stackoom
  简体   繁体   中英

Adding SSL certs to NGINX docker container

 原文  2018-07-18 10:38:15  7   3    docker/ ssl/ nginx/ docker-compose/ ssl-certificate

Question

I'm trying to add SSL certs (generated with LetsEncrypt) to my nginx. The nginx is built from a docker-compose file where I create a volume from my host to the container so the containers can access the certs and private key. 

volumes:
  - /etc/nginx/certs/:/etc/nginx/certs/

When the nginx container starts and fails with the following error

[emerg] 1#1: BIO_new_file("/etc/nginx/certs/fullchain.pem") failed 
(SSL: error:02001002:system library:fopen:No such file or 
directory:fopen('/etc/nginx/certs/fullchain.pem','r') 
error:2006D080:BIO routines:BIO_new_file:no such file)

My nginx config file looks like this:

server {
    listen 80;
    server_name server_blah www.server_blah;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name server_blah;
    ssl_certificate      /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key  /etc/nginx/certs/privkey.pem;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;
}

What am I missing/doing incorrectly?

3 answers

solution1
 16 ACCPTED  2018-07-19 17:04:58

Finally cracked this and was able to successfully repeat the process on my dev and production site to get SSL certs working!

Sorry for the length of the post!

In my setup I have docker docker-compose setup on an ubuntu 16 machine.

Anyone who's encountering this problem I'll detail the steps I did.

  1. Go to the directory where your code lives

    cd /opt/example_dir/

  2. Make a directory for letsencrypt and it's site.

    sudo mkdir -p /opt/example_dir/letsencrypt/letsencrypt-site

  3. Create barebones docker-compose.yml file from the letsencrypt directory.

    sudo nano /opt/example_dir/letsencrypt/docker-compose.yml

Add the following to it:

    version: '2'

        services:
            image: nginx:latest
            ports:
              - "80:80"
            volumes:
              - ./nginx.conf:/etc/nginx/conf.d/default.conf
              - ./letsencrypt-site:/usr/share/nginx/html
            networks:
              - docker-network

        networks:
          docker-network:
            driver: bridge

* This will pull down the latest nginx version
* Expose port 80 
* Mount a config file (that i'll create later) 
* Maps the site directory so that we can have a simple test index.html for when

we start the simple nginx container.

  1. Create an nginx.conf file in /opt/example_dir/letsencrypt

    sudo nano /opt/example_dir/letsencrypt/nginx.conf

Put the following into it

    server {
      listen 80;
      listen [::]:80;
      server_name example_server.com;

      location ~ /.well-known/acme-challenge {
          allow all;
          root /usr/share/nginx/html;
      }

      root /usr/share/nginx/html;
      index index.html;
    }

* This listens for requests on port 80 for the server with name example_server.com
* Gives the Certbot agent access to ./well-known/acme-challenge
* Sets the default root and file
  1. Next create an index.html file within /opt/example_dir/letsencrypt/letsencrypt-site

sudo nano /opt/example_dir/letsencrypt/letsencrypt-site/index.html

Add the following to it

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8" />
    <title>LetsEncrypt Setup</title>
</head>
<body>

    <p>Test file for our http nginx server</p>
</body>
</html>

#### All parts in place for basic nginx container!

  1. Now we start up the nginx container.

     cd /opt/example_dir/letsencrypt sudo docker-compose up -d

The nginx container is up and running now, visit the url you've defined and you should get the test index.html page back. At this point we're ready to run the certbot command to generate some certs

  1. Run the following to generate certs replacing --email with your email

    sudo docker run -it --rm \\ -v /docker-volumes/etc/letsencrypt:/etc/letsencrypt \\ -v /docker-volumes/var/lib/letsencrypt:/var/lib/letsencrypt \\ -v /opt/example_dir/letsencrypt/letsencrypt-site:/data/letsencrypt \\ -v "/docker-volumes/var/log/letsencrypt:/var/log/letsencrypt" \\ certbot/certbot \\ certonly --webroot \\ --email youremail@domain.com --agree-tos --no-eff-email \\ --webroot-path=/data/letsencrypt \\ -d example.com
    • Run docker in interactive mode so you can see the output.
    • When its finished generating certs it will remove itself.
    • It will mount 4 volumes:
      1. The letsencrypt folder where the certs are stored/
      2. A lib folder
      3. Maps our site folder
      4. Maps a logging path
    • It agrees to ToS
    • Specifies the root webpath
    • Specify the server address you want to generate certs for.

If that command ran okay then we have generated certs for this web server. We can now use these in our production site and configure nginx to use the ssl and make use of these certs!

