无法将SSL证书添加到NGINX Docker容器
作者：互联网
我正在尝试将SSL证书(使用LetsEncrypt生成)添加到我的Nginx中. nginx是从docker-compose文件构建的,在该文件中,我创建了从主机到容器的卷,以便容器可以访问证书和私钥.
volumes:
- /etc/nginx/certs/:/etc/nginx/certs/
当nginx容器启动并失败并出现以下错误时
[emerg] 1#1: BIO_new_file("/etc/nginx/certs/fullchain.pem") failed
(SSL: error:02001002:system library:fopen:No such file or
directory:fopen('/etc/nginx/certs/fullchain.pem','r')
error:2006D080:BIO routines:BIO_new_file:no such file)
我的nginx配置文件如下所示：
server {
listen 80;
server_name server_blah www.server_blah;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl;
server_name server_blah;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
}
我在想什么/做错了什么？
解决方法:
终于破解了这一点,并能够在我的开发和生产站点上成功地重复该过程,以使SSL证书正常工作！
对不起,文章的长度！
在我的安装程序中,我在ubuntu 16机器上安装了docker docker-compose安装程序.
任何遇到此问题的人,我都会详细说明我的步骤.
>转到代码所在的目录
cd / opt / example_dir /
>创建一个目录letencrypt及其站点.
须藤mkdir -p / opt / example_dir / letsencrypt / letsencrypt-site
>从letsencrypt目录创建准系统docker-compose.yml文件.
须藤纳米/opt/example_dir/letsencrypt/docker-compose.yml
向其中添加以下内容：
version: '2'
services:
image: nginx:latest
ports:
- "80:80"
volumes:
- ./nginx.conf:/etc/nginx/conf.d/default.conf
- ./letsencrypt-site:/usr/share/nginx/html
networks:
- docker-network
networks:
docker-network:
driver: bridge
* This will pull down the latest nginx version
* Expose port 80
* Mount a config file (that i'll create later)
* Maps the site directory so that we can have a simple test index.html for when
我们启动简单的nginx容器.
>在/ opt / example_dir / letsencrypt中创建一个nginx.conf文件
须藤纳米/opt/example_dir/letsencrypt/nginx.conf
将以下内容放入其中
server {
listen 80;
listen [::]:80;
server_name example_server.com;
location ~ /.well-known/acme-challenge {
allow all;
root /usr/share/nginx/html;
}
root /usr/share/nginx/html;
index index.html;
}
* This listens for requests on port 80 for the server with name example_server.com
* Gives the Certbot agent access to ./well-known/acme-challenge
* Sets the default root and file
>接下来在/ opt / example_dir / letsencrypt / letsencrypt-site中创建一个index.html文件
须藤纳米/opt/example_dir/letsencrypt/letsencrypt-site/index.html
在其中添加以下内容
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<title>LetsEncrypt Setup</title>
</head>
<body>
<p>Test file for our http nginx server</p>
</body>
</html>
####基本的nginx容器的所有零件就位！
>现在,我们启动nginx容器.
cd /opt/example_dir/letsencrypt
sudo docker-compose up -d
Nginx容器现已启动并运行,请访问您定义的url,然后应返回测试index.html页面.至此,我们准备运行certbot命令来生成一些证书.
>运行以下命令以生成证书-用您的电子邮件替换–email
sudo docker run -it --rm \
-v /docker-volumes/etc/letsencrypt:/etc/letsencrypt \
-v /docker-volumes/var/lib/letsencrypt:/var/lib/letsencrypt \
-v /opt/example_dir/letsencrypt/letsencrypt-site:/data/letsencrypt \
-v "/docker-volumes/var/log/letsencrypt:/var/log/letsencrypt" \
certbot/certbot \
certonly --webroot \
--email youremail@domain.com --agree-tos --no-eff-email \
--webroot-path=/data/letsencrypt \
-d example.com
>以交互方式运行docker,以便您可以看到输出.
>生成证书完成后,它将自行删除.
>它将装入4个卷：
>存储证书的letencrypt文件夹/
> lib文件夹
>映射我们的站点文件夹
>映射日志记录路径
>同意ToS
>指定根Web路径
>指定要为其生成证书的服务器地址.
如果该命令运行正常,那么我们已经为该Web服务器生成了证书.现在,我们可以在生产站点中使用它们,并将nginx配置为使用ssl并利用这些证书！
>关闭Nginx容器
cd /opt/example_dir/letsencrypt/
sudo docker-compose down
设置生产Nginx容器
目录结构现在应该看起来像这样.您的代码/ Web应用程序项目所在的位置,然后是我们在上面创建的letencrypt文件夹的位置.
/opt/example_dir
/ -> project_folder
/ -> letsencrypt
>创建一个文件夹调用dh-param
sudo mkdir -p /opt/example_dir/project_folder/dh-param
>生成dh密钥
sudo openssl dhparam -out /opt/example_dir/project_folder/dh-param/dhparam-2048.pem 2048
>更新/ opt / example_dir / project_folder中的docker-compose.yml和nginx.conf文件
project_folder是我的源代码所在的位置,因此我在这里为nginx创建了一个生产配置文件,并更新了docker-compose.yml以安装我的nginx配置,dh-pharam交换密钥以及我们之前创建的证书本身.
docker-compose中的nginx服务
nginx:
image: nginx:1.11.3
restart: always
ports:
- "80:80"
- "443:443"
- "8000:8000"
volumes:
- ./nginx.conf:/etc/nginx/conf.d/default.conf
- ./dh-param/dhparam-2048.pem:/etc/ssl/certs/dhparam-2048.pem
- /docker-volumes/etc/letsencrypt/live/exampleserver.com/fullchain.pem:/etc/letsencrypt/live/exampleserver.com/fullchain.pem
- /docker-volumes/etc/letsencrypt/live/exampleserver.com/privkey.pem:/etc/letsencrypt/live/exampleserver.com/privkey.pem
networks:
- docker-network
volumes_from:
- flask
depends_on:
- flask
- falcon
links:
- datastore
project_folder中的nginx.conf
error_log /var/log/nginx/error.log warn;
server {
listen 80;
listen [::]:80;
server_name exampleserver.com
location / {
rewrite ^ https://$host$request_uri? permanent;
}
#for certbot challenges (renewal process)
location ~ /.well-known/acme-challenge {
allow all;
root /data/letsencrypt;
}
}
#https://exampleserver.com
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name exampleserver.com;
server_tokens off;
ssl_certificate /etc/letsencrypt/live/exampleserver.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/exampleserver.com/privkey.pem;
ssl_buffer_size 8k;
ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
ssl_ecdh_curve secp384r1;
ssl_session_tickets off;
# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8;
# Define the specified charset to the “Content-Type” response header field
charset utf-8;
}
至此,一切就绪！ (最后)
>启动Docker容器.
cd /opt/example_dir/project_folder
sudo docker-compose up -d
# Check the docker log with:
sudo docker logs -f -t
我知道这是很多步骤,但这是我所做的,对我有用,希望对其他人有所帮助.
标签：nginx,docker,docker-compose,ssl,ssl-certificate 来源： https://codeday.me/bug/20191025/1925744.html