Back in February I ran the shell script pasted below to generate a letsencrypt certificate on my server. It worked, and after I had it I set up a docker-compose file with services nginx, certbot, among others, to redirect http://example.com to https://example.com. All was well for 90 days till renewal time. My automated renewal failed. I guess for the same reason my attempt to manually get a new certificate via the init shell file below also fails this time around.
The docker services that handled the redirects from http to https have been stopped yet the redirects appear to remain in place. There's currently no reverse proxy running since I have stopped the nginx container. However visiting http://collabora.alamko.de STILL tries to redirect to https. I suspect this is part of or related to my issue. The browser tells me 'connection refused', the same as the output message below 'Certbot failed'.
It looks like the script which obtains the certificate try's a url at http but this time around it's being redirected to https which is perhaps what's causing the problem? See the output below.
My domain is:
collabora.alamko.de
I ran this command:
See pasted shell script below init-letsencrypt.sh
It produced this output:
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: collabora.alamko.de
Type: connection
Detail: Fetching http://collabora.alamko.de/.well-known/acme-challenge/f7ANvS1aFRNrx5BN7gbeEDGiF5cG3xCLWI-RVm7AOT0: Connection refused
My web server is (include version):
Looking at the sh script mentioned above, init-letsencrypt.sh, it seems to be using nginx via a docker container.
The operating system my web server runs on is (include version):
Ubuntu 20.04.1 LTS
My hosting provider, if applicable, is:
Hetzner
I can login to a root shell on my machine (yes or no, or I don't know):
Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No.
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
Certbot via docker. I presume latest'? Details in the init sh script below.
Here is the init-letsencrypt.sh that I've been referencing throughout my post (Not my script, downloaded from a blog out there somewhere). Before, when I ran this script the outcome was a newly generated letsencrypt certificate. This time around I get the 'connection refused' error message:
#!/bin/bash
if ! [ -x "$(command -v docker-compose)" ]; then
echo 'Error: docker-compose is not installed.' >&2
exit 1
fi
domains=(collabora.alamko.de)
rsa_key_size=4096
data_path="./data/certbot"
email="myemail@fastmail.com" # Adding a valid address is strongly recommended
staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits
if [ -d "$data_path" ]; then
read -p "Existing data found for $domains. Continue and replace existing certificate? (y/N) " decision
if [ "$decision" != "Y" ] && [ "$decision" != "y" ]; then
exit
fi
fi
if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then
echo "### Downloading recommended TLS parameters ..."
mkdir -p "$data_path/conf"
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf"
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem"
echo
fi
echo "### Creating dummy certificate for $domains ..."
path="/etc/letsencrypt/live/$domains"
mkdir -p "$data_path/conf/live/$domains"
docker-compose run --rm --entrypoint "\
openssl req -x509 -nodes -newkey rsa:$rsa_key_size -days 1\
-keyout '$path/privkey.pem' \
-out '$path/fullchain.pem' \
-subj '/CN=localhost'" certbot
echo
echo "### Starting nginx ..."
docker-compose up --force-recreate -d nginx
echo
echo "### Deleting dummy certificate for $domains ..."
docker-compose run --rm --entrypoint "\
rm -Rf /etc/letsencrypt/live/$domains && \
rm -Rf /etc/letsencrypt/archive/$domains && \
rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot
echo
echo "### Requesting Let's Encrypt certificate for $domains ..."
#Join $domains to -d args
domain_args=""
for domain in "${domains[@]}"; do
domain_args="$domain_args -d $domain"
done
# Select appropriate email arg
case "$email" in
"") email_arg="--register-unsafely-without-email" ;;
*) email_arg="--email $email" ;;
esac
# Enable staging mode if needed
if [ $staging != "0" ]; then staging_arg="--staging"; fi
docker-compose run --rm --entrypoint "\
certbot certonly --webroot -w /var/www/certbot \
$staging_arg \
$email_arg \
$domain_args \
--rsa-key-size $rsa_key_size \
--agree-tos \
--force-renewal" certbot
echo
echo "### Reloading nginx ..."
docker-compose exec nginx nginx -s reload
Given my server seems to continue to redirect, even though I've switched off the docker services that created and managed the redirects, how can I obtain a new letsencrypt certificate?
