Nginx ssl config without changing virtualhost config

alex88 · June 7, 2020, 2:47pm

I’m setting up a docker container with nginx, however I want to have full control of the main virtualhost config instead of having the nginx installer edit my virtualhost. Is it possible to have certbot only generate and keep updated the /etc/letsencrypt/options-ssl-nginx.conf and /etc/letsencrypt/ssl-dhparams.pem files so I can reference them?

Osiris · June 7, 2020, 3:25pm

Use certbot certonly.

alex88 · June 8, 2020, 7:11am

Unfortunately that’s only generates the certs, the ssl configs and ssl dhparams aren’t there

Osiris · June 8, 2020, 1:20pm

Ah, makes sense, because those files are webserver specific. And without using a specific webserver plugin, it won’t place those files in the letsencrypt directory.

It seems however, using the plugin as installer isn’t necessary, if I read the source correctly, just triggering the plugin by using it as authenticator is enough:

github.com

certbot/certbot/blob/d135e6140b6ea58a7f80baf23cd4fc60d035f52c/certbot-nginx/certbot_nginx/_internal/configurator.py#L172-L206


# This is called in determine_authenticator and determine_installer
def prepare(self):
    """Prepare the authenticator/installer.

    :raises .errors.NoInstallationError: If Nginx ctl cannot be found
    :raises .errors.MisconfigurationError: If Nginx is misconfigured
    """
    # Verify Nginx is installed
    if not util.exe_exists(self.conf('ctl')):
        raise errors.NoInstallationError(
            "Could not find a usable 'nginx' binary. Ensure nginx exists, "
            "the binary is executable, and your PATH is set correctly.")

    # Make sure configuration is valid
    self.config_test()

    self.parser = parser.NginxParser(self.conf('server-root'))

    # Set Version
    if self.version is None:

This file has been truncated. show original

See the install_ssl_options_conf function.

The nginx authenticator however, does temporarily modify your nginx configuration, but not permanently, for the validation of the challenges. You can specify this in stead of the webroot authenticator by using -a nginx .

alex88 · June 9, 2020, 1:12am

I think I’ll end up using the config file that exists on the package folder, as we can’t user nginx for authorization (we use DNS validation because we have IP whitelisting on the http/https ports.
Thanks for trying @Osiris

system · July 9, 2020, 1:12am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Generating options-ssl-nginx.conf and ssl-dhparams in certonly mode Help	4	14372	November 17, 2020
It is possible to customize what certbot adds to a nginx vhost conf after issuing a certificate? Help	4	1809	November 5, 2021
NGINX server in Docker Help	4	426	April 9, 2024
Docker Container options-ssl-nginx.conf Help	5	1112	June 18, 2023
Is this re-formulation of the recommended Let's Encrypt NGINX configuration correct? Help	5	781	August 28, 2023

Nginx ssl config without changing virtualhost config

Related topics