如何在Dockerized反向代理后面解析LetsEncrypt / Certbot 404？

Question

I have a couple web-domains behind a reverse proxy in Docker... As context, here's a snippet from the docker-compose.yml: 我在Docker中的反向代理后面有两个网络域...作为上下文，这是docker-compose.yml中的片段：

version: '2'

services:
  nginx-proxy:
    image: jwilder/nginx-proxy
    container_name: nginxREVERSE
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro

  site1:
    container_name: 'nginxsite1'
    image: nginx:latest
    volumes:
      - ./sites-available/site1.com/index.html:/usr/share/nginx/html/index.html
      - ./sites-available/site1.com/nginx.conf:/etc/nginx/conf.d/default.conf
    ports:
      - 8080:80
    environment:
      - VIRTUAL_HOST=site1.com,www.site1.com
      - VIRTUAL_PORT:80
      - VIRTUAL_PORT:443

 site2:
    container_name: 'nginxsite2'
    image: nginx:latest
    volumes:
      - ./sites-available/site2.com/index.html:/usr/share/nginx/html/index.html
    ports:
      - 8082:80
    environment:
      - VIRTUAL_HOST=site2.com,www.site2.com
      - VIRTUAL_PORT:80

And this works perfectly in my browser. 这在我的浏览器中完美运行。 I can go to site1.com/www.site1.com or site2.com/www.site2.com and I get proxied to the correct Index.html page. 我可以转到site1.com/www.site1.com或site2.com/www.site2.com，然后代理到正确的Index.html页面。

Site1.com's nginx.conf file: Site1.com的nginx.conf文件：

server {
    listen 80;
    listen [::]:80;
    server_name site1.com www.site1.com;

    location ~ /.well-known/acme-challenge {
        allow all;
        root /usr/share/nginx/html;
    }

    root /usr/share/nginx/html;
    index index.html;
}

I'm running Certbot in docker using this command: 我正在使用以下命令在docker中运行Certbot：

sudo docker run -it --rm \
-v /docker-volumes/etc/letsencrypt:/etc/letsencrypt \
-v /docker-volumes/var/lib/letsencrypt:/var/lib/letsencrypt \
-v /docker/letsencrypt-docker-nginx/src/letsencrypt/letsencrypt-site:/data/letsencrypt \
-v "/docker-volumes/var/log/letsencrypt:/var/log/letsencrypt" \
certbot/certbot \
certonly --webroot \
--register-unsafely-without-email --agree-tos \
--webroot-path=/data/letsencrypt \
--staging \
-d site1.com -d www.site1.com

When I port forward from the router to site1.com container directly, above works. 当我直接从路由器移植到site1.com容器时，以上方法均有效。

When I port forward to the reverse proxy, I get this 404 error from Certbot: 当我移植到反向代理时，我从Certbot收到此404错误：

Failed authorization procedure. site1.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorizatin :: Invalid response from http://site1.com/.well-known/acme-challenge/x05mYoqEiWlrRFH9ye6VZfEiX-mlwEffVt2kP3twoOU: "<html>\r\n<head><ttle>404 Not Found</title></head>\r\n<body>\r\n<center><h1>404 Not Found</h1></center>\r\n<hr><center>nginx/1.15.5</ce", www.site1.com (ttp-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://www.site1/.well-known/acme-challenge/AIDgGYg1WiQRm4-dOVK6fV8-vKqR940nLPzT9poFUZA: "<html>\r\n<head><title>404 Not Found</title></head>\r\n<body>r\n<center><h1>404 Not Found</h1></center>\r\n<hr><center>nginx/1.15.5</ce"

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: site1.com
   Type:   unauthorized
   Detail: Invalid response from
   http://site1.com/.well-known/acme-challenge/x05mYoqEiWlrRFH9ye6VZfEiX-mlwEOU:
   "<html>\r\n<head><title>404 Not
   Found</title></head>\r\n<body>\r\n<center><h1>404 Not
   Found</h1></center>\r\n<hr><center>nginx/1.15.5</ce"

   Domain: www.site1.com
   Type:   unauthorized
   Detail: Invalid response from
   http://www.site1.com/.well-known/acme-challenge/AIDgGYg1WiQRm4-dOVK6fV8-poFUZA:
   "<html>\r\n<head><title>404 Not
   Found</title></head>\r\n<body>\r\n<center><h1>404 Not
   Found</h1></center>\r\n<hr><center>nginx/1.15.5</ce"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

What am I missing that allows me to access the sites behind the reverse proxy from my browser but won't allow Cerbot? 我缺少什么让我可以从浏览器访问反向代理后面的网站，但不允许Cerbot呢？

Answer 1

The challenge location in your Site1.com's nginx.conf file don't match with the certbot option --webroot-path. 您的Site1.com的nginx.conf文件中的质询位置与certbot选项--webroot-path不匹配。 It's for that you get a 404 error. 这是因为您收到404错误。

Next a posible correction. 接下来是可能的更正。

Site1.com's nginx.conf file: Site1.com的nginx.conf文件：

server {
    listen 80;
    listen [::]:80;
    server_name site1.com www.site1.com;

    location ~ /.well-known/acme-challenge {
        alias /usr/share/nginx/html;
        try_files $uri =404;
    }

    root /usr/share/nginx/html;
    index index.html;
}

Certbot in docker using this command: 使用以下命令在docker中的Certbot：

sudo docker run -it --rm \
-v /docker-volumes/etc/letsencrypt:/etc/letsencrypt \
-v /docker-volumes/var/lib/letsencrypt:/var/lib/letsencrypt \
-v /docker/letsencrypt-docker-nginx/src/letsencrypt/letsencrypt-site:/data/letsencrypt \
-v "/docker-volumes/var/log/letsencrypt:/var/log/letsencrypt" \
certbot/certbot \
certonly --webroot \
--register-unsafely-without-email --agree-tos \
--webroot-path=/usr/share/nginx/html \
--staging \
-d site1.com -d www.site1.com

如何在Dockerized反向代理后面解析LetsEncrypt / Certbot 404？

问题描述

1 个解决方案

解决方案1
0 2019-06-19 10:00:39

如何在Dockerized反向代理后面解析LetsEncrypt / Certbot 404？

问题描述

1 个解决方案

解决方案1 0 2019-06-19 10:00:39

解决方案1
0 2019-06-19 10:00:39