3

My server runs on a LEMP Stack Ubuntu 16.04 and last version of nginx

I already have a SSL certificate installed on my server for the following domains and subdomains : example.com, domain1.example.com and everything is working fine.

What I try to achieve

I'd like to create a new certificate for domain2.example.com

To do so, I tried this command:

sudo certbot --nginx -d example.com -d domain1.example.com -d domain2.example.com --expand

Error message

Cannot find a cert or key directive in /etc/nginx/sites-enabled/example.com for set(['www.example.com', '*.example.com', 'example.com']). VirtualHost was not modified.

nginx config

server {

   # SSL configuration

   listen 443 ssl http2 default_server;
   listen [::]:443 ssl http2 default_server;
   include snippets/ssl-example.com.conf;
   include snippets/ssl-params.conf;


    root /var/www/laravel/public;
    index index.php index.html index.htm;


    server_name example.com *.example.com www.example.com ;
}

Questions

What am I doing wrong ? How can I recreate the certificate to add the domain2 ?

6
  • 1
    Please un-obfuscate the commands, command output, and confuguration in your question. In your effort to obscure, you've made it impossible to understand what actually is going on.
    – EEAA
    Jul 26, 2017 at 2:12
  • Sorry but what do you mean by un-obfuscate ?
    – Leo
    Jul 26, 2017 at 2:14
  • 1
    You're currently mixing domain.com, site.com and example.com in ways that don't make sense. We cannot tell how these map to your real domains.
    – 84104
    Jul 26, 2017 at 2:18
  • You're right ! I just fixed it
    – Leo
    Jul 26, 2017 at 2:21
  • AFAIK, NGINX support is still rather unstable and since you only just need to add ssl_certificate and ssl_certificate_key in the appropriate server block, I'd recommend doing it by hand. If you want to keep the question open, I'd recommend giving the path of the NGINX configuration since Certbot looks for a specific file. Jul 26, 2017 at 5:55

3 Answers 3

0

Here is what I had to do.

  1. First find the existing certificates by typing certbot certificates
  2. Then identify the certificate you wish to expand
  3. Update the certificate by typing sudo certbot certonly --cert-name example.com -d example.com -d domain1.example.com -d domain2.example.com --expand.
  4. Select 2: Place files in webroot directory (webroot)
  5. Enter new webroot which was for me /var/www/laravel
0

For me, I went into the /etc/nginx/sites-enabled folder and manually deleted the erroneous sym-linked virtual host files that I thought I had deleted prior. Surprise, they were still there. So make sure to do sudo rm -rf [filename] in that folder. Then restart nginx via sudo nginx -s reload and run the certbot command again and should be GTG.

0

One of the best way is to use webroot plugin (described https://certbot.eff.org/#centosrhel7-other). I advice to follow next way:

  1. Add following location directive to hosts (server blocks), that you want to process by certbot and get certificates for that:

    location /.well-known {
        root /usr/share/nginx/html;
    }
    
  2. Install certbot

  3. Exec certbot certonly command
  4. Follow instruction. Choose "webroot way" of authentication (2nd option). And when you asked for www-root for you domain enter /usr/share/nginx/html (as in location directive root).
  5. When all finished you can find you certificates in /etc/letsencrypt/live/youdomain.com/fullchain.pem.
  6. Add to server block:

    ssl on;
    ssl_certificate /etc/letsencrypt/live/youdomain.com/fullchain.pem;
    ssl_certificate_key    /etc/letsencrypt/live/youdomain.com/privkey.pem;
    

Thats all ;) After that you can easily renew cerificates by run certbot renew command.

How it works?

When we add location directive we select custom root folder for /.well-known location. Certbot create files inside .well-known directory and external authentication server (ACME CA) check files within this folder. If you manage many domains or using nginx as proxy (!) it's very useful to use one common root for /.well-known location because in that case you may have no root directory on machine with nginx (for example you have nginx installed in one VPS as a proxy for Apache installed in another VPS).

Good luck.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .