Got it
The dry run was successful
/opt/certbot # certbot certonly --webroot -w /www -d voxx.biz --dry-run --account 20a9a8143e358826aee1f1a1f58d0b6c
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for voxx.biz
Using the webroot path /www for all unmatched domains.
Waiting for verification...
Cleaning up challenges
IMPORTANT NOTES:
- The dry run was successful.
Some background info:
The main challenge after the crucial hint of @_az regarding --webroot was the .well-known/acme-challenge nginx 404 error, well-known by itself.
To this end I used a dummy file 1234 to test – it delivered 403 Forbidden first and then 404 Not Found.
The follwing proves those problems solved:
# curl "https://voxx.biz/.well-known/acme-challenge/1234"
Hi
2 levels of nginx
Also, both this instance of nginx and that of the real server being proxied had to be corrected:
location ^~ /.well-known/acme-challenge/ {
allow all;
default_type "text/plain";
#return 404 "==119=====$server_name==========$uri== testing"; # testing
try_files $uri =404; # /index.html;
break;
}
and/or
location ~ /\.(?!well-known).* {
deny all;
}
location ^~ /.well-known/acme-challenge/ {
allow all;
root /www;
default_type "text/plain";
try_files $uri /index.html;
}
This took care of the 403 error.
Those instructions differ which reflect my search for the right definition, they can certainly be unified, but I leave it at that – it works.
Intermediate proxy
I have another webserver in between those two acting as proxy to provide caching services. In order to make it work I had to manipulate that one to not cache calls to .well-known
webroot access
Also it was crucial that my proxy nginx had access to the webroot of this domain – an obvious condition not needed otherwise.
volumes:
- /root/2proxy/nginx.conf:/etc/nginx/nginx.conf
- /root/2proxy/nginx/log/:/var/log/nginx/
- /root/2proxy/nginx/cache/:/etc/nginx/cache
- /etc/letsencrypt/:/etc/letsencrypt/
- /var/www/:/var/www/
- /www/:/www/
This correction took care of the 404 error.
Further strategy
In order to check if the automatic renewal works, I leave it at --dry-run as well.
This is a special solution with dedicated parameters. Looking at the automatic procedure
entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
there may be some quirks to take care of. I might even test it right away.
Hopefully this will work for the other two domains on this server at due time. I’ll check a second server along these lines as well after these lessons learned.
Thank you all very much.
I now understand much better what I am doing here.
