nginx Let’s Encrypt authentication for reverse-proxy sites

Problem:

You have an nginx host that is configured as reverse-proxy-only like this:

server {
    server_name  my.domain;
    [...]
    location / {
        proxy_pass http://localhost:1234;
    }
}

For this host, you want to use Let’s Encrypt to automatically issue a certificate using the webroot method like this:

certbot certonly -a webroot --webroot-path ??? -d my.domain

The reverse-proxied webserver does not provide a webroot to use for the automated autentication process and you want to keep the flexibility of updating the cert at any time without manually modifying the nginx configuration.

Solution:

Let’s Encrypt uses the /.well-known directory to communicate with the ACME server. This means that you only need to perform two simple steps:

• Create a new (empty) webroot directory where the Let’s Encrypt software can place the authentication info
• Configure nginx to use said webroot directory for the /.well-known path instead of the reverse proxy.

Assuming you created the webroot directory in /var/my.domain.webroot, you could use this config block inside the server block:

location /.well-known {
    root /var/my.domain.webroot;
}

Then, restart nginx and use Let’s Encrypt like this:

certbot certonly -a webroot --webroot-path /var/my.domain.webroot -d my.domain

You can share the webroot directory with other domains.