title: How correctly install ssl certificate using certbot in docker?
body: <p>I am trying to deploy <code>Node.js/Express</code> application with <code>Docker</code>, using Let's Encrypt SSL certificates for HTTPS.</p>
  
  <p>When I run <code>docker-compose up</code> command all 3 services started but I notice such warning:</p>
  
  <pre><code>Saving debug log to /var/log/letsencrypt/letsencrypt.log
  No certs found.
  </code></pre>
  
  <p>This warning happens when docker tried to execute <code>RUN /scripts/certbot-auto -n certificates</code> command in <code>certbot/Dockerfile</code> file.</p>
  
  <p>Inside <code>/var/log/letsencrypt/letsencrypt.log</code> file I see this:</p>
  
  <pre><code>2019-08-21 10:27:50,354:DEBUG:certbot.main:certbot version: 0.37.1
  2019-08-21 10:27:50,355:DEBUG:certbot.main:Arguments: ['-n']
  2019-08-21 10:27:50,355:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#apache,PluginEntryPoint#manual,PluginEntryPoint#nginx,Plugin$
  2019-08-21 10:27:50,372:DEBUG:certbot.log:Root logging level set at 20
  2019-08-21 10:27:50,372:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
  </code></pre>
  
  <p>Also in the logs of nginx container I notice such warning:</p>
  
  <pre><code>2019/08/21 10:28:37 [emerg] 1#1: cannot load certificate "/etc/letsencrypt/live/tols/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/tols/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file) 
  </code></pre>
  
  <p><strong>QUESTION</strong>: As far as I understand, ssl certificate was not created. How fix this problem and correctly install certificate using certbot?</p>
  
  <p><strong>Structure</strong>:</p>
  
  <pre><code>certbot/
      certbot-auto
      Dockerfile
      register
  nginx/
      Dockerfile
      nginx.conf
  server/
      bin/
          www.js
  Dockerfile
  docker-compose.yml
  </code></pre>
  
  <p><strong>docker-compose.yml</strong>:</p>
  
  <pre><code>version: '3'
  
  services:
    frontend:
      build: ./
      image: tols_frontend_image
      container_name: tols_frontend_container
      restart: always
      volumes:
      - certbot-webroot-tols:/tols-frontend/public/.well-known
      - certbot-letsencrypt:/etc/letsencrypt
  
    certbot:
      build: ./certbot
      image: tols_certbot_image
      container_name: tols_certbot_container
      restart: always
      volumes:
      - certbot-webroot-tols:/webroots/tols/.well-known
      - certbot-letsencrypt:/etc/letsencrypt
  
    nginx:
      build: ./nginx
      image: tols_nginx_image
      container_name: tols_nginx_container
      ports:
      - "9012:80"
      - "9013:443"
      restart: always
      volumes:
      - certbot-webroot-tols:/webroots/tols/.well-known
      - certbot-letsencrypt:/tols/letsencrypt
  
  volumes:
    certbot-webroot-tols:
    certbot-letsencrypt:
  </code></pre>
  
  <p><strong>certbot/Dockerfile:</strong></p>
  
  <pre><code>FROM debian:jessie
  
  RUN apt-get update &amp;&amp; apt-get install -y cron bash wget
  RUN mkdir -p /webroots/tols/.well-known /scripts
  
  WORKDIR /scripts
  COPY certbot-auto certbot-auto
  RUN chmod a+x ./certbot-auto
  RUN /scripts/certbot-auto -n certificates
  COPY register /scripts/
  RUN chmod +x /scripts/register
  
  VOLUME /webroots
  VOLUME /etc/letsencrypt
  RUN echo "0 0 1 * * root /scripts/certbot-auto renew" &gt;/etc/cron.d/certbot
  
  CMD [ "cron", "-f" ]
  </code></pre>
  
  <p><strong>certbot/register</strong>:</p>
  
  <pre><code>#!/bin/sh
  /scripts/certbot-auto certonly --webroot -w /webroots/$1 -d $1
  </code></pre>
  
  <p><strong>nginx/Dockerfile</strong>:</p>
  
  <pre><code>FROM nginx
  COPY nginx.conf /etc/nginx/nginx.conf
  EXPOSE 80
  EXPOSE 443
  </code></pre>
  
  <p><strong>nginx/nginx.conf</strong>:</p>
  
  <pre><code>user  root;
  worker_processes  1;
  error_log  /var/log/nginx-error.log debug;
  pid        /var/run/nginx.pid;
  events {
      worker_connections  1024;
  }
  http {
      include       /etc/nginx/mime.types;
      default_type  application/octet-stream;
      log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" "$http_x_forwarded_for"';
      access_log  /var/log/nginx-access.log  main;
      sendfile        on;
      keepalive_timeout  65;
      server {
          listen 80;
          listen [::]:80 default_server ipv6only=on;
          return 301 https://$host$request_uri;
      }
      server {
          listen 443 ssl http2;
          listen [::]:443 ssl http2;
          server_name tols;
          ssl_certificate /etc/letsencrypt/live/tols/fullchain.pem;
          ssl_certificate_key /etc/letsencrypt/live/tols/privkey.pem;
          location / {
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-NginX-Proxy true;
              proxy_pass http://frontend:3010/;
              proxy_ssl_session_reuse off;
              proxy_set_header Host $http_host;
              proxy_cache_bypass $http_upgrade;
              proxy_redirect off;
          }
          location /.well-known {
              root /webroots/tols/.well-known;
          }
      }
  }
  </code></pre>