This is how I automate LE (technically ACME/ZeroSSL) in my Nginx reverse proxy.

https://git.inportb.com/jyio/docker-nginx-auto

Basically, inotifywait on the config directory and request new certificates as needed. Grep the config files for hostnames (and ignore if labeled NOSSL). And a configuration snippet to include the same SSL config for anything that needs SSL (including the .well-known/acme-challenge directory). Oh, and use cron to renew periodically.

> inotifywait on the config directory

I like this idea. I'm going to start using this.

Just be aware that nginx needs a self-signed certificate in the very beginning, to serve the .well-known/acme-challenge directory. To simplify the initial setup, I include a default "snake oil" certificate, which gets overwritten.

It doesn't. You can serve it over http.

With apache2 httpd, you can of course serve the challenge over insecure HTTP, but httpd won't start if you say it should use a cert that doesn't actually exist, so for the sake of automated setup and not having to edit the config multiple times it's way easier to write a self-signed cert and then overwrite it with LE. I think the situation is the same with nginx but not 100% sure.

You can use IfFile to gate the TLS part of the server until the certificate file exists, if you really don't want to edit your config files during TLS bootstrap.

The situation is the same with nginx. It's way easier to write a self-signed cert and then overwrite it with LE.

I just use dns and acme.sh for that reason and not bother about it anymore

Interesting! Thanks for pointing that out.

Though... I think I'd still include the snake oil cert and serve everything over SSL, because it simplifies the configuration.

How I solve this is that I deactivate all configuration files that have missing certificates, and then reactivate them again after the files have been created.

https://github.com/JonasAlfredsson/docker-nginx-certbot

> I was disappointed to find they are just creating a self-signed RootCA and issuing certs.

Agreed. Not sure why you'd go through the trouble of importing a self-signed CA when you can provision certs for any internal service with LE. I dont use self-signed and instead have been using LE certs provisioned for internal services for the last couple years. Extra nice to be able to leverage DNS challenge for cert provisioning at home to get around overloading common ports.

I know a lot of people mention Caddy but I find Traefik [0] (pronounced "traffic") more flexible. It's routing and middleware configurations are fantastic. Especially when you want to stick a reverse proxy in front of things that are a pain to provision certs into (switches, routers, old embedded web interfaces, etc).

[0] https://traefik.io/traefik/

didn't know you could do this with LE. Good tip. Although this seems quite complicated to do.

A lot of webservers now have ACME built in and you can just have it automatically handle the entire certificate life cycle.