5

The official certbot ( https://certbot.eff.org ) tool to issue and renew certificates from Let's Encrypt saves the currently valid certificate to ${prefix}/archive/${domain}/certN.pem, where N is an arbitrary number. The paths that should be used to access the currently valid certificates and keys are relative symlinks in ${prefix}/live/${domain}/cert.pem:

root@skprov2:${prefix}/live/${domain}# ls
total 12K
4.0K drwxr-xr-x 2 root root 4.0K Jul 24 16:08 ./
4.0K drwx------ 9 root root 4.0K Aug 24 10:57 ../
   0 lrwxrwxrwx 1 root root   39 Jul 24 16:08 cert.pem -> ../../archive/${domain}/cert2.pem
   0 lrwxrwxrwx 1 root root   40 Jul 24 16:08 chain.pem -> ../../archive/${domain}/chain2.pem
   0 lrwxrwxrwx 1 root root   44 Jul 24 16:08 fullchain.pem -> ../../archive/${domain}/fullchain2.pem
   0 lrwxrwxrwx 1 root root   42 Jul 24 16:08 privkey.pem -> ../../archive/${domain}/privkey2.pem
4.0K -rw-r--r-- 1 root root  682 Jul 23 09:40 README

When only mounting the live directory, programs running inside docker containers will fail loading the required certiticate data, because of the relative symlinks.

How can the latest (valid) certificate data from certbot be used within a Docker container?

1 Answer 1

4

The relative symlinks are mapped to go up 2 layers (from domain folder to live folder, from live folder to root folder), then enter the archive folder and finally the domain subfolder within.

To avoid mounting all domain subdirectories, giving access to all certificate data, we have to use 2 mounts.

Docker Host directory structure

Let's assume the following directory structure created by certbot on the Docker host:

/certbot/
    |-live/
    |  |-domain.com
    |  |  |-cert.pem
    |  |  |-privkey.pem
    |  |-domain2.com
    |     |-cert.pem
    |     |-privkey.pem
    |
    |-archive/
       |-domain.com
       |  |-cert.pem
       |  |-privkey.pem
       |-domain2.com
          |-cert.pem
          |-privkey.pem

Mounting the subdirectories

In Docker, we only want the subdirectories for the target domain mounted inside the container.

docker run \
  -v /certbot/live/domain.com:/cert/live/domain.com:ro \
  -v /certbot/archive/domain.com:/cert/archive/domain.com:ro \
  myimage:tag

This way, programs inside the container can successfully resolve the relative paths to the archive folder while their configuration points to the symlinks inside the live folder (/cert/live/domain.com/cert.pem).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .