docker certbot颁发letsencrypt证书

webroot方式配置https证书,定时执行续期执行certbot certonlywebroot方式nginx被访问查询结果查询帮助信息执行续期证书命令定时任务自动续期手动更新证书-日志问题:报了以下错误:解决: 需要把.well-known配置加以443端口里

Alex_z0897

1998人浏览 · 2022-06-15 05:46:04

Alex_z0897 · 2022-06-15 05:46:04 发布

webroot方式配置https证书,定时执行续期

参数	解释
certonly	创建时使用, 表示采用验证模式，只会获取证书
renew	更新时使用
–manual	配置插件,http验证/dns验证
–webroot	http验证
–force-renewal	强制续签
–preferred-challenges	dnsdns验证, 表示采用DNS验证申请者合法性
–dry-run	测试执行,不会真正去申请
–manual-auth-hook	动态验证DNS的脚本服务
–deploy-hook	后面的参数是证书更新成功之后，要指定执行的命令，这里是重启 nginx, 因为nginx不会自动重新加载证书，reload也不会
-d *.xxx.com	域名(可以是通配符)
-m xxx@xxx.com	通知邮箱

nginx配置访问地址

        location ~/.well-known/acme-challenge/ {
            root /mnt/cert/webroot_acme-challenge;
        }

执行certbot certonly webroot方式

docker run -it --rm --name certbot \
            -v "/mnt/cert/www.example.com/letsencrypt:/etc/letsencrypt" \
            -v "/mnt/cert/www.example.com/letsencrypt1:/var/lib/letsencrypt" \
            -v "/mnt/cert/log/:/var/log/letsencrypt/" \
            -v /mnt/cert/webroot_acme-challenge:/data/letsencrypt \
            certbot/certbot certonly  \
            --webroot --agree-tos \
            --webroot-path=/data/letsencrypt \
            -m xxx@xxx.cn -d www.example.com

Saving debug log to /var/log/letsencrypt/letsencrypt.log


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered.
Requesting a certificate for www.example.com




Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/www.example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/www.example.com/privkey.pem
This certificate expires on 2022-09-10.
These files will be updated when the certificate renews.


NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

nginx被访问

18.188.144.19 - - [13/Jun/2022:01:15:33 +0800] "GET /.well-known/acme-challenge/jg_HRFtupEdbwKXJbYU-SLPRgehDk8T8oyAhxoiPDHI HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
18.237.56.27 - - [13/Jun/2022:01:15:33 +0800] "GET /.well-known/acme-challenge/jg_HRFtupEdbwKXJbYU-SLPRgehDk8T8oyAhxoiPDHI HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
64.78.149.164 - - [13/Jun/2022:01:15:34 +0800] "GET /.well-known/acme-challenge/jg_HRFtupEdbwKXJbYU-SLPRgehDk8T8oyAhxoiPDHI HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
176.107.176.83 - - [13/Jun/2022:01:16:37 +0800] "GET /.git/config HTTP/1.1" 404 134 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/418.8 (KHTML, like Gecko) Safari/419.3"
95.211.187.223 - - [13/Jun/2022:01:17:00 +0800] "GET / HTTP/1.1" 200 1843 "-" "Go-http-client/1.1”

查询结果

docker run -it --rm --name certbot \
            -v "/mnt/cert/www.example.com/letsencrypt:/etc/letsencrypt" \
            -v "/mnt/cert/www.example.com/letsencrypt1:/var/lib/letsencrypt" \
            certbot/certbot certificates

Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: www.example.com
    Serial Number: 42667b9821f5721a9733aa071ebf6b3ddfb
    Key Type: RSA
    Domains: www.example.com
    Expiry Date: 2022-09-10 16:15:42+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/www.example.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/www.example.com/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

查询帮助信息

docker run -it --rm certbot/certbot —help

执行续期证书命令

docker run -it --rm --name certbot \
            -v "/mnt/cert/www.example.com/letsencrypt:/etc/letsencrypt" \
            -v "/mnt/cert/www.example.com/letsencrypt1:/var/lib/letsencrypt" \
            -v "/mnt/cert/log/:/var/log/letsencrypt/" \
            -v /mnt/cert/webroot_acme-challenge:/data/letsencrypt \
            certbot/certbot renew

Saving debug log to /var/log/letsencrypt/letsencrypt.log


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/www.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certificates are not due for renewal yet:
  /etc/letsencrypt/live/www.example.com/fullchain.pem expires on 2022-09-10 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

