Certginx

Certginx is a helper tool to generate certbot certificates. It is compatible with multiple domains and support multiple applications.

This project is neither affiliated with cerbot nor nginx.

How to use certginx

Configuring firewall

Make sure your firewall allows the incoming 80 and 443 ports.

Open ports with iptables:

iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT

Configuring nginx

./nginx/conf.d/subdomain.domain.com.conf
Replace all the occurrences of subdomain.domain.com with your domain name. Rename up-app with up-<app-name>, it may create conflicts if you use the same name between files. Rename ./nginx/conf.d/subdomain.domain.com.conf with ./nginx/conf.d/<your-domain>.conf.

Executing the script

Usage: ./certginx.sh <command> [options]

Commands:
    add -d <domains> -e <email>    Add domains with email (-e not required)
    self-signed -d <name>          Create self signed certificate
    remove -d <domains>            Remove domains
    list                           List domains (not self signed)
    update-tls                     Update TLS parameters

Configuring after script

Update ./nginx/conf.d/<your-domain>.conf to suit your needs.

./nginx/conf.d/.conf
Update localhost in up-<app-name> section with the name of your docker container.

Communicating between certginx and your app

I will use example-app as network, you may rename it.

./docker-compose.yml
At the end of nginx service, add: networks: - example-app At the end of the file, add: networks: example-app: external: true External networks are not automatically created by docker-compose. To do so, just run the command below: docker network create example-app

You need to do the same thing in your docker-compose.yml app, but instead of nginx service, it will be your communicating service.

Best practice to deploy

The best way to deploy your app with certginx is to create a user per application (eg. user certginx for certgins and user website for your website).

Secure your nginx

Use the latest ssl protocols.

./nginx/conf.d/00_tls-cipher.conf
ssl_protocols TLSv1.3; ssl_prefer_server_ciphers off;

Catch bad sni (replace dummy-certificate with a dummy certificate).

./nginx/conf.d/01_catch-bad-sni.conf
server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name _; ssl_certificate /etc/letsencrypt/live/dummy-certificate/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/dummy-certificate/privkey.pem; return 444; }

Catch bad vhost.

./nginx/conf.d/01_catch-bad-vhost.conf
server { listen 80; listen [::]:80; server_name _; return 444; }

Credits

• nginx-certbot the base of the add_domain script.