AddingSSLcertstoNGINXdockercontainer

I'm trying to add SSL certs (generated with LetsEncrypt) to my nginx. The nginx is built from a docker-compose file where I create a volume from my host to the container so the containers can access the certs and private key.

volumes:
  - /etc/nginx/certs/:/etc/nginx/certs/

When the nginx container starts and fails with the following error

[emerg] 1#1: BIO_new_file("/etc/nginx/certs/fullchain.pem") failed 
(SSL: error:02001002:system library:fopen:No such file or 
directory:fopen('/etc/nginx/certs/fullchain.pem','r') 
error:2006D080:BIO routines:BIO_new_file:no such file)

My nginx config file looks like this:

server {
    listen 80;
    server_name server_blah www.server_blah;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name server_blah;
    ssl_certificate      /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key  /etc/nginx/certs/privkey.pem;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;
}

What am I missing/doing incorrectly?

终于破解了这一点，并能够在我的开发和生产站点上成功地重复该过程，以使SSL证书正常工作！

对不起，文章的长度！

在我的安装程序中，我在ubuntu 16机器上安装了docker docker-compose安装程序。

任何遇到此问题的人，我都会详细说明我的步骤。

转到代码所在的目录

cd /opt/example_dir/

创建一个目录letencrypt及其站点。

sudo mkdir -p /opt/example_dir/letsencrypt/letsencrypt-site

从letsencrypt目录创建准系统docker-compose.yml文件。

sudo nano /opt/example_dir/letsencrypt/docker-compose.yml

向其中添加以下内容：

    version: '2'

        services:
            image: nginx:latest
            ports:
              - "80:80"
            volumes:
              - ./nginx.conf:/etc/nginx/conf.d/default.conf
              - ./letsencrypt-site:/usr/share/nginx/html
            networks:
              - docker-network

        networks:
          docker-network:
            driver: bridge

* This will pull down the latest nginx version
* Expose port 80 
* Mount a config file (that i'll create later) 
* Maps the site directory so that we can have a simple test index.html for when 

我们启动简单的nginx容器。

在中创建一个nginx.conf文件 /opt/example_dir/letsencrypt

sudo nano /opt/example_dir/letsencrypt/nginx.conf

将以下内容放入其中

    server {
      listen 80;
      listen [::]:80;
      server_name example_server.com;

      location ~ /.well-known/acme-challenge {
          allow all;
          root /usr/share/nginx/html;
      }

      root /usr/share/nginx/html;
      index index.html;
    }

* This listens for requests on port 80 for the server with name example_server.com
* Gives the Certbot agent access to ./well-known/acme-challenge
* Sets the default root and file

接下来在其中创建一个index.html文件 /opt/example_dir/letsencrypt/letsencrypt-site

sudo nano /opt/example_dir/letsencrypt/letsencrypt-site/index.html

在其中添加以下内容

    
    



    
Test file for our http nginx server

####基本的nginx容器的所有零件就位！

现在，我们启动nginx容器。

cd /opt/example_dir/letsencrypt
sudo docker-compose up -d

Nginx容器现已启动并运行，请访问您定义的url，然后应返回测试index.html页面。至此，我们准备运行certbot命令来生成一些证书。

运行以下命令以生成证书替换--email为您的电子邮件

sudo docker run -it --rm \
-v /docker-volumes/etc/letsencrypt:/etc/letsencrypt \
-v /docker-volumes/var/lib/letsencrypt:/var/lib/letsencrypt \
-v /opt/example_dir/letsencrypt/letsencrypt-site:/data/letsencrypt \
-v "/docker-volumes/var/log/letsencrypt:/var/log/letsencrypt" \
certbot/certbot \
certonly --webroot \
--email youremail@domain.com --agree-tos --no-eff-email \
--webroot-path=/data/letsencrypt \
-d example.com

以交互方式运行docker，以便您可以看到输出。

完成生成证书后，它将删除自己。

它将装入4个卷：

存储证书的letencrypt文件夹/

一个lib文件夹

映射我们的站点文件夹

映射日志记录路径

它同意ToS

指定根Web路径

指定要为其生成证书的服务器地址。

如果该命令运行正常，那么我们已经为该Web服务器生成了证书。现在，我们可以在生产站点中使用它们，并将nginx配置为使用ssl并利用这些证书！

关闭nginx容器

cd /opt/example_dir/letsencrypt/
sudo docker-compose down

设置生产Nginx容器

目录结构现在应该看起来像这样。您的代码/ Web应用程序项目所在的位置，然后是我们在上面创建的letencrypt文件夹的位置。

/opt/example_dir
             / -> project_folder
             / -> letsencrypt

创建一个文件夹调用dh-param

sudo mkdir -p /opt/example_dir/project_folder/dh-param

生成dh密钥

sudo openssl dhparam -out /opt/example_dir/project_folder/dh-param/dhparam-2048.pem 2048

更新docker-compose.yml和nginx.conf文件 /opt/example_dir/project_folder

project_folder是我的源代码所在的位置，因此我在这里为nginx创建了一个生产配置文件，并更新了docker-compose.yml以安装我的nginx配置，dh-pharam交换密钥以及我们之前创建的证书本身。

docker-compose中的nginx服务

    nginx:
        image: nginx:1.11.3
        restart: always
        ports:
          - "80:80"
          - "443:443"
          - "8000:8000"
        volumes:
          - ./nginx.conf:/etc/nginx/conf.d/default.conf
          - ./dh-param/dhparam-2048.pem:/etc/ssl/certs/dhparam-2048.pem
          - /docker-volumes/etc/letsencrypt/live/exampleserver.com/fullchain.pem:/etc/letsencrypt/live/exampleserver.com/fullchain.pem
          - /docker-volumes/etc/letsencrypt/live/exampleserver.com/privkey.pem:/etc/letsencrypt/live/exampleserver.com/privkey.pem
        networks:
          - docker-network

        volumes_from:
          - flask
        depends_on:
          - flask
          - falcon
        links:
          - datastore

project_folder中的nginx.conf

error_log /var/log/nginx/error.log warn;

server {
    listen 80;
    listen [::]:80;

    server_name exampleserver.com

    location / {
        rewrite ^ https://$host$request_uri? permanent;
    }

    #for certbot challenges (renewal process)
    location ~ /.well-known/acme-challenge {
        allow all;
        root /data/letsencrypt;
    }
}

#https://exampleserver.com
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name exampleserver.com;

    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/exampleserver.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/exampleserver.com/privkey.pem;

    ssl_buffer_size 8k;

    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;

    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;


    # Define the specified charset to the “Content-Type” response header field
    charset utf-8;
}

至此，一切就绪！（最后）

启动docker容器。

cd /opt/example_dir/project_folder
sudo docker-compose up -d

# Check the docker log with:
sudo docker logs -f -t  

我知道这是很多步骤，但这是我所做的，对我有用，希望对其他人有所帮助。