A Docker container running an out-of-the-box Apache2 web server with SSL enabled. You don't need to provide any previously-obtained certificate for your server because the issue of such certificate as well as the renewal are automatically handled by the Certbot client.
Certbot is an easy-to-use automatic client that fetches and deploys SSL/TLS certificates for your webserver. Certbot was developed by EFF and others as a client for Let's Encrypt and was previously known as "the official Let’s Encrypt client" or "the Let’s Encrypt Python client."
Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. It is a service provided by the Internet Security Research Group (ISRG).
We give people the digital certificates they need in order to enable HTTPS (SSL/TLS) for websites, for free, in the most user-friendly way we can. We do this because we want to create a more secure and privacy-respecting Web.
The base configuration file for the Apache web server (i.e. httpd.conf
) has been tweaked to source a couple of external files that provide some extra configuration. These files are httpd-vhosts.conf
and httpd-ssl.conf
and they must reside in /usr/local/apache2/conf/extra
inside the container. Because of that it's a good thing to:
- Set up a folder structure like this in your host:
conf
└── extra
├── httpd-ssl.conf
└── httpd-vhosts.conf
- Mount the previous folder with
-v $PWD/conf/extra:/usr/local/apache2/conf/extra
.
The file httpd-vhosts.conf
should contain the configuration for your virtual hosts. Here you usually specify the location of the certificate files as well as the automatic redirection from HTTP to HTTPS.
<VirtualHost *:80>
ServerName mperezi.com
Redirect permanent / https://mperezi.com/
</VirtualHost>
<VirtualHost *:443>
ServerName mperezi.com
SSLEngine on
SSLCertificateFile /etc/letsencrypt/certs/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/certs/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/certs/chain.pem
</VirtualHost>
The file httpd-ssl.conf
is where you place the settings that are specific to SSL.
Listen 443
SSLSessionCache shmcb:/usr/local/apache2/logs/ssl_scache(512000)
$ docker volume create certs
$ docker container run \
-d
-p 80:80
-p 443:443
--hostname <domain-to-be-secured.com>
-e LETS_ENCRYPT_EMAIL <maintainer-of-the-domain@mail-server.com>
-v $PWD/html:/usr/local/apache2/htdocs
-v $PWD/conf/extra:/usr/local/apache2/conf/extra
-v certs:/etc/letsencrypt
--name web
mperezi/apache2-letsencrypt
version: '2'
services:
web:
image: mperezi/apache2-letsencrypt
hostname: <domain-to-be-secured.com>
ports:
- '80:80'
- '443:443'
environment:
LETS_ENCRYPT_EMAIL: <maintainer-of-the-domain@mail-server.com>
volumes:
- '$PWD/html:/usr/local/apache2/htdocs'
- '$PWD/conf/extra:/usr/local/apache2/conf/extra'
- 'certs:/etc/letsencrypt'
volumes:
certs:
All generated keys and issued certificates can be found in /etc/letsencrypt/live/<domain>
inside the container. It's advisable to use a volume and mount /etc/letsencrypt
to prevent certificate loss upon successive restarts of the container.
You can query Certbot at any time and obtain valuable information about the certificates installed in the container by using:
$ docker container exec web certbot certificates
Found the following certs:
Certificate Name: example.com
Domains: example.com, www.example.com
Expiry Date: 2017-02-19 19:53:00+00:00 (VALID: 30 days)
Certificate Path: /etc/letsencrypt/live/example.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/example.com/privkey.pem
You don't need to worry about expiry dates or renewing your certificates because Certbot does it for you too. And it does so by setting up a cron job that runs the command certbot renew
(usually twice a day). This command attempts to renew any previously-obtained certificates that expire in less than 30 days.
You can obtain a certificate for as many domains as you want by setting the environment variable LETS_ENCRYPT_DOMAINS
. By providing a comma-separated list of domains there you get a certificate where:
The first domain provided will be the subject CN of the certificate, and all domains will be Subject Alternative Names on the certificate.
The first domain refers to the hostname
of the container.