Free SSL Certificates with LetsEncrypt and Docker

Everyone loves security, yeah?!

Up until recently, it's cost a fair whack of money to use SSL certificates on your website. This has been a barrier for a lot of smaller website, which subsequently leaves them vulnerable to common attacks such as man in the middle.

Then comes letsencrypt, a free, crowdfunded way to get valid https certificates, like the one used on this website! In order to keep costs down (you know, as its free) they rely a lot on automated scripts and domain validation, which can be a little fiddly. I also have to do this for lots, and lots of microservices and websites that I host - so I wanted to encapsulate all of these concerns into a simple container which was generic, and did it all for me.

docker-nginx-letsencrypt

I created this docker container which is an NGINX reverse proxy, which will front your microservice with a valid HTTPS certificate without you having to do much at all!

Lets take this website, karlstoney.com as an example. The blog is actually a ghost nodejs application, which serves up http on port karlstoney.www.svc.cluster.local:2368. However, I want to expose that to the world on karlstoney.com. I could use the following docker-compose file to do just that:

version: '2'

services:  
  nginx:
    image: stono/docker-nginx-letsencrypt 
    restart: always
    volumes:
      - ./certs:/etc/letsencrypt/live
    environment:
      - HOST_WEBSITE1=karlstoney.com,karlstoney.www.svc.cluster.local:2368,default_server
    ports:
      - 443
      - 80

That's it, watch what happens when the container boots on my server:

Generating self signed certificate for karlstoney.com  
Generating a 4096 bit RSA private key  
................................................++
.............++
writing new private key to 'key.pem'  
-----
Writing nginx config for karlstoney.com with an upstream of karlstoney.www.svc.cluster.local:2368  
server {  
    listen 80;
    server_name karlstoney.com;

    location ~ /.well-known {
        allow all;
        break;
    }
    location / {
        return  301 https://$host$request_uri;
    }
}

server {  
    listen 443 default_server;
    server_name karlstoney.com;

    ssl on;
    ssl_certificate           /etc/letsencrypt/live/karlstoney.com/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/karlstoney.com/key.pem;

    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

    access_log            /var/log/nginx/karlstoney.com.access.log;

    set $upstream_endpoint_host_karlstoney http://karlstoney.www.svc.cluster.local:2368;
    resolver 10.37.80.10;
    resolver_timeout 5s;

    location / {
        proxy_set_header        Host $host;
        proxy_set_header        X-Real-IP $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto $scheme;

        proxy_http_version  1.1;
        proxy_set_header    Upgrade $http_upgrade;
        proxy_set_header    Connection "upgrade";
        proxy_set_header    Host $host;

        proxy_pass          $upstream_endpoint_host_karlstoney;
        proxy_redirect      http://karlstoney.www.svc.cluster.local:2368 https://karlstoney.com;
        proxy_read_timeout  90;
    }
}
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok  
nginx: configuration file /etc/nginx/nginx.conf test is successful  
Starting Nginx  
2016/12/30 21:06:31 [notice] 26#0: using the "epoll" event method  
2016/12/30 21:06:31 [notice] 26#0: nginx/1.11.5  
2016/12/30 21:06:31 [notice] 26#0: built by gcc 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC)  
2016/12/30 21:06:31 [notice] 26#0: OS: Linux 4.4.21+  
2016/12/30 21:06:31 [notice] 26#0: getrlimit(RLIMIT_NOFILE): 1048576:1048576  
2016/12/30 21:06:31 [notice] 26#0: start worker processes  
2016/12/30 21:06:31 [notice] 26#0: start worker process 28  
Nginx started with pid 26  
Running simp_le letsencrypt for karlstoney.com  
2016-12-30 21:06:34,455:INFO:simp_le:1211: Generating new account key  
10.37.64.1 - - [30/Dec/2016:21:06:36 +0000] "GET /.well-known/acme-challenge/h_rKjS1mbLjzs9d0bw6yDfk7M8RBr7_FVkPprVD_wkE HTTP/1.1" 200 87 "-" "python-requests/2.12.4"  
2016/12/30 21:06:36 [info] 28#0: *1 client 10.37.64.1 closed keepalive connection  
2016-12-30 21:06:36,648:INFO:simp_le:1305: karlstoney.com was successfully self-verified  
2016-12-30 21:06:36,861:INFO:simp_le:1313: Generating new certificate private key  
10.37.64.1 - - [30/Dec/2016:21:06:37 +0000] "GET /.well-known/acme-challenge/h_rKjS1mbLjzs9d0bw6yDfk7M8RBr7_FVkPprVD_wkE HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"  
2016-12-30 21:06:39,370:INFO:simp_le:391: Saving account_key.json  
2016-12-30 21:06:39,371:INFO:simp_le:391: Saving fullchain.pem  
2016-12-30 21:06:39,383:INFO:simp_le:391: Saving key.pem  
2016/12/30 21:06:39 [notice] 26#0: signal 1 (SIGHUP) received, reconfiguring  
2016/12/30 21:06:39 [notice] 26#0: reconfiguring  
2016/12/30 21:06:39 [notice] 26#0: using the "epoll" event method  
2016/12/30 21:06:39 [notice] 26#0: start worker processes  
2016/12/30 21:06:39 [notice] 26#0: start worker process 40  
2016/12/30 21:06:39 [notice] 28#0: gracefully shutting down  
2016/12/30 21:06:39 [notice] 28#0: exiting  
2016/12/30 21:06:39 [notice] 28#0: exit  
2016/12/30 21:06:39 [notice] 26#0: signal 17 (SIGCHLD) received  
2016/12/30 21:06:39 [notice] 26#0: worker process 28 exited with code 0  
2016/12/30 21:06:39 [notice] 26#0: signal 29 (SIGIO) received  

You can view the full repo here