What is the easiest way to generate an SSL cert in 2020?

by Benny Chan

I've been using this tutorial for a few years. I want to set up SSL for 2 subdomains with docker compose.

When I tried to edit init-letsencrypt.sh in one of the steps, it always went wrong.

Any better way comes out in 2020?

Updated 7/7/2020:
My production is hosting several WordPress blogs. When I tried to put my app on prod, ports 80 & 443 are used on the nginx installed on host. My dockers simply can't pass through ACME http challenge in order to get a cert. ACME challenge requires to use 80 port

Benny Chan

posted to

Developers

on July 6, 2020

Say something nice to bennychan…

Post Comment

4

certbot generating Let's Encrypt certs, as cron job, placing the cert on apache and other web servers paths never failed me.

jeandelarue2002

·
5 years ago
·
Reply
1. 1
  
  yes, I can generate certs with certbot if there is no docker / docker compose. When there is docker, it's getting complicated
  
  bennychan
  
  ·
  5 years ago
  ·
  Reply
  1. 1
    
    sorry I didn't pay attention to the context.
    If it's a docker image, then why not having RUN(s) that install certbot, with a config. This would then generate an image that has certbot configured as cron job.
    
    I don't see anything a Dockerfile can't do :)
    
    jeandelarue2002
    
    ·
    5 years ago
    ·
    Reply
    1. 1
      
      Yes, I finally managed to generate the cert with the certbot docker image. But I missed the nginx conf folder in the docker compose yml file. It took me half a day to figure it out
      
      Imo, SSL is a must-have for standard websites. The application process should be as easy as possible.
      
      sillycube
      
      ·
      5 years ago
      ·
      Reply
1

All of my domains are connected to Cloudflare. They handle public facing certificates, and for Cloudflare to my server, I generate certificates using the cloudflare plugin. The whole process is automated and runs in a docker container. If you want it, let me know and I will share the script file.

nazmul

·
5 years ago
·
Reply
1. 1
  
  Yes, please share the script. Feel free to ping me in twitter
  
  bennychan
  
  ·
  5 years ago
  ·
  Reply
  1. 1
    One thing I feel like I need to clarify is, I export the certs to /etc/nginx-ssl which is a directory mounted in both the certbot container and nginx container. Add these two lines in nginx.conf and you should be good to go,
    
    ssl_certificate /etc/nginx-ssl/fullchain.pem; ssl_certificate_key /etc/nginx-ssl/privkey.pem;
    
    You can also forward any http traffic to https
    
    server { listen 80 default_server; server_name _; return 301 https://$host$request_uri; }
    
    nazmul
    
    ·
    5 years ago
    ·
    Reply
  2. 1
    
    Here you go
    https://gist.github.com/nazmulpcc/de347b48e146bf8428efd6954543003b
    Please keep in mind that the Dockerfile It may not work straight out of the box as I just copy pasted the related portions from my actual Dockerfile. You should pass some environment variables to the docker container, see the certbot.sh file for the variables you will need. If you need any more help, feel free to reach out at [email protected]
    
    nazmul
    
    ·
    5 years ago
    ·
    Reply
1

I created my own ui for this, but is not production ready yet. where do you host docker in AWS? Maybe I should give you a test server to try out 😉

rmamba

·
5 years ago
·
Reply
1. 1
  
  I host my apps in digital ocean.
  
  bennychan
  
  ·
  5 years ago
  ·
  Reply
  1. 1
    
    send me an email, can explain more if you want to give it a try.
    
    rmamba
    
    ·
    5 years ago
    ·
    Reply
2. 1
  
  This comment was deleted 5 years ago.
  
  sillycube
  
  ·
  5 years ago
1

If you are self hosting Docker I recommend using Traefik.

ATLChris

·
5 years ago
·
Reply
1

I am using docker via Dokku add cert with one line and config autorenew just once for all certs
dokku letsencrypt <domain>
dokku letsencrypt:cron-job --add

apsion

·
5 years ago
·
Reply
1

try traefik and it will automanage the certs

doctor_b

·
5 years ago
·
Reply
1

Kubernetes with nginx-ingress and cert-manager

nikke

·
5 years ago
·
Reply
1

I think it depends on what your hosting strategy is. For example, if you're on heroku, you just click the SSL box and done (of course, theoretically, if someone compromises heroku, then they could intercept between the load balancer and your dyno).

Similarly, on AWS, if your app is behind a Load Balancer, you can do SSL termination at the load balancer and lock down your VPC. At that point, you could run http between the LB and your host, or you could use a self-signed cert that doesn't need to go through the hoops of of certbot (that would only be for intra-vpc traffic, you'd still have a real cert between the VPC and your customers). Most of the cloud providers should have a fairly straightforward way to do SSL-termination at a load balancer and never have to deal with certbot inside the VPC.

ianwremmel

·
5 years ago
·
Reply
1

I've been using Cloudflare SSL on my root domain. It handles subdomains as well.

amirali

·
5 years ago
·
Reply
1. 1
  
  I've read some tutorials. If you're using Cloudflare flexible SSL, you can still be intercepted. This is because Cloudflare only encrypts the path between users and Cloudflare CDN. The path between CDN and your server is not encrypted.
  
  That's why people use certbot / let's encrypt to generate a cert
  
  bennychan
  
  ·
  5 years ago
  ·
  Reply