The official certbot
( https://certbot.eff.org ) tool to issue and renew certificates from Let's Encrypt
saves the currently valid certificate to ${prefix}/archive/${domain}/certN.pem
, where N
is an arbitrary number.
The paths that should be used to access the currently valid certificates and keys are relative symlinks in ${prefix}/live/${domain}/cert.pem
:
root@skprov2:${prefix}/live/${domain}# ls
total 12K
4.0K drwxr-xr-x 2 root root 4.0K Jul 24 16:08 ./
4.0K drwx------ 9 root root 4.0K Aug 24 10:57 ../
0 lrwxrwxrwx 1 root root 39 Jul 24 16:08 cert.pem -> ../../archive/${domain}/cert2.pem
0 lrwxrwxrwx 1 root root 40 Jul 24 16:08 chain.pem -> ../../archive/${domain}/chain2.pem
0 lrwxrwxrwx 1 root root 44 Jul 24 16:08 fullchain.pem -> ../../archive/${domain}/fullchain2.pem
0 lrwxrwxrwx 1 root root 42 Jul 24 16:08 privkey.pem -> ../../archive/${domain}/privkey2.pem
4.0K -rw-r--r-- 1 root root 682 Jul 23 09:40 README
When only mounting the live
directory, programs running inside docker containers will fail loading the required certiticate data, because of the relative symlinks.
How can the latest (valid) certificate data from certbot
be used within a Docker container?