E
E
EVOSandru62019-12-01 22:34:48
Nginx
EVOSandru6, 2019-12-01 22:34:48

Why does nginx from a Docker container not respond to certificates thrown into it?

Hey guys.
Please tell me how to diagnose the problem. Similarly to the specified tutorial https://medium.com/@marksta/this-was-so-useful-tha... I
registered a bunch of containers and launched the script for creating fake certificates. The only difference is in the nginx config (domen.ru - conditionally):

server {
    listen 80;
    server_name domen.ru;
    server_tokens off;
    root /public_html;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }
}

server {
    listen 443 ssl;
    server_name domen.ru;
    server_tokens off;
    root /public_html;

    ssl_certificate /etc/letsencrypt/live/domen.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domen.ru/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    location / {
        index index.html;
    }
}

docker-compose.yml :
version: '3'

services:
  nginx:
    image: nginx:1.15-alpine
    restart: unless-stopped
    volumes:
      - ./public_html:/public_html
      - ./data/nginx:/etc/nginx/conf.d
      - ./data/certbot/conf:/etc/letsencrypt
      - ./data/certbot/www:/var/www/certbot
    ports:
      - "80:80"
      - "443:443"
    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
  certbot:
    image: certbot/certbot
    restart: unless-stopped
    volumes:
      - ./data/certbot/conf:/etc/letsencrypt
      - ./data/certbot/www:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

With the following command, I make sure that the preferred certificates are:
docker exec nginx-certbot_nginx_1 ls /etc/letsencrypt/live/domen.ru;

cert.pem
chain.pem
fullchain.pem
privkey.pem

When launched from the project directory:
docker-compose up -d;
I am accessing https://domen.ru - https is crossed out.
Common Name (CN) domen.ru
Organization (O) <Not part of the certificate> Organizational
Unit (OU) <Not part of the certificate>
Common Name (CN) Fake LE Intermediate X1
Organization (O) <Not part of the certificate> Organizational
Unit (OU ) ) <Not part of the certificate>
Issue date Sunday, December 1, 2019 11:43:16 AM
Validity period Saturday, February 29, 2020 11:43:16 AM Fingerprint
SHA-256 64 F6 68 51 A1 79 AA CA 2D 4C EF EB 42 88 87 9B
D9 11 E7 4A 17 C5 0C 0D BE 67 F4 CE E7 84 8A 6B
SHA-1 fingerprint F3 9E C8 7D EA A9 06 A9 E9 1D 30 92 0A 9F 32 B7
63 57 8A EB
Could this be a fake certificate? and sertbotovskie have not loaded yet?
When trying to renew the certificate:
docker exec nginx-certbot_certbot_1 certbot renew;
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/domen.ru.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not yet due for renewal
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certs are not due for renewal yet:
/etc/letsencrypt/live/domen.ru/fullchain.pem expires on 2020-02-29 (skipped)
No renewals were attempted.

What could be wrong?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question