定时任务自动续期

0 3 * * 1 cd /mnt/cert/ && renew.sh &&  nginx -s reload

手动更新证书-日志

# 尝试更新
$ docker run -it --rm --name certbot \
    -v "/mnt/cert/www.example.com/letsencrypt:/etc/letsencrypt" \
    -v "/mnt/cert/www.example.com/letsencrypt1:/var/lib/letsencrypt" \
    -v "/mnt/cert/log/:/var/log/letsencrypt/" \
    -v /mnt/cert/webroot_acme-challenge:/data/letsencrypt \
    certbot/certbot renew --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/www.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Simulating renewal of an existing certificate for m.me56.cn

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all simulated renewals succeeded:
  /etc/letsencrypt/live/m.me56.cn/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


# 更新
$ docker run -it --rm --name certbot \
>     -v "/mnt/cert/www.example.com/letsencrypt:/etc/letsencrypt" \
>     -v "/mnt/cert/www.example.com/letsencrypt1:/var/lib/letsencrypt" \
>     -v "/mnt/cert/log/:/var/log/letsencrypt/" \
>     -v /mnt/cert/webroot_acme-challenge:/data/letsencrypt \
>     certbot/certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/m.me56.cn.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Renewing an existing certificate for m.me56.cn

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all renewals succeeded:
  /etc/letsencrypt/live/www.example.com/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

# 重复更新
$ docker run -it --rm --name certbot    \
		 -v "/mnt/cert/www.example.com/letsencrypt:/etc/letsencrypt"    \
		 -v "/mnt/cert/www.example.com/letsencrypt1:/var/lib/letsencrypt"     \
		 -v "/mnt/cert/log/:/var/log/letsencrypt/"     \
		 -v /mnt/cert/webroot_acme-challenge:/data/letsencrypt     \
		 certbot/certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/www.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certificates are not due for renewal yet:
  /etc/letsencrypt/live/www.example.com/fullchain.pem expires on 2022-12-05 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

问题:

docker run -it --rm --name certbot \
            -v "/mnt/cert/m.xxx.cn/letsencrypt:/etc/letsencrypt" \
            -v "/mnt/cert/m.xxx.cn/letsencrypt1:/var/lib/letsencrypt" \
            -v "/mnt/cert/log/:/var/log/letsencrypt/" \
            -v /mnt/cert/webroot_acme-challenge:/data/letsencrypt \
            certbot/certbot renew

报了以下错误:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for m.xxx.cn

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
  Domain: m.xxx.cn
  Type:   unauthorized
  Detail: 121.xx.161.xx: Invalid response from https://m.xxx.cn/.well-known/acme-challenge/FCyKJVpjk_6c9ogLkIPzrCLWpWzo_nDmzgMZFZof0ss: "<!DOCTYPE html><html lang=\"\"><head><meta charset=\"utf-8\"><meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\"><meta http-equiv=\""

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

解决: 需要把.well-known配置加以443端口里

server {
        listen 443 ssl http2;
        server_name  m.xxx.cn;
        ssl_certificate     xxx.pem;
        ssl_certificate_key xxx.pem;

        location ^~ /.well-known/acme-challenge/ {
                root /mnt/cert/webroot_acme-challenge;
        }

向您推荐>>Eolink开发者社区

权威｜前沿｜技术｜干货｜国内首个API全生命周期开发者社区

更多推荐

ELK实现containerd的容器日志采集展示【基于logging的全栈监测】

企业级ELK Stack构建介绍

云原生

深入理解 Mocha 测试框架：从零实现一个 Mocha

前言什么是自动化测试自动化测试在很多团队中都是Devops环节中很难执行起来的一个环节，主要原因在于测试代码的编写工作很难抽象，99%的场景都需要和业务强绑定，而且写测试代码的编写工作量往往比编写实际业务代码的工作量更多。在一些很多业务场景中投入产出比很低，适合写自动化测试的应该是那些中长期业务以及一些诸如组件一样的基础库。自动化测试是个比较大的概念，其中分类也比较多，比如单元测试，端对端测试，集

云原生

(20200916 Solved)docker-compose up创建容器自动退出

问题描述如题，创建容器后自动退出了。并且docker start container无效解决方案原因是缺失了控制终端的配置，需要在docker-compose.yml中增加tty:true ，有时候这样也不行，需要再增加一个command:/bin/bash，命令不一定是这个，需要是一个不会退出的命令，然后用-d后台启动容器。Referencesdocker-compose启动容器后自动退出...