Docker container can't read certificates due to strict default permissions

Help
1

I'm trying to install renewing certs for my website that runs in docker, but the certs are always generated without read permissions for normal users so docker can't see and thus use the certificates. I assume the certs have this security for a reason, and docker doesn't run with root access for a reason, so what is the proper way to use these certs with docker?

cert data mount point

-v /var/lib/nginx/ssl:/etc/nginx/ssl

permissions of files in /var/lib/nginx/ssl/archive

-rw-r--r--    1 root     root          1874 Feb 27 23:15 cert1.pem
-rw-r--r--    1 root     root          3749 Feb 27 23:15 chain1.pem
-rw-r--r--    1 root     root          5623 Feb 27 23:15 fullchain1.pem
-rw-------    1 root     root          1704 Feb 27 23:15 privkey1.pem

mention in config

ssl_certificate     /etc/nginx/ssl/live/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/live/privkey.pem;

error message

2022/02/28 05:35:49 [emerg] 1#1: cannot load certificate "/etc/nginx/ssl/live/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/nginx/ssl/live/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
nginx: [emerg] cannot load certificate "/etc/nginx/ssl/live/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/nginx/ssl/live/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)

I ran this command: certbot certonly
My web server is (include version): nginx (latest alpine from official docker image)
The operating system my web server runs on is (include version): Alpine Linux 3.15
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.23.0 (latest certbot/certbot docker image)

I appreciate any help.

2

This doesn't look like a permission error.

What are the mounts for both containers?

1 Like
3

Both containers mount at the same location with this option -v /var/lib/nginx/ssl:/etc/nginx/ssl

Without execute and read permissions, non-root (owner) accounts can't view the cert files, it doesn't even show that they exist with ls for example. I might be able to change the permissions, but then when the certs renew I would have to manually change them again.

Unless I'm missing something?

Edit: Oh shoot I was wrong, forgot that the container that generates the certs mounts /etc/letsencrypt to /var/lib/nginx/ssl first, sorry.

4

... and the symlinks in /etc/letsencrypt/live, where do they point? (Are they absolute or relative?)

ls -la /var/lib/nginx/ssl/live should tell you. (inside the nginx container)

Also, it's usually /etc/letsencrypt/live/certname/{fullchain,key}.pem

1 Like
5

Looks like relative.
I copied the container data so I could inspect it, here's what I get with ls -la etc/nginx/ssl/live/example.org/ as root in the copied data.

total 12
drwxr-xr-x    2 user     user          4096 Feb 27 23:15 .
drwx------    3 user     user          4096 Feb 27 23:15 ..
-rw-r--r--    1 user     user           692 Feb 27 23:15 README
lrwxrwxrwx    1 user     user            40 Feb 27 23:15 cert.pem -> ../../archive/example.org/cert1.pem
lrwxrwxrwx    1 user     user            41 Feb 27 23:15 chain.pem -> ../../archive/example.org/chain1.pem
lrwxrwxrwx    1 user     user            45 Feb 27 23:15 fullchain.pem -> ../../archive/example.org/fullchain1.pem
lrwxrwxrwx    1 user     user            43 Feb 27 23:15 privkey.pem -> ../../archive/example.org/privkey1.pem

Yeah, I caught that just now. Thanks.

Edit: noticing I can read the certs in the archive in the copied data

1 Like
6

I usually like to run a shell inside the container, like a savage. (docker-compose exec containername [ba]sh)

Ok, does nginx complain still?

1 Like
7

Looks like I was missing the site in /etc/nginx/ssl/live/(cert), and my fix had "live" and "(sitename)" in the wrong spot. Once I got that fixed, its not complaining anymore so I believe I can take it from here.

Ex. of solution:

ssl_certificate     /etc/nginx/ssl/live/(site name)/fullchain.pem;

Not

ssl_certificate     /etc/nginx/ssl/live/fullchain.pem;

I really appreciate the help in fixing my dumb mistake, so thank you :slight_smile:

1 Like
8

You're welcome.

Docker is not very collaborative when using certbot, more importantly when you need to restart the nginx container or send an interrupt to reload.

You kinda have to mount the docker.sock and either install the docker cli or make some hack with curl.

1 Like
9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.