We have a wordpress site on an aws ec2 that was setup to auto renew its SSL certificate via Let’s Encrypt.
The auto renewal has recently stopped and the certificate has since expired.
I have attempting to run docker exec {container_id} /app/force_renew
but received this error:
ACME server returned an error: urn:acme:error:serverInternal :: The server experienced an internal error :: ACMEv1 is deprecated and you can no longer get certificates from this endpoint. Please use the ACMEv2 endpoint, you may need to update your ACME client software to do so. Visit https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430/27 for more information.
I have assumed that the jrcs/letsencrypt-nginx-proxy-companion
image has since been updated to handle this required change to the ACME client — and that pulling the image and restarting the container with the new image would fix auto renewal.
If that’s a correct assumption, how can I pull the latest jrcs/letsencrypt-nginx-proxy-companion
image and restart the container without disturbing the volumes attached to the the wordpress
or db
services?
If it’s an incorrect assumption, how do I fix the certificate auto renewal?
version: '3.1'
services:
nginx-proxy:
container_name: nginx-proxy
image: jwilder/nginx-proxy:latest
restart: always
ports:
- 80:80
- 443:443
volumes:
- conf:/etc/nginx/conf.d
- vhost:/etc/nginx/vhost.d
- html:/usr/share/nginx/html
- dhparam:/etc/nginx/dhparam
- certs:/etc/nginx/certs:ro
- /var/run/docker.sock:/tmp/docker.sock:ro
nginx-proxy-companion:
image: jrcs/letsencrypt-nginx-proxy-companion:latest
restart: always
volumes:
- conf:/etc/nginx/conf.d
- vhost:/etc/nginx/vhost.d
- html:/usr/share/nginx/html
- dhparam:/etc/nginx/dhparam
- certs:/etc/nginx/certs:rw
- /var/run/docker.sock:/var/run/docker.sock:ro
depends_on:
- nginx-proxy
environment:
DEFAULT_EMAIL: [email protected]
NGINX_PROXY_CONTAINER: nginx-proxy
wordpress:
image: wordpress
restart: always
environment:
WORDPRESS_DB_HOST: db
WORDPRESS_DB_USER: myuser
WORDPRESS_DB_PASSWORD: mypass
WORDPRESS_DB_NAME: mydb
VIRTUAL_HOST: mysite.com
LETSENCRYPT_HOST: mysite.com
volumes:
- ./wp-content:/var/www/html/wp-content
db:
image: mysql:5.7
restart: always
environment:
MYSQL_DATABASE: mydb
MYSQL_USER: myuser
MYSQL_PASSWORD: mypass
MYSQL_RANDOM_ROOT_PASSWORD: '1'
volumes:
- ./mysql-data:/var/lib/mysql
command: mysqld --sql-mode=""
volumes:
conf:
vhost:
html:
dhparam:
certs:
2
Answers
The document has option to provide URL, set env variable as suggested.
The ACME_CA_URI environment variable is used to set the ACME API endpoint from which the container’s certificate(s) will be requested (defaults to https://acme-v02.api.letsencrypt.org/directory).
What I would suggest is to spin up a new set of containers on a different server, and to copy the content of the current volumes.
The upgrade of the
nginx-proxy-companion
container shouldn’t affect the one with wordpress, but you want to be sure everything is compatible.Once you have all the new versions on the new server, and you verify they work as expected, you either keep that and abandon the old one, or you update the image for the companion on the old server.
P.S.: I hope the password in the pasted yaml aren’t the ones actually in production