Renew Let's encrypt certificate automatically without stopping nginx hosted on docker

Question

I am using nginx as proxy and SSL termination for the site hosted on docker. App & nginx both are on docker. I have installed Let's encrypt SSL using Certbot directly on Ubuntu server. And now using the SSL cert installed on Ubuntu server in Docker by mapping it using volume in docker-compose.

I noticed that Certbot cron job to renew certificate is failing as the port 80 and 443 are in use by docker nginx instance.

And to renew, I need to stop the docker and then run certbot renew command which works fine.

What is the best way to have automated renewal without stopping docker container that runs nginx.

score 2 · Answer 1 · answered Mar 03 '21 at 18:42

2

One of the obvious answers is to not use certbot. There are many other ACME compatible clients, some that could use the DNS-01 challenge.

Or you could use a different proxy that has certificate renewal built in. One popular choice is Traefik, that works nicely as a proxy, and can automatically get certs using either HTTP or DNS challenges, depending on what you configure.

If you really want to stick with certbot, look at switching over to DNS validation if you can. Using DNS validation doesn't require opening any ports, it does require you be able to automatically publish a DNS record though.

answered Mar 03 '21 at 18:42

Zoredache

130,897
41
276
420

does it need to publish a new /updated record for renewal? Or is it one time record for the same? – Krunal Mar 18 '21 at 11:19
Yes the challenge has to be changed each time you renew the certificate. – Zoredache Mar 18 '21 at 23:48

score 0 · Answer 2 · answered Mar 03 '21 at 19:09

0

Options that I see using certbot:

Let nginx serve the HTTP-01 response. While I imagine that the nginx plugin wouldn't play nice in your containerized scenario, the webroot plugin ought to be fine if you just map the .well-known/acme-challenge/ directory as necessary.
Have certbot use DNS-01 instead, then nginx is entirely taken out of the picture of the challenge handling.

answered Mar 03 '21 at 19:09

Håkan Lindqvist

35,011
5
69
94

I don't see DNS-01 in the link? Can you give some more idea on the same? – Krunal Mar 18 '21 at 11:16
@Krunal I linked to the page that lists the included DNS plugins (for completing the DNS-01 challenge) – Håkan Lindqvist Mar 18 '21 at 12:19
Ok, get that. Looking at that. – Krunal Mar 18 '21 at 16:43
how can I use webroot plugin with mapping .well-known/acme-challenge... – Krunal Apr 06 '21 at 10:39

Renew Let's encrypt certificate automatically without stopping nginx hosted on docker

2 Answers2