Nearly three months ago I started up a web server for my website and purchased a domain. I have three Docker containers running, one for nginx (jonasal/nginx-certbot), one for a mysql database, and one for the Flask app. I recently received an email from LetsEncrypt to renew the certificate so I have attempted to run the renew command within the nginx container but I am encountering errors.
I have already tried:
Setting the permissions of the webroot path and the challenges location (www-data now has permissions to /var/www/letsencrypt/.well-known/acme-challenge)
Checking firewall permissions (port 80 is not blocked)
Checking DNS settings (my domain points to where the certbot is running)
Not sure what other approach to take, any help is appreciated!
The above error indicates a couple things. One is that you redirect the original HTTP ACME Challenge request to HTTPS. That is not harmful but it is better if you handle it right in HTTP.
The main problem is your response is supposed to be the challenge token placed by Certbot. Instead it looks like your home page.
This is probably something wrong in your nginx config. Can you show the entire output by running nginx -T ? Please add 3 backticks before and after the very long output to maintain formatting. Like:
```
output of: sudo nginx -T
```
capital T is essential as are backticks (not single quotes)
Edit: sudo probably not needed inside container
The above is the server block handling HTTP requests for that domain name.
Adding the below lines from your default server to the above server block should fix your problem
# Anything requesting this particular URL should be served content from
# Certbot's folder so the HTTP-01 ACME challenges can be completed for the
# HTTPS certificates.
location '/.well-known/acme-challenge' {
default_type "text/plain";
root /var/www/letsencrypt;
}
What I mean is that LE Server sends an HTTP request for the challenge. You were replying to LE with a redirect. LE sends a second request using HTTPS (as that is what you redirected to) and your server then replied (wrongly so far).
It is best if you just return the correct result with the first HTTP request. Redirecting LE and making it do a second request is just wasteful. And more complicated for things to go wrong. Especially now that I see you proxy all requests in your HTTPS server block
Sorry, I made the correction in haste. I am not sure that the IF statement takes precedence over Location. So below is more typically how that is done:
# configuration file /etc/nginx/conf.d/myportfolio.conf:
server {
listen 80; # listen for HTTP traffic at 80
server_name emilyllim.com;
location /.well-known/acme-challenge {
default_type "text/plain";
root /var/www/letsencrypt;
}
location / {
return 301 https://$host$request_uri; # redirect to HTTPS
}
}
I see. This makes sense and is much more clear than what I had before. I added your suggestions to the config and restarted the web server and it looks like the certificate automatically renewed. Thank you so much, I appreciate your help!