CODEWITHSUNDEEP
nginxdockerlets-encrypt
blockloop
blockloop

Reputation: 5735

Docker letsencrypt does not appear to be creating webroot files

I have an nginx service running with the following configuration 

location /.well-known {
        root /tmp/letsencrypt/;
}

I execute the following docker command

sudo docker run -it --rm --name certbot \
        -v /etc/letsencrypt \
        -v /var/lib/letsencrypt \
        -v /tmp/letsencrypt \
        quay.io/letsencrypt/letsencrypt:latest certonly \
        --webroot --webroot-path /tmp/letsencrypt \
        -d dev.blockloop.io --renew-by-default

I get the following output from letsencrypt

Type:   unauthorized
Detail: Invalid response from
http://dev.blockloop.io/.well-known/acme-challenge/wupz1YYLDRv8dJRYegoFXfZ24rJCwRrenQxBoYndO30:
"<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>"

and my nginx logs say this

nginx_1  | 2016/05/28 20:10:44 [error] 6#6: *1 open() "/tmp/letsencrypt/.well-known/acme-challenge/wupz1YYLDRv8dJRYegoFXfZ24rJCwRrenQxBoYndO30" failed (2: No such file or directory), client: 66.133.109.36, server: dev.blockloop.io, request: "GET /.well-known/acme-challenge/wupz1YYLDRv8dJRYegoFXfZ24rJCwRrenQxBoYndO30 HTTP/1.1", host: "dev.blockloop.io"
nginx_1  | 66.133.109.36 - - [28/May/2016:20:10:44 +0000] "GET /.well-known/acme-challenge/wupz1YYLDRv8dJRYegoFXfZ24rJCwRrenQxBoYndO30 HTTP/1.1" 404 169 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"

when I look in /tmp/letsencrypt I expect to see some files leftover by letsencrypt, but the only thing there is an empty .well-known directory. I suspect either letsencrypt is cleaning up or it's not creating the files.

If I drop an index.html file in /tmp/letsencrypt/.well-known and go to http://dev.blockloop.io/.well-known/ I see its contents so I know nginx is working properly.

Upvotes: 2

Views: 1516

Answers (1)

blockloop
blockloop

Reputation: 5735

I managed to fix the problem somehow. I think the solution was the trailing slash at the end of --webroot-path /tmp/letsencrypt/, but who knows. Here's the resulting script. Everything else remained the same.

sudo docker run -it --rm --name certbot \
        -v "/etc/letsencrypt:/etc/letsencrypt" \
        -v "/var/lib/letsencrypt:/var/lib/letsencrypt" \
        -v "/tmp/letsencrypt:/tmp/letsencrypt" \
        quay.io/letsencrypt/letsencrypt:latest certonly \
        --webroot --webroot-path /tmp/letsencrypt/ \
        -d dev.blockloop.io --renew-by-default

Upvotes: 1

Related Questions