5 ms·
Just be aware that nginx needs a self-signed certificate in the very beginning, to serve the .well-known/acme-challenge directory. To simplify the initial setup
by inportb 5y ago
Just be aware that nginx needs a self-signed certificate in the very beginning, to serve the .well-known/acme-challenge directory. To simplify the initial setup, I include a default "snake oil" certificate, which gets overwritten.
- megous 5y agoIt doesn't. You can serve it over http.
- inportb 5y agoInteresting! Thanks for pointing that out. Though... I think I'd still include the snake oil cert and serve everything over SSL, because it simplifies the configuration.
- yjftsjthsd-h 5y agoWith apache2 httpd, you can of course serve the challenge over insecure HTTP, but httpd won't start if you say it should use a cert that doesn't actually exist, so for the sake of automated setup and not having to edit the config multiple times it's way easier to write a self-signed cert and then overwrite it with LE. I think the situation is the same with nginx but not 100% sure.
- ossusermivami 5y agoI just use dns and acme.sh for that reason and not bother about it anymore
- megous 5y agoYou can use IfFile to gate the TLS part of the server until the certificate file exists, if you really don't want to edit your config files during TLS bootstrap.
- inportb 5y agoThe situation is the same with nginx. It's way easier to write a self-signed cert and then overwrite it with LE.
- jonasal 5y agoHow I solve this is that I deactivate all configuration files that have missing certificates, and then reactivate them again after the files have been created. https://github.com/JonasAlfredsson/docker-nginx-certbot https://github.com/JonasAlfredsson/docker-nginx-certbot