1

Originally, I had NGINX configured for two services (Radicale and LMS) on two different ports. I did this in /etc/nginx/nginx.conf. Access to MYDOMAIN:8000 and :8009 and 3001 from the internet are redirected to Radicale and LMS respectively.

I set up certificates on the server to enable this and then ran sudo certbot --nginx -d MYDOMAIN to generate letsencrypt certs. Afterwards I disabled my own certs (I just had to set them up to make the config file error-free).

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
}

http {
    sendfile on;

    tcp_nopush on;
    types_hash_max_size 2048;
    keepalive_timeout 65;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    # reduce logging
    access_log off;

#   access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    gzip on;

#   include /etc/nginx/conf.d/*.conf;
#   include /etc/nginx/sites-enabled/*;

    auth_basic "NGINX";
    auth_basic_user_file /etc/nginx/.htpasswd;

#   old, before Certbot
#   ssl_certificate ssl/server.crt;
#   ssl_certificate_key ssl/server.key;
    
    server {
      server_name MYDOMAIN;
      listen 8000 ssl;
      location / {
        proxy_pass http://localhost:8000;
        proxy_set_header X-Script-Name /;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Remote-User $remote_user;
        proxy_set_header Host $http_host;
        proxy_pass_header Authorization;
        auth_basic "Nginx-Radicale - Password required";
      }
    
    # generated with: sudo certbot --nginx -d MYDOMAIN
    ssl_certificate /etc/letsencrypt/live/MYDOMAIN/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
}
    server {
      server_name MYDOMAIN;
      listen 8009;
      return 301 https://MYDOMAIN:3001;
    }
    server {
      server_name MYDOMAIN;
      listen 3001;
      location / {
        proxy_pass http://localhost:3000/;
        auth_basic "NGINX";
      }
    }
}

Now I changed my setup and wanted to split the server part of the config into nginx/conf.d subdirectory to have a clean setup. I wanted to let the original nginx.conf as it comes and just adjust my own two files:

pi@RPi64:/etc/nginx $ cat conf.d/radicale.conf 
server {
  server_name MYDOMAIN;
  listen 8000; 
# ssl;
  location / {
    proxy_pass http://localhost:5232;
    proxy_set_header X-Script-Name /;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Remote-User $remote_user;
    proxy_set_header Host $http_host;
    proxy_pass_header Authorization;
    auth_basic "Nginx-Radicale - Password required";
  }
}

and second file:

pi@RPi64:/etc/nginx $ cat conf.d/LMS.conf
server {
    server_name MYDOMAIN;
    listen 8009;
    return 301 https://MYDOMAIN:3001;

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/MYDMOAIN/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    server_name MYDOMAIN;
    listen 3001;
    location / {
        proxy_pass http://localhost:3000/;
        auth_basic "NGINX";
    }
}

As you can see I commented out the ssl part in the first file. If I let it in sudo nginx -t was giving the error of missing certificates. I wanted to avoid having to setup my own certs.

Also, you can see that running certbot added five lines into my second file:

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/MYDMOAIN/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

I think certbot found the https in this file and then decided to add the certs there.

However, I wanted to add certificates for the whole server - meaning both sites/files.

Especially since the process of renewing the certs has to be done regularly, I wanted to make sure there is not manual copying involved.

How can I tell Certbot to insert certs for both files? Do I have to add my own certs first for certbot to recognise the requiry?

Or would it make sense to add the certs to the main nginx.conf file? Am I doing something wrong?

1 Answer 1

1

My solution was to add the following to nginx.conf:

server {
    server_name MYDOMAIN
    listen 443; 
}

EDIT: It's of course also possible to add this server as an .conf in conf.d. This makes handling easier.


Then I ran certbot --nginx -d MYDOMAIN which put the following lines in:

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/MYDOMAIN/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}


    server {
    if ($host = MYDOMAIN) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        server_name MYDOMAIN
        listen 443;
    listen 80;
    return 404; # managed by Certbot

I then deleted those lines and put this part in every single file in my conf.d/

    ssl_certificate /etc/letsencrypt/live/MYDOMAIN/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

I think the renewal process will just consider the certificates itself at /etc/letsencrypt and thus the manual fix in the conf.d should be okay.

1
  • You can check that the auto renewal is working with certbot renew --dry-run Mar 10, 2023 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .