SSL Certificates Not Generated with Certbot for Nginx using Docker

If you're running Nginx in a Docker container, you might be wondering how to generate SSL certificates for your website. One popular tool for generating SSL certificates is Certbot, but it's not always straightforward to use it with Nginx in Docker.

In this article, we'll walk you through the process of generating SSL certificates for Nginx running in a Docker container, without using Certbot. We'll cover the following steps:

1. Setting up a Docker container for Nginx
2. Obtaining SSL certificates from Let's Encrypt
3. Configuring Nginx to use the SSL certificates
4. Renewing the SSL certificates

Step 1: Setting up a Docker container for Nginx

The first step is to create a Docker container for Nginx. We'll use the official Nginx Docker image, which you can pull from Docker Hub:

docker pull nginx

Next, we'll create a new Docker container based on the Nginx image. We'll map the container's port 80 to the host's port 80, and the container's port 443 to the host's port 443. This will allow us to access the Nginx server from the host machine.

docker run -d -p 80:80 -p 443:443 --name my-nginx nginx

At this point, you should be able to access the Nginx server by navigating to http://localhost in your web browser.

Step 2: Obtaining SSL certificates from Let's Encrypt

Now that we have Nginx up and running, we can obtain SSL certificates from Let's Encrypt. We'll use the Certbot client to generate the certificates.

Before we can generate the certificates, we need to create a Docker container that runs the Certbot client. We'll use the official Certbot Docker image, which you can pull from Docker Hub:

docker pull certbot/certbot

Next, we'll create a new Docker container based on the Certbot image. We'll map the container's port 80 to the host's port 80, and the container's port 443 to the host's port 443. This will allow the Certbot client to access the Nginx server and verify that we own the domain.

docker run -it --rm -p 80:80 -p 443:443 --name my-certbot certbot/certbot certonly --webroot -w /var/www/html -d example.com --email [email protected] --agree-tos --non-interactive

Replace example.com with the domain name of your website, and replace [email protected] with your email address. The Certbot client will generate the SSL certificates and save them to the host machine.

You can find the SSL certificates in the following directory on the host machine:

/etc/letsencrypt/live/example.com

Step 3: Configuring Nginx to use the SSL certificates

Now that we have the SSL certificates, we can configure Nginx to use them. We'll need to modify the Nginx configuration file to include the path to the SSL certificates.

First, we'll create a new Docker container for Nginx. We'll use the same Nginx image as before, but this time we'll mount the SSL certificates as a volume.

docker run -d -p 80:80 -p 443:443 --name my-nginx -v /etc/letsencrypt/live/example.com:/etc/nginx/ssl nginx

Next, we'll modify the Nginx configuration file to include the path to the SSL certificates. We'll use the docker exec command to modify the Nginx configuration file inside the Docker container.

docker exec my-nginx bash -c "echo 'ssl_certificate /etc/nginx/ssl/fullchain.pem;' > /etc/nginx/conf.d/default.conf"

docker exec my-nginx bash -c "echo 'ssl_certificate_key /etc/nginx/ssl/privkey.pem;' >> /etc/nginx/conf.d/default.conf"

This will add the following lines to the Nginx configuration file:

ssl_certificate /etc/nginx/ssl/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/privkey.pem;

This tells Nginx to use the SSL certificates when serving HTTPS requests.

Finally, we'll restart the Nginx container to apply the changes.

docker restart my-nginx

At this point, you should be able to access your website using HTTPS.

Step 4: Renewing the SSL certificates

The SSL certificates from Let's Encrypt are valid for 90 days, so you'll need to renew them periodically. We can use the Certbot client to renew the certificates automatically.

First, we'll create a new Docker container for the Certbot client, just like we did before.

docker run -it --rm -p 80:80 -p 443:443 --name my-certbot certbot/certbot certonly --webroot -w /var/www/html -d example.com --email [email protected] --agree-tos --non-interactive

Next, we'll use the docker exec command to renew the certificates.

docker exec my-certbot certbot renew --webroot -w /var/www/html --post-hook "docker restart my-nginx"

This will renew the SSL certificates and restart the Nginx container to apply the changes.

In this article, we've shown you how to generate SSL certificates for Nginx running in a Docker container, without using Certbot. We've covered the following steps:

1. Setting up a Docker container for Nginx
2. Obtaining SSL certificates from Let's Encrypt
3. Configuring Nginx to use the SSL certificates
4. Renewing the SSL certificates

We hope this article has been helpful. If you have any questions or comments, please leave them below.

References