The error I get in the browser is as follows:
NET::ERR_CERT_COMMON_NAME_INVALID
Back to safetyHide advanced
This server could not prove that it is app.fatraaustralia.com.au ; its security certificate is from www.sinerji.com.au . This may be caused by a misconfiguration or an attacker intercepting your connection.
My domain is:
app.fatraaustralia.com.au. It points to an EC2 instance running ubuntu, which has a docker setup running a nodejs app. Infront of the node.js app is a reverse proxy nginx, additionally there is a certbot container running that renews and creates the certificates for the above mentioned domain.
I ran this command:
So I have a docker compose file that I have followed from an article that I have setup and seems to run all the steps successfully. It has the certbot command that renews and generates the certs, as you can see bellow:
version: ‘3.2’
services:
web:
build:
context: ./
dockerfile: Dockerfile
image: server
container_name: webapp
ports:
- 4000:4000
volumes:
- type: bind
source: ./
target: /app
restart: unless-stopped
networks:
- app-network
environment:
nginx:
image: nginx:mainline-alpine
container_name: nginx
restart: unless-stopped
ports:
- “80:80”
- “443:443”
volumes:
- web-root:/var/www/html
- ./nginx-conf:/etc/nginx/conf.d
- certbot-etc:/etc/letsencrypt
- certbot-var:/var/lib/letsencrypt
- dhparam:/etc/ssl/certs
depends_on:
- web
networks:
- app-network
certbot:
image: certbot/certbot
container_name: certbot
volumes:
- certbot-etc:/etc/letsencrypt
- certbot-var:/var/lib/letsencrypt
- web-root:/var/www/html
depends_on:
- nginx
command: certonly --webroot --webroot-path=/var/www/html --agree-tos --no-eff-email --force-renewal -d app.fatraaustralia.com.au
volumes:
certbot-etc:
certbot-var:
web-root:
driver: local
driver_opts:
type: none
device: /home/ubuntu/ss-gql-server/views
o: bind
dhparam:
driver: local
driver_opts:
type: none
device: /home/ubuntu/server/dhparam/
o: bind
networks:
app-network:
driver: bridge
It produced this output:
certbot | Saving debug log to /var/log/letsencrypt/letsencrypt.log
certbot | Plugins selected: Authenticator webroot, Installer None
certbot | Renewing an existing certificate
certbot | IMPORTANT NOTES:
certbot | - Congratulations! Your certificate and chain have been saved at:
certbot | /etc/letsencrypt/live/app.fatraaustralia.com.au/fullchain.pem
certbot | Your key file has been saved at:
certbot | /etc/letsencrypt/live/app.fatraaustralia.com.au/privkey.pem
certbot | Your cert will expire on 2020-01-29. To obtain a new or tweaked
certbot | version of this certificate in the future, simply run certbot
certbot | again. To non-interactively renew all of your certificates, run
certbot | “certbot renew”
certbot | - If you like Certbot, please consider supporting our work by:
certbot |
certbot | Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
certbot | Donating to EFF: https://eff.org/donate-le
certbot |
certbot exited with code 0
My web server is (include version):
nginx alpine docker image.
The operating system my web server runs on is (include version):
Ubuntu 16.04.6 LTS which is an ec2 instance.
My hosting provider, if applicable, is:
crazy domains has an a record for the sub domain app.fatraaustralia.com.au that is pointing towards elastic ip of the ec2 instance.
I can login to a root shell on my machine (yes or no, or I don’t know):
yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):
It is the image certbot/certbot fro docker.
my nginx config is as follows:
server {
listen 80;
listen [::]:80;
root /var/www/html;
index index.html index.htm index.nginx-debian.html;
server_name app.fatraaustralia.com.au;
location ~ /.well-known/acme-challenge {
allow all;
root /var/www/html;
}
location / {
rewrite ^ https://$host$request_uri? permanent;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name app.fatraaustralia.com.au;
server_tokens off;
ssl_certificate /etc/letsencrypt/live/app.fatraaustralia.com.au/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/app.fatraaustralia.com.au/privkey.pem;
ssl_buffer_size 8k;
ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
ssl_ecdh_curve secp384r1;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8;
location / {
try_files $uri @nodejs;
}
location @nodejs {
proxy_pass_header Set-Cookie;
proxy_pass http://web:4000;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# enable strict transport security only if you understand the implications
}
root /var/www/html;
index index.html index.htm index.nginx-debian.html;
}