  1. Shut down the nginx container

    cd /opt/example_dir/letsencrypt/ sudo docker-compose down

Setup Production nginx container

Directory structure should look like this now. Where you have your code / web app project and then the letsencrypt folder that we created above.

/opt/example_dir
             / -> project_folder
             / -> letsencrypt

  1. Create a folder call dh-param

     sudo mkdir -p /opt/example_dir/project_folder/dh-param

  2. Generate a dh key

    sudo openssl dhparam -out /opt/example_dir/project_folder/dh-param/dhparam-2048.pem 2048

  3. Update docker-compose.yml and nginx.conf files within /opt/example_dir/project_folder

The project_folder is where my source code lives so I create a production config file here for nginx and update the docker-compose.yml to mount my nginx config, dh-pharam exchange key as well as the certs themselves we created earlier.

nginx service in the docker-compose 

    nginx:
        image: nginx:1.11.3
        restart: always
        ports:
          - "80:80"
          - "443:443"
          - "8000:8000"
        volumes:
          - ./nginx.conf:/etc/nginx/conf.d/default.conf
          - ./dh-param/dhparam-2048.pem:/etc/ssl/certs/dhparam-2048.pem
          - /docker-volumes/etc/letsencrypt/live/exampleserver.com/fullchain.pem:/etc/letsencrypt/live/exampleserver.com/fullchain.pem
          - /docker-volumes/etc/letsencrypt/live/exampleserver.com/privkey.pem:/etc/letsencrypt/live/exampleserver.com/privkey.pem
        networks:
          - docker-network

        volumes_from:
          - flask
        depends_on:
          - flask
          - falcon
        links:
          - datastore

nginx.conf within project_folder 

error_log /var/log/nginx/error.log warn;

server {
    listen 80;
    listen [::]:80;

    server_name exampleserver.com

    location / {
        rewrite ^ https://$host$request_uri? permanent;
    }

    #for certbot challenges (renewal process)
    location ~ /.well-known/acme-challenge {
        allow all;
        root /data/letsencrypt;
    }
}

#https://exampleserver.com
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name exampleserver.com;

    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/exampleserver.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/exampleserver.com/privkey.pem;

    ssl_buffer_size 8k;

    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;

    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;


    # Define the specified charset to the “Content-Type” response header field
    charset utf-8;
}

At this point everything is setup! (finally)

  1. Spin up the docker container.

     cd /opt/example_dir/project_folder sudo docker-compose up -d # Check the docker log with: sudo docker logs -f -t

I know it's a lot of steps but this is what I have done, it's worked for me and hope it helps someone else.

solution2
 1  2020-09-15 08:06:15

My solution:

I have mapped /etc/letsencrypt/live/mydomain.com/ to /etc/nginx/certs/ by:

volumes:
  - /etc/letsencrypt/live/mydomain.com/:/etc/nginx/certs/

In this case, it has mapped the soft symbolic link.

lrwxrwxrwx 1 root root   38 Sep 15 00:21 chain.pem -> ../../archive/mydomain.com/chain1.pem
lrwxrwxrwx 1 root root   42 Sep 15 00:21 fullchain.pem -> ../../archive/mydomain.com/fullchain1.pem
lrwxrwxrwx 1 root root   40 Sep 15 00:21 privkey.pem -> ../../archive/mydomain.com/privkey1.pem

Finally, I changed the volume section as the following:

volumes:
  - /etc/letsencrypt/archive/mydomain.com/:/etc/nginx/certs/

solution3
 0  2018-07-19 07:54:05

I've got the exact same problem right now. Same error codes.

I tried different things on my .pem files:

  • Changing permissions (chmod) to:
    • 777
    • 755
    • 600
  • Changing the owner (chown) to:
    • nginx (user defined in nginx.conf)
    • root
  • Changing the location to:
    • /etc/ssl/certs
    • /etc/nginx/ssl
    • /etc/letsencrypt/live
  • Changing docker mounting to:
    • ro (readonly)
    • rw (readwrite)

Sadly, none of those solutions worked for me.

It really looks like nginx isn't able to find the files even if I'm able to list (ls) them when I connect to the container terminal.

To give some more details, I'm running Docker on a Synology DS918+ NAS.

I hope this will help to find the solution! I'll be experimenting and trying various things, I'll come back if I manage to get this working!

暂无
暂无

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

Related Question Nginx SSL inside a docker container SSL not working in Nginx docker container trying ssl to docker nginx container docker nginx ssl proxy pass to another container Using SSL on nginx in a Docker container hosted on Jelastic Adding SSL certificates to a mysql docker container Adding SSL certificates to Docker linux container SSL SpringBoot App Docker container behind Nginx Proxy Wordpress inside docker container behind nginx proxy with ssl How to expose an nginx docker container via Apache 2 with SSL?
Related Tags
 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM