pslobo / dockerized-certbot

A Docker container based on Alpine Linux with Certbot installed.

What is Certbot

Certbot is an easy-to-use automatic client that fetches and deploys SSL/TLS certificates for your webserver. Certbot was developed by EFF and others as a client for Let's Encrypt and was previously known as "the official Let’s Encrypt client" or "the Let’s Encrypt Python client." Certbot will also work with any other CAs that support the ACME protocol.

How to use this image

Start a Certbot instance with the Apache plugin

In it's simplest form, starting an instance is as easy as:

docker container run -it \
       --rm \
       --net host \
       -v /etc/letsencrypt:/etc/letsencrypt \
       -v /var/lib/letsencrypt:/var/lib/letsencrypt \
       -v /var/www:/var/www \
       palobo/certbot -t install --apache -d DOMAIN

• DOMAIN is the domain name to apply. For multiple domains use multiple -d flags.

Start a Certbot instance with the Webroot plugin

docker container run -it \
       --rm \
       -v /etc/letsencrypt:/etc/letsencrypt \
       -v /var/www:/var/www \
       palobo/certbot -t certonly --webroot -w WEBROOT_PATH -d DOMAIN

• WEBROOT_PATH is a public_html / webroot path. This can be specified multiple times to handle different domains; each domain will have the webroot path that preceded it and
• DOMAIN is the domain name to apply. For multiple domains use multiple -d flags

Start a Certbot instance with the Standalone plugin

docker container run -it \
       --rm \
       -p 443:443 \
       -v /etc/letsencrypt:/etc/letsencrypt \
       -v $(pwd)/log:/var/log/letsencrypt \
       palobo/certbot certonly --standalone \
       -t -m [email protected] -d my.domain.com

Access the Container

If for some reason you need to access the container to perform some troubleshooting or any other reason, you can do so by bypassing the entrypoint with:

docker container run -it \
                 --entrypoint /bin/sh
                 palobo/certbot

Exposed Ports

• 80
• 443

Exported Volumes

• /etc/letsencrypt

dockerized-certbot's Issues

UserWarning: implicit cast from char *

@pslobo when creating a certificate, there is a warning that we should maybe deal with:

root@uw# docker run -it --rm -v couch_https_certs:/etc/letsencrypt -p 80:80 -p 443:443 palobo/certbot:1.0 certonly -t -n --standalone --email {email} --agree-tos -d {domain}
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for {domain}
/opt/certbot/venv/lib/python2.7/site-packages/OpenSSL/rand.py:58: UserWarning: implicit cast from 'char *' to a different pointer type: will be forbidden in the future (check that the types are as you expect; use an explicit ffi.cast() if they are correct)
  result_code = _lib.RAND_bytes(result_buffer, num_bytes)
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/0000_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pem

Docker-Compose

Can this as a standelone cert generator used with docker-compose?

Outdated certbot

How do we upgrade the certbot version?

docker container run -it palobo/certbot --version
certbot 0.21.0.dev0

TLS-SNI-01 validation is deprecated, getting rid of it requires certbot 0.28.