Docker环境下Certbot域名认证失败问题求助

错误信息 #

Certbot failed to authenticate some domains (authenticator: webroot).
The Certificate Authority reported these problems:
Domain: dev-core-app.example.com
Type: unauthorized
Detail: 100.100.100.100: Invalid response from http://dev-core-app.example.com/.well-known/acme-challenge/XyWgWZVTZgMzvYjFCYVVypLNeDhgE1lNFVN2U0eaubk: 404

Domain: www.dev-core-app.example.com
Type: unauthorized
Detail: 100.100.100.100: Invalid response from http://www.dev-core-app.example.com/.well-known/acme-challenge/OnGprMCbHeQRdas5cST7bsYNpa762PwaDLLrsU2H7Bg: 404

当前配置 #

Nginx配置文件 #

server {
    listen 80;

    server_name dev-core-app.example.com;
    server_tokens off;
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";

    error_log /var/log/nginx/sdr-fe-nginx-error.log info;
    access_log /var/log/nginx/sdr-fe-nginx-access.log;

    ignore_invalid_headers off;
    underscores_in_headers on;

    # Allow larger than normal headers
    large_client_header_buffers 4 64k;
    proxy_buffers         8 16k;  # Buffer pool = 8 buffers of 16k
    proxy_buffer_size     16k;    # 16k of buffers from pool used for headers
    

    location /.well-known/acme-challenge/ {
        rewrite ^/\.well-known/acme-challenge(.*) $1 break;
        root /var/www/certbot;
    } 
    location /{
        proxy_pass http://gateway_us/;
        proxy_set_header Authorization $http_authorization;
        proxy_pass_header Authorization; 
        proxy_set_header Host $http_host;
    }
}

Docker Compose配置 #

nginx:
    environment:
      - TZ=Asia/Singapore
    image: nginx:latest
    ports:
      - "80:80"
      - "443:443"
    restart: unless-stopped
    networks: 
    - ${NETWORK}
    volumes:
      - ./fe_nginx:/etc/nginx/conf.d
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
      - ./data/certbot/conf:/etc/letsencrypt
      - ./data/certbot/www:/var/www/certbot

  certbot:
    image: certbot/certbot
    volumes:
      - ./data/certbot/conf:/etc/letsencrypt
      - ./data/certbot/www:/var/www/certbot

问题分析与解决步骤 #

1. 修正ACME验证路径的Rewrite规则 #

你的Nginx配置中，/.well-known/acme-challenge/的rewrite规则错误，导致Nginx无法找到Certbot生成的验证文件：

• Certbot会将验证文件写入/var/www/certbot/.well-known/acme-challenge/目录下
• 你的rewrite规则会把请求路径从/.well-known/acme-challenge/xxx改为xxx，导致Nginx去/var/www/certbot/xxx查找文件，而非正确的路径

修改后的location块：

location /.well-known/acme-challenge/ {
    root /var/www/certbot;
    allow all;
}

2. 添加www域名的Server配置 #

错误信息显示Let's Encrypt同时验证了dev-core-app.example.com和www.dev-core-app.example.com，但你的Nginx配置仅处理了主域名，导致www域名的验证请求返回404。

更新server_name行：

server_name dev-core-app.example.com www.dev-core-app.example.com;

3. 确保证书申请命令包含所有域名 #

检查init-letsencrypt.sh脚本中的Certbot命令，确认同时包含主域名和www域名，例如：

certbot certonly --webroot -w /var/www/certbot \
  -d dev-core-app.example.com -d www.dev-core-app.example.com

4. 重启Nginx并重新申请证书 #

• 重启Nginx容器加载新配置：

docker-compose restart nginx

• 重新运行init-letsencrypt.sh脚本发起证书申请

内容的提问来源于stack exchange，提问作者JianYA