Apply new certificates without restarting server. Using docker and nginx

DanielIvaylov · November 25, 2020, 8:53am

The certificates are on the server, not in the docker container.
cp /etc/letsencrypt/archive/b2bmarket.aidimme.es/privkey2.pem /etc/letsencrypt/live/b2bmarket.aidimme.es/privkey.pem
cp: cannot stat '/etc/letsencrypt/archive/b2bmarket.aidimme.es/privkey2.pem': No such file or directory

griffin · November 25, 2020, 8:55am

Where are these then?

Do you not have the archive there?

DanielIvaylov · November 25, 2020, 8:57am

yes i have this in the docker container This are the old certificates. And the new ones are in the server . I get them for first time with the nginx.config the first time .
ls -l /etc/letsencrypt/live/b2bmarket.aidimme.es/
total 8
-rwxr-xr-x 1 root root 3574 Sep 14 11:47 fullchain.pem
-rwxr-xr-x 1 root root 1704 Sep 14 11:47 privkey.pem

griffin · November 25, 2020, 8:58am

That's the issue. Those are the September 4 certificates (copied on September 14). You need to replace those with the November 24 files (keeping the names as they are in the live folder).

DanielIvaylov · November 25, 2020, 9:01am

how do i replace the documents from the server to the docker container?

griffin · November 25, 2020, 9:01am

How did the others get into the docker container?

DanielIvaylov · November 25, 2020, 10:24am

This is the docker_setup and nginx config of my project.

github.com

nimble-platform/docker_setup/blob/master/prod-fmp/infra/nginx/nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log info;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  text/html;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"';

    server {
        listen              80 default_server;
        listen              [::]:80 default_server;
        server_name         fmp-nimble.salzburgresearch.at;

This file has been truncated. show original

In the file of nginx.config we have the path to the ssl certificate and key. This is the path. in my case:
ssl_certificate /etc/letsencrypt/live/b2bmarket.aidimme.es/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/b2bmarket.aidimme.es/privkey.pem;

I notice that the new certificates are in /archive/b2bmarket.aidimme.es so i change the path.
to
ssl_certificate /etc/letsencrypt /archive/b2bmarket.aidimme.es/fullchain3.pem;
ssl_certificate_key /etc/letsencrypt/archive/b2bmarket.aidimme.es/privkey3.pem;

i did certbot renew --force-renewal so i have cert3 and chain 3 now.
ls -l /etc/letsencrypt/live/b2bmarket.aidimme.es/
total 4
lrwxrwxrwx 1 root root 44 nov 25 10:42 cert.pem -> ../../archive/b2bmarket.aidimme.es/cert3.pem
lrwxrwxrwx 1 root root 45 nov 25 10:42 chain.pem -> ../../archive/b2bmarket.aidimme.es/chain3.pem
lrwxrwxrwx 1 root root 49 nov 25 10:42 fullchain.pem -> ../../archive/b2bmarket.aidimme.es/fullchain3.pem
lrwxrwxrwx 1 root root 47 nov 25 10:42 privkey.pem -> ../../archive/b2bmarket.aidimme.es/privkey3.pem
-rwxrwxrwx 1 root root 692 sep 4 09:54 README

But when i restart the container it have exited status.
logs of container: docekr logs id

2020/11/25 10:23:06 [emerg] 1#1: BIO_new_file("/etc/letsencrypt/archive/b2bmarket.aidimme.es/fullchain3.pem") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/archive/b2bmarket.aidimme.es/fullchain3.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
nginx: [emerg] BIO_new_file("/etc/letsencrypt/archive/b2bmarket.aidimme.es/fullchain3.pem") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/archive/b2bmarket.aidimme.es/fullchain3.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)

One colegue told me to coppy the certs to other directory and restart the container. I did it but got the same resoult :No such file or directory

DanielIvaylov · November 25, 2020, 10:41am

Ok i just restarted the container and i have the new certificates applied and now i have them in the platform.
I think that sudo certbot renew --force-renewal woked because i put the old certificate path and now i have it applied.
Thank you very much for the help @griffin @rg305

Topic		Replies	Views
Renew cert without stop/start nginx docker container Help	13	7636	October 7, 2023
I cant renew certificates without stopping nginx on docker Help	4	3551	October 27, 2021
Crontab HS Made Docker Image Certificate renewal Nginx reload Help	17	279	September 21, 2024
Error renew certificate docker Help	1	1582	January 20, 2022
Certificate renewed but server still not secure Help	40	606	May 2, 2024

Apply new certificates without restarting server. Using docker and nginx

Related topics