nginx Let’s Encrypt authentication for reverse-proxy sites
Problem:
You have an nginx host that is configured as reverse-proxy-only like this:
server {
server_name my.domain;
[...]
location / {
proxy_pass http://localhost:1234;
}
}
For this host, you want to use Let’s Encrypt to automatically issue a certificate using the webroot method like this:
certbot certonly -a webroot --webroot-path ??? -d my.domain
The reverse-proxied webserver does not provide a webroot to use for the automated autentication process and you want to keep the flexibility of updating the cert at any time without manually modifying the nginx configuration.
Solution:
Let’s Encrypt uses the /.well-known
directory to communicate with the ACME server. This means that you only need to perform two simple steps:
- Create a new (empty) webroot directory where the Let’s Encrypt software can place the authentication info
- Configure nginx to use said webroot directory for the
/.well-known
path instead of the reverse proxy.
Assuming you created the webroot directory in /var/my.domain.webroot
, you could use this config block inside the server
block:
location /.well-known {
root /var/my.domain.webroot;
}
Then, restart nginx and use Let’s Encrypt like this:
certbot certonly -a webroot --webroot-path /var/my.domain.webroot -d my.domain
You can share the webroot directory with other domains.