5 ms·

This is how I automate LE (technically ACME/ZeroSSL) in my Nginx reverse proxy. https://git.inportb.com/jyio/docker-nginx-auto https://git.inportb.com/jyio/doc

This is how I automate LE (technically ACME/ZeroSSL) in my Nginx reverse proxy. https://git.inportb.com/jyio/docker-nginx-auto https://git.inportb.com/jyio/docker-nginx-auto Basically, inotifywait on the config directory and request new certificates as needed. Grep the config files for hostnames (and ignore if labeled NOSSL). And a configuration snippet to include the same SSL config for anything that needs SSL (including the .well-known/acme-challenge directory). Oh, and use cron to renew periodically.

InvaderFizz 5y ago
> inotifywait on the config directory I like this idea. I'm going to start using this.
- inportb 5y ago
  Just be aware that nginx needs a self-signed certificate in the very beginning, to serve the .well-known/acme-challenge directory. To simplify the initial setup, I include a default "snake oil" certificate, which gets overwritten.
  - megous 5y ago
    It doesn't. You can serve it over http.
    - inportb 5y ago
      Interesting! Thanks for pointing that out. Though... I think I'd still include the snake oil cert and serve everything over SSL, because it simplifies the configuration.
    - yjftsjthsd-h 5y ago
      With apache2 httpd, you can of course serve the challenge over insecure HTTP, but httpd won't start if you say it should use a cert that doesn't actually exist, so for the sake of automated setup and not having to edit the config multiple times it's way easier to write a self-signed cert and then overwrite it with LE. I think the situation is the same with nginx but not 100% sure.
      - ossusermivami 5y ago
        I just use dns and acme.sh for that reason and not bother about it anymore
      - megous 5y ago
        You can use IfFile to gate the TLS part of the server until the certificate file exists, if you really don't want to edit your config files during TLS bootstrap.
      - inportb 5y ago
        The situation is the same with nginx. It's way easier to write a self-signed cert and then overwrite it with LE.
  - jonasal 5y ago
    How I solve this is that I deactivate all configuration files that have missing certificates, and then reactivate them again after the files have been created. https://github.com/JonasAlfredsson/docker-nginx-certbot https://github.com/JonasAlfredsson/docker-nginx-certbot

InvaderFizz 5y ago

> inotifywait on the config directory I like this idea. I'm going to start using this.

inportb 5y ago
Just be aware that nginx needs a self-signed certificate in the very beginning, to serve the .well-known/acme-challenge directory. To simplify the initial setup, I include a default "snake oil" certificate, which gets overwritten.
- megous 5y ago
  It doesn't. You can serve it over http.
  - inportb 5y ago
    Interesting! Thanks for pointing that out. Though... I think I'd still include the snake oil cert and serve everything over SSL, because it simplifies the configuration.
  - yjftsjthsd-h 5y ago
    With apache2 httpd, you can of course serve the challenge over insecure HTTP, but httpd won't start if you say it should use a cert that doesn't actually exist, so for the sake of automated setup and not having to edit the config multiple times it's way easier to write a self-signed cert and then overwrite it with LE. I think the situation is the same with nginx but not 100% sure.
    - ossusermivami 5y ago
      I just use dns and acme.sh for that reason and not bother about it anymore
    - megous 5y ago
      You can use IfFile to gate the TLS part of the server until the certificate file exists, if you really don't want to edit your config files during TLS bootstrap.
    - inportb 5y ago
      The situation is the same with nginx. It's way easier to write a self-signed cert and then overwrite it with LE.
- jonasal 5y ago
  How I solve this is that I deactivate all configuration files that have missing certificates, and then reactivate them again after the files have been created. https://github.com/JonasAlfredsson/docker-nginx-certbot https://github.com/JonasAlfredsson/docker-nginx-certbot