Docker-letsencrypt-nginx-proxy-companion: How to explicitly not create a SAN certificate?

[erikverheij]

Is it possible to instruct the companion to create one certificate per domain? In our setup it's preferable as we don't want www.example.org to be dependent on the availability of example.com.

- VIRTUAL_HOST=www.example.org,example.org,www.example.com,example.com
- LETSENCRYPT_HOST=www.example.org,example.org,www.example.com,example.com

[buchdag]

Unfortunately no, that's not possible at the moment, but that might be a use case for the experimental standalone cert feature, if you are willing to give it a try.

[mastef]

Just came here looking for this 👍 Would be great, so we wouldn't have to have 100 containers with one customer cert each, but one container that can handle 100 domains that have different certs. ( We have a client-side SPA - every client is being served the same read only html content, just on their own domain )

[ivonoppen]

I have a similar situation as above, where multiple domains point indeed to one container but I would like to get separate certs (or at least only a san for x.com / www.x.com and y.com / www.y.com).
_Note: x.com / y.com are obviously replacements of other domains I'm using for this setup._

First of all, it does work and each domain in the container seems to be served the right certificate. However, something is still going wrong as the nginx-proxy logs will show the following for each of the domains in the standalone certs file:

nginx-proxy        | 2019/01/05 14:13:10 [warn] 1#1: conflicting server name "x.com" on 0.0.0.0:80, ignored
nginx-proxy        | 2019/01/05 14:13:10 [warn] 1#1: conflicting server name "www.x.com" on 0.0.0.0:80, ignored
(... snip ...)

Container in docker-compose.yml with environment variables:

environment:
  - VIRTUAL_HOST=x.com,www.x.com,y.com,www.y.com

Config for the standalone certs:

LETSENCRYPT_STANDALONE_CERTS=('x' 'y')
LETSENCRYPT_x_HOST=('x.com' 'www.x.com')
[email protected]
LETSENCRYPT_y_HOST=('y.com' 'www.y.com')
[email protected]

Not sure if this is one of the intended purposes of the standalone certificates. However, if it is, this might be something that has to be checked against the virtual hosts before adding to the nginx configuration.

[buchdag]

@ivolution643 thanks for spotting that, I've just pushed a version of dev that should take care of it (it does according to the short test I did).

Don't hesitate to try again with the fixed version and to report back (just wait for the new dev tag autobuild to complete on Dockerhub).

[buchdag]

Feature added by @SilverFire in #647