Create certificate but is not working

[lcluna86]

My domain is: https://symloging.cloudns.cl/

is for onlyoffice document server

i used certbot

i have this msg

this CA Root certificate is not trusted

:

[rg305]

The issue described is misleading.
[yes, the “CA root” is not trusted and a problem - but NOT as you would think]
See: https://www.ssllabs.com/ssltest/analyze.html?d=symloging.cloudns.cl&ignoreMismatch=on

The site isn’t using the correct cert.
It is using a self-signed cert for: office.symloging.com
The “CA root” for the self-signed cert is itself.
So, yes, that “CA root” will never be trusted.
But that can’t be fixed.
The “fix” is to use the correct signed cert.

[lcluna86]

i used this

1. sudo apt-get update
2. sudo apt-get install software-properties-common
3. sudo add-apt-repository universe
4. sudo add-apt-repository ppa:certbot/certbot
5. sudo apt-get update

sudo apt-get install certbot

sudo certbot certonly --standalone

followed this steps https://certbot.eff.org/lets-encrypt/ubuntubionic-other

[rg305]

@lcluna86

--standalone

The --standalone parameter will only get the cert.
It is then up to you to use the cert.

If you issue:
certbot certificates
you can see what certs you have.

[lcluna86]

so i must do it without --standalone

because i have the webserver in a docker out of the docker there is nothing

[rg305]

If the web server and certbot are in the same docker instance, then you can treat it like you would any other system with certbot and a web server:
Cerbot gets and renews the certs.
The web server hosts sites (via HTTP and/or HTTPS).

So, you already have two good certs.
Now, do you have the two corresponding HTTP sites to enable with TLS(HTTPS)?

[lcluna86]

maybe the problem is i am doin certbot out of the docker

[rg305]

I don’t see how you could (unless you have multiple IPs or shutdown the first container while getting the certs).
If I read that correctly, the first container has both port 80 and port 443.

Anywho, if they are on separate systems, then you will need to either:

• find a common “shared” path for them to both reach the cert files.
• move the certbot program function into the container that has the web server.