Let‘s Encrypt SSL 製作免費證書

1. 查看80端口

sudo lsof -i :80

sudo pkill nginx

2. 啟動 80 測試程序

啟動Ubuntu的Nginx服務
sudo systemctl start nginx


啟動docker的80服務無效，可以嘗試做端口映射可能行，但是沒有嘗試過
測試過不行，因為Let's Encrypt 無法重啟docker裡面的Nginx。
vb_build_myerp_local

3. 生成證書

如果之前做過證書，讓certbot重新生成
sudo certbot renew

生成的證書文件如下

4. Copy 證書到工程目錄

將cp symlink過去
sudo cp -a /etc/letsencrypt/live/erp.vital-base.com/. /opt/workspace/worker_**/ssl2/

#正確
cp privkey.pem fullchain.pem cert.pem chain.pem /opt/workspace/worker_**/ssl2/

5. 啟動nginx 443

停掉所有的80端口，開啟443服務。

6. 檢查docker

通過-a 包括啟動失敗的docker
docker ps -a | grep myerp-vue3

查看docker內的證書
docker exec myerp-vue3 ls -l /etc/ssl/myerp/

查看docker內的nginx
docker exec myerp-vue3 nginx -t

7. 關於symlinks的問題

如果cp過去只是一個鏈接，docker將無法獲得證書

刪除symlink
rm -f /opt/workspace/worker_myerp/ssl2/privkey.pem
rm -f /opt/workspace/worker_myerp/ssl2/fullchain.pem
rm -f /opt/workspace/worker_myerp/ssl2/cert.pem
rm -f /opt/workspace/worker_myerp/ssl2/chain.pem

copy後再次check
ls -lah /opt/workspace/worker_***/ssl2/

8. 簡要說明

Ubuntu默認的nginx路徑
/etc/nginx/sites-available

#Let’s Encrypt的配置路徑
/etc/letsencrypt/renewal

#Let’s Encrypt 生成證書後的存放路徑
/etc/letsencrypt/live

app.abc.com.conf文件

# renew_before_expiry = 30 days
version = 1.21.0
archive_dir = /etc/letsencrypt/archive/erp.vital-base.com
cert = /etc/letsencrypt/live/erp.vital-base.com/cert.pem
privkey = /etc/letsencrypt/live/erp.vital-base.com/privkey.pem
chain = /etc/letsencrypt/live/erp.vital-base.com/chain.pem
fullchain = /etc/letsencrypt/live/erp.vital-base.com/fullchain.pem

# Options used in the renewal process
[renewalparams]
account = your account
authenticator = username
webroot_path = /var/www/html,
server = https://acme-v02.api.letsencrypt.org/directory
[[webroot_map]]
erp.vital-base.com = /var/www/html