CODEWITHSUNDEEP
dockertraefik
Andrey Kurnikovs
Andrey Kurnikovs

Reputation: 427

Your connection is not private (this certificate can't be verified up to a trusted verification authority)

I have hard times setting up Traefik's "Let's encrypt" automated certificates for my site. It keeps popping Error message: "Your connection is not private". When I check the certificate it looks like this shown here on screenshot

Is this feature broke with Traefik? How can I make it work. Am I doing something wrong?

Here's my traefik.toml file:

defaultEntryPoints = ["http", "https"]
[web]
address = ":8080"
  [web.auth.basic]
  users = ["admin:$apr1$yhytIYv.$p0hPOLpt/NE9aAr7c1HsV1"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
[acme]
email = "[email protected]"
storage = "acme.json"
onDemand = true
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
entryPoint = "https"
  [acme.httpChallenge]
  entryPoint = "http"

Also, I'm starting the container this way:

docker network create proxy
docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v $PWD/traefik.toml:/traefik.toml \
  -v $PWD/acme.json:/acme.json \
  -p 80:80 \
  -p 443:443 \
  -l traefik.frontend.rule=Host:monitor.btcsha.com \
  -l traefik.port=8080 \
  --network proxy \
  --name traefik \
  traefik:1.7-alpine --docker

Upvotes: 1

Views: 2816

Answers (2)

Andrey Kurnikovs
Andrey Kurnikovs

Reputation: 427

Ok, I somehow made it work. I think the issue was that I had to remove the old acme.json file. Then when I created a new one I forgot to give it a "chmod 600 acme.json"

And yes, Idez was right with "caServer = "https://acme-v02.api.letsencrypt.org/directory"

Now it works. So for future references, here is my traefik.toml:

defaultEntryPoints = ["http", "https"]
[web]
address = ":8080"
  [web.auth.basic]
  users = ["admin:$apr1$yhytIYv.$p0hPOLpt/NE9aAr7c1HsV1"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[acme]
email = "[email protected]"
storage = "acme.json"
onDemand = true
caServer = "https://acme-v02.api.letsencrypt.org/directory"
entryPoint = "https"
  [acme.httpChallenge]
   entryPoint = "http"

... and I start docker with the following command:

docker network create proxy
docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v $PWD/traefik.toml:/traefik.toml \
  -v $PWD/acme.json:/acme.json \
  -p 80:80 \
  -p 443:443 \
  -l traefik.frontend.rule=Host:monitor.btcsha.com \
  -l traefik.port=8080 \
  --network proxy \
  --name traefik \
  traefik:1.7-alpine --docker

Upvotes: 2

ldez
ldez

Reputation: 3130

You are using the Let's Encrypt Staging (caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"), so the Root Certificate is not valid and it's the expected behavior.

Please read https://letsencrypt.org/docs/staging-environment/

To have real certificates, you need to use Let's Encrypt production endpoint (caServer = "https://acme-v02.api.letsencrypt.org/directory") which is the default in Traefik.

Upvotes: 0

Related Questions