Nginx – Renew Let’s encrypt certificate automatically without stopping nginx hosted on docker

certbotdockerlets-encryptnginx

I am using nginx as proxy and SSL termination for the site hosted on docker. App & nginx both are on docker. I have installed Let's encrypt SSL using Certbot directly on Ubuntu server. And now using the SSL cert installed on Ubuntu server in Docker by mapping it using volume in docker-compose.

I noticed that Certbot cron job to renew certificate is failing as the port 80 and 443 are in use by docker nginx instance.

And to renew, I need to stop the docker and then run certbot renew command which works fine.

What is the best way to have automated renewal without stopping docker container that runs nginx.

Best Answer

One of the obvious answers is to not use certbot. There are many other ACME compatible clients, some that could use the DNS-01 challenge.

Or you could use a different proxy that has certificate renewal built in. One popular choice is Traefik, that works nicely as a proxy, and can automatically get certs using either HTTP or DNS challenges, depending on what you configure.

If you really want to stick with certbot, look at switching over to DNS validation if you can. Using DNS validation doesn't require opening any ports, it does require you be able to automatically publish a DNS record though.

Related Solutions

Nginx – Let’s Encrypt certificate not recognized by Nginx

You appear to be missing a semicolon at the end of the server_name directive. I suspect this is causing the following line to be interpreted as part of the server_name directive rather than as a new directive.

Nginx – Lets encrypt SSL certificate in Docker container via nginx-proxy

Finally, I found out that my docker-compose.yaml was not correct. Here is my new config:

nginx-proxy:
  image: jwilder/nginx-proxy
  ports:
  - "80:80"
  - "443:443"
  volumes:
  - /var/local/nginx/certs:/etc/nginx/certs
  - /etc/letsencrypt:/etc/letsencrypt
  - /var/run/docker.sock:/tmp/docker.sock

owncloud:
  image: owncloud
  expose:
  - 443
  environment:
  - "VIRTUAL_HOST=owncloud.mydomain.com,www.owncloud.mydomain.com"
  volumes:
  - "owncloud-data:/var/www/html"

A link to my fullchain.pem and privkey.pem is within /var/local/nginx

Best Answer

Related Solutions

Nginx – Let’s Encrypt certificate not recognized by Nginx

Nginx – Lets encrypt SSL certificate in Docker container via nginx-proxy

Related Topic