A standalone certificate should be fetched. (I think because our certbot runs externally, and nginx runs in a docker container).

For the domain vwiki2.avril.work:

sudo certbot certonly --standalone -d vwiki2.avril.work

Note: Usually it should be done automatically with help of a cron job, but here is described how we can do it manually.

Simply run:

cd /dockerdata/compose
# Stop Avril docker compose
sudo docker-compose down
 
# Renew certificates 
sudo certbot renew
 
# Start Avril docker compose 
sudo docker-compose up -d

After that check in browser if you have new certificates. Maybe removing all cookies (Ctrl+Shift+Del) etc. and F5 is necessary.

Der obige Ansatz funktioniert sehr gut (nur 2 minuten Downtime). Aber 0 Minuten Downtime ist besser, deshalb wäre es schön nach einer Lösung zu schauen, die einen anderen Ansatz fährt (z.B. DNS-Plugins verwenden: https://certbot.eff.org/docs/using.html#dns-plugins).

P.S. Übrigens, das cerbot-Log liegt unter /var/log/letsencrypt.

It does not work at the moment, because the necessary port (80? or 443?) is in use during renewal. It can work (I didn't test it) if we install pre- and post-hooks, which will shut down and start again (after certs renewal) the docker compose.

At the moment I'm using the manual way, because I want to know exactly when the server will shut down.

Important for relay.avril.work certificates: because of problems, whether the mail server(?) uses wrong (old) certificates, the Dovecot service should be reloaded after the certificate renewal (see https://superuser.com/questions/1494333/thunderbird-not-updating-certificate-keeps-using-old-one-and-saying-its-expire ).

sudo service dovecot reload

It can be checked from a client with the following command:

openssl s_client -connect relay.avril.work:993 -quiet

This command gives for expired certificate:

kalaschnikow@kalaschnikow2017:~$ openssl s_client -connect relay.avril.work:993 -quiet
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = relay.avril.work
verify error:num=10:certificate has expired
notAfter=Oct 28 17:05:33 2021 GMT
verify return:1
depth=0 CN = relay.avril.work
notAfter=Oct 28 17:05:33 2021 GMT
verify return:1
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot (Ubuntu) ready.
^C

And for valid certificate:

kalaschnikow@kalaschnikow2017:~$ openssl s_client -connect relay.avril.work:993 -quiet
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = relay.avril.work
verify return:1
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot (Ubuntu) ready.
^C

If certbot is used the status of certificates can be checked in the terminal on the particular system with the command:

sudo certbot certificates

(see https://eff-certbot.readthedocs.io/en/stable/using.html#managing-certificates)

• 94.199.215.198 (jrserver on ip-projects)
  • /etc/letsencrypt/live/relay.avril.work/fullchain.pem expires on 2022-04-27
  • /etc/letsencrypt/live/www.avril.work/fullchain.pem expires on 2022-04-27

• 202.61.247.140 (Avril2021 on netcup)
  • /etc/letsencrypt/live/avril2021.avril.work/fullchain.pem expires on Donnerstag, 3. April 2025 um 08:28:04

• 185.194.236.66 (Avril2019 on ip-projects)
  • /etc/letsencrypt/live/avril2019.wialon-consulting.de/fullchain.pem expires on Montag, 1. Januar 2024 um 06:48:09