A standalone certificate should be fetched. (I think because our certbot runs externally, and nginx runs in a docker container).
For the domain vwiki2.avril.work:
sudo certbot certonly --standalone -d vwiki2.avril.work
Note: Usually it should be done automatically with help of a cron job, but here is described how we can do it manually.
Simply run:
cd /dockerdata/compose # Stop Avril docker compose sudo docker-compose down # Renew certificates sudo certbot renew # Start Avril docker compose sudo docker-compose up -d
After that check in browser if you have new certificates. Maybe removing all cookies (Ctrl+Shift+Del) etc. and F5 is necessary.
Der obige Ansatz funktioniert sehr gut (nur 2 minuten Downtime). Aber 0 Minuten Downtime ist besser, deshalb wäre es schön nach einer Lösung zu schauen, die einen anderen Ansatz fährt (z.B. DNS-Plugins verwenden: https://certbot.eff.org/docs/using.html#dns-plugins).
P.S. Übrigens, das cerbot-Log liegt unter /var/log/letsencrypt.
It does not work at the moment, because the necessary port (80? or 443?) is in use during renewal. It can work (I didn't test it) if we install pre- and post-hooks, which will shut down and start again (after certs renewal) the docker compose.
At the moment I'm using the manual way, because I want to know exactly when the server will shut down.
Important for relay.avril.work certificates: because of problems, whether the mail server(?) uses wrong (old) certificates, the Dovecot service should be reloaded after the certificate renewal (see https://superuser.com/questions/1494333/thunderbird-not-updating-certificate-keeps-using-old-one-and-saying-its-expire ).
sudo service dovecot reload
It can be checked from a client with the following command:
openssl s_client -connect relay.avril.work:993 -quiet
This command gives for expired certificate:
kalaschnikow@kalaschnikow2017:~$ openssl s_client -connect relay.avril.work:993 -quiet depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = R3 verify return:1 depth=0 CN = relay.avril.work verify error:num=10:certificate has expired notAfter=Oct 28 17:05:33 2021 GMT verify return:1 depth=0 CN = relay.avril.work notAfter=Oct 28 17:05:33 2021 GMT verify return:1 * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot (Ubuntu) ready. ^C
And for valid certificate:
kalaschnikow@kalaschnikow2017:~$ openssl s_client -connect relay.avril.work:993 -quiet depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = R3 verify return:1 depth=0 CN = relay.avril.work verify return:1 * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot (Ubuntu) ready. ^C
If certbot is used the status of certificates can be checked in the terminal on the particular system with the command:
sudo certbot certificates
(see https://eff-certbot.readthedocs.io/en/stable/using.html#managing-certificates)