I have been running Let's Encrypt's certbot utility with NGINX on Ubuntu Server 17.10 for a while now, and while it has been working well, I prefer FreeBSD. Until recently (Feb 2018), the nginx plugin wasn't available for certbot on FreeBSD, but now that it is, it was time to migrate to FreeBSD.

Nginx was easy, copy/paste configs and it was up and running (with a little tweaking of paths).

Certbot and the /etc/letsencrypt hierarchy wasn't too much of a challenge either, until I tried running certbot renew --dry-run to test if everything worked. The entire hierarchy was copied over with symlinks intact (using tar), paths in the renewal config files were changed to reflect the new location (/usr/local/etc/letsencrypt rather than /etc/letsencrypt). The Nginx config lives at /usr/local/etc/nginx/nginx.conf.

The error message I get when running certbot is as follows:

# certbot
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Error while running nginx -c /etc/nginx/nginx.conf -t.

nginx: [emerg] open() "/etc/nginx/nginx.conf" failed (2: No such file or directory)
nginx: configuration file /etc/nginx/nginx.conf test failed

Certbot doesn't know how to automatically configure the web server on
this system. However, it can still get a certificate for you. Please run
"certbot certonly" to do so. You'll need to manually configure your web
server to use the resulting certificate.

The contents of /var/log/letsencrypt/letsencrypt.log:

# cat /var/log/letsencrypt/letsencrypt.log
2018-04-04 18:52:42,032:DEBUG:certbot.main:certbot version: 0.22.2
2018-04-04 18:52:42,033:DEBUG:certbot.main:Arguments: []
2018-04-04 18:52:42,033:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#nginx,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2018-04-04 18:52:42,051:DEBUG:certbot.log:Root logging level set at 20
2018-04-04 18:52:42,052:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2018-04-04 18:52:42,052:DEBUG:certbot.plugins.selection:Requested authenticator None and installer None
2018-04-04 18:52:42,065:ERROR:certbot.util:Error while running nginx -c /etc/nginx/nginx.conf -t.

nginx: [emerg] open() "/etc/nginx/nginx.conf" failed (2: No such file or directory)
nginx: configuration file /etc/nginx/nginx.conf test failed

2018-04-04 18:52:42,065:DEBUG:certbot.plugins.disco:Misconfigured PluginEntryPoint#nginx: Error while running nginx -c /etc/nginx/nginx.conf -t.

nginx: [emerg] open() "/etc/nginx/nginx.conf" failed (2: No such file or directory)
nginx: configuration file /etc/nginx/nginx.conf test failed
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/site-packages/certbot/plugins/disco.py", line 126, in prepare
    self._initialized.prepare()
  File "/usr/local/lib/python2.7/site-packages/certbot_nginx/configurator.py", line 134, in prepare
    self.config_test()
  File "/usr/local/lib/python2.7/site-packages/certbot_nginx/configurator.py", line 798, in config_test
    raise errors.MisconfigurationError(str(err))
MisconfigurationError: Error while running nginx -c /etc/nginx/nginx.conf -t.

nginx: [emerg] open() "/etc/nginx/nginx.conf" failed (2: No such file or directory)
nginx: configuration file /etc/nginx/nginx.conf test failed

2018-04-04 18:52:42,066:DEBUG:certbot.plugins.selection:Single candidate plugin: * nginx
Description: Nginx Web Server plugin - Alpha
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: nginx = certbot_nginx.configurator:NginxConfigurator
Initialized: <certbot_nginx.configurator.NginxConfigurator object at 0x80217c0d0>
Prep: Error while running nginx -c /etc/nginx/nginx.conf -t.

nginx: [emerg] open() "/etc/nginx/nginx.conf" failed (2: No such file or directory)
nginx: configuration file /etc/nginx/nginx.conf test failed

2018-04-04 18:52:42,067:DEBUG:certbot.plugins.selection:Selected authenticator None and installer None

The most frustrating thing is that if I create a symlink from /usr/local/etc/nginx to /etc/nginx, everything works.

I'd also like to point out that nginx works perfectly, as do the certificates. When the symlink mentioned above is in place, certificate renewal also works.

I am aware that I can issue flags to certbot to instruct it to look for the nginx files elsewhere than the configured default or put those flags in a config file, but I'd rather have it work without them if at all possible.

I assume all this stems from me copying the letsencrypt directory tree across from a linux server, so my question is simply if there is a way to "reconfigure" certbot to look for the nginx configs under /usr/local/etc/nginx rather than /etc/nginx.

System info:
FreeBSD 11.1-RELEASE-p9 amd64, stock kernel
Nginx: www/nginx-devel from ports, version 1.13.10
Certbot: security/py-certbot from ports, py27-certbot-0.22.2,1
Certbot-nginx: security/py-certbot-nginx from ports, py27-certbot-nginx-0.22.2

Thanks in advance.

  • I'm not sure why you have both py-certbot and py-certbot-nginx. For years I've been running py-certbot alone without issue and was unaware of the nginx version. – Rob May 2 at 11:38
  • py-certbot-nginx is a plugin that handles updating the nginx vhost configuration automatically. Strictly speaking it's not really necessary, but it makes it a bit easier. py-certbot is a requirement if you install py-certbot-nginx, so that gets pulled in automatically. – remiel May 3 at 12:51

I solved it!

After much searching around the system, having ran certbot -vvvvvv for lots of debug output, I finally found /usr/local/lib/python2.7/site-packages/certbot_nginx/constants.py which sets the nginx config path. I changed that from /etc/nginx to /usr/local/etc/nginx, recompiled the .pyc (python -m py_compile constants.py) and .pyo (python -O -m py_compile constants.py) files, removed the symlink from /etc/nginx and hey presto, it works!

Not sure if the path was set during compile/installation time or if it was picked up from the config files copied from the Linux system, but at least it looks for the config files in the right place now.

Also not sure if these changes will stick through upgrades; time will tell.

Edit: I spun up a virtual machine and installed nginx, py-certbot-nginx and dependencies, and it does indeed set /etc/nginx as the base dir for nginx configs on installation. I'll file a PR to the port maintainer for py-certbot-nginx.

  • Also there is dehydrated package for FreeBSD that manage LetsEncrypt certificates way more easily than native certbot. – Kondybas Apr 4 at 21:44

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.