如何在 docker 中使用 certbot 正确安装 ssl 证书？

Question

我正在尝试部署Node.js/Express应用程序Docker，使用让我们为 HTTPS 加密 SSL 证书。

当我运行docker-compose up命令时，所有 3 个服务都已启动，但我注意到这样的警告：

Saving debug log to /var/log/letsencrypt/letsencrypt.log
No certs found.

当 docker 尝试RUN /scripts/certbot-auto -n certificates在certbot/Dockerfile文件中执行命令时会发生此警告。

里面的/var/log/letsencrypt/letsencrypt.log文件我看到这个：

2019-08-21 10:27:50,354:DEBUG:certbot.main:certbot version: 0.37.1
2019-08-21 10:27:50,355:DEBUG:certbot.main:Arguments: ['-n']
2019-08-21 10:27:50,355:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#apache,PluginEntryPoint#manual,PluginEntryPoint#nginx,Plugin$
2019-08-21 10:27:50,372:DEBUG:certbot.log:Root logging level set at 20
2019-08-21 10:27:50,372:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log

同样在 nginx 容器的日志中，我注意到这样的警告：

2019/08/21 10:28:37 [emerg] 1#1: cannot load certificate "/etc/letsencrypt/live/tols/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/tols/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file) 

问题：据我所知，没有创建 ssl 证书。如何解决此问题并使用 certbot 正确安装证书？

结构:

certbot/
    certbot-auto
    Dockerfile
    register
nginx/
    Dockerfile
    nginx.conf
server/
    bin/
        www.js
Dockerfile
docker-compose.yml

docker-compose.yml：

version: '3'

services:
  frontend:
    build: ./
    image: tols_frontend_image
    container_name: tols_frontend_container
    restart: always
    volumes:
    - certbot-webroot-tols:/tols-frontend/public/.well-known
    - certbot-letsencrypt:/etc/letsencrypt

  certbot:
    build: ./certbot
    image: tols_certbot_image
    container_name: tols_certbot_container
    restart: always
    volumes:
    - certbot-webroot-tols:/webroots/tols/.well-known
    - certbot-letsencrypt:/etc/letsencrypt

  nginx:
    build: ./nginx
    image: tols_nginx_image
    container_name: tols_nginx_container
    ports:
    - "9012:80"
    - "9013:443"
    restart: always
    volumes:
    - certbot-webroot-tols:/webroots/tols/.well-known
    - certbot-letsencrypt:/tols/letsencrypt

volumes:
  certbot-webroot-tols:
  certbot-letsencrypt:

certbot/Dockerfile：

FROM debian:jessie

RUN apt-get update && apt-get install -y cron bash wget
RUN mkdir -p /webroots/tols/.well-known /scripts

WORKDIR /scripts
COPY certbot-auto certbot-auto
RUN chmod a+x ./certbot-auto
RUN /scripts/certbot-auto -n certificates
COPY register /scripts/
RUN chmod +x /scripts/register

VOLUME /webroots
VOLUME /etc/letsencrypt
RUN echo "0 0 1 * * root /scripts/certbot-auto renew" >/etc/cron.d/certbot

CMD [ "cron", "-f" ]

证书机器人/注册：

#!/bin/sh
/scripts/certbot-auto certonly --webroot -w /webroots/$1 -d $1

nginx/Dockerfile：

FROM nginx
COPY nginx.conf /etc/nginx/nginx.conf
EXPOSE 80
EXPOSE 443

nginx/nginx.conf：

user  root;
worker_processes  1;
error_log  /var/log/nginx-error.log debug;
pid        /var/run/nginx.pid;
events {
    worker_connections  1024;
}
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx-access.log  main;
    sendfile        on;
    keepalive_timeout  65;
    server {
        listen 80;
        listen [::]:80 default_server ipv6only=on;
        return 301 https://$host$request_uri;
    }
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name tols;
        ssl_certificate /etc/letsencrypt/live/tols/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/tols/privkey.pem;
        location / {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-NginX-Proxy true;
            proxy_pass http://frontend:3010/;
            proxy_ssl_session_reuse off;
            proxy_set_header Host $http_host;
            proxy_cache_bypass $http_upgrade;
            proxy_redirect off;
        }
        location /.well-known {
            root /webroots/tols/.well-known;
        }
    }
}

Answer 1

Let's Encrypt 生成的 SSL 证书有效期为 90 天，然后自动续订

这是 Letsencrypt 的 docker 实现docker-compose.yml

让加密：

image: jrcs/letsencrypt-nginx-proxy-companion:v1.7
container_name: letsencrypt
restart: always
volumes_from:
    - nginx
volumes:
  - ./letsencrypt/certs:/etc/nginx/certs:rw
  - /var/run/docker.sock:/var/run/docker.sock:ro
environment:
  - REUSE_PRIVATE_KEYS=true

对于 nginx，这里的代码来自docker-compose.yml

nginx:

image: jwilder/nginx-proxy:0.6.0
container_name: nginx
restart: always
labels:
  - com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy
ports:
  - "443:443"
  - "80:80"
volumes:
  - /var/run/docker.sock:/tmp/docker.sock:ro
  - ./nginx/html:/usr/share/nginx/html
  - ./nginx/vhost.d:/etc/nginx/vhost.d
  - ./letsencrypt/certs:/etc/nginx/certs:ro

现在的问题是如何更新我的 Letscrypt 认证？

更新证书

• 检查证书公用名称是否与您要续订的名称相匹配。
• 检查证书详细信息是否准确。
• 如果您希望在到期前自动续订，请启用自动续订。
• 提交订单。

这是将自动更新证书的命令

sudo docker exec letsencrypt /app/force_renew