl.conf:12
    2026/07/13 11:55:36 [emerg] 1686323#1686323: a duplicate listen 0.0.0.0:443 in /etc/passbolt/nginx-ssl.conf:12
    nginx: configuration file /etc/nginx/nginx.conf test failed
    root@fsi-password:/etc/nginx# cat /etc/passbolt/nginx-ssl.conf | grep -v ‘^#’

    listen [::]:443 ssl http2;
    listen 443 ssl http2;

    ssl_certificate /etc/ssl/certs/1783936192-fullchain.pem;
    ssl_certificate_key /etc/ssl/private/1783936192-privkey.pem;

    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m; # about 40000 sessions

    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ```

  • When I run dpkg-reconfigure, I enter the full path on my ssl configuration, the one managed by certbot dynamically, but it seems to duplicate the ssl file statically in /etc/ssl/certs ? Why ?
    Can I edit that file manually to fill with the dynamically updated ssl files ?

Best regards