SSL certificate not trusted. Certbot - docker

Question

I generated the certificate using Cert bat, there were no errors, configured nginx, does not allow https access to the site.
My nginx.conf
server {
listen 80;
server_name cars4me.ru;
server_tokens off;
root /var/www/html;
index index.php;
#location /.well-known/acme-challenge/ {
# root /var/www/certbot;
#}
location ^~ /.well-known/acme-challenge {
root /var/www/certbot;
default_type "text/plain";
try_files $uri =404;
}
#location / {
# try_files $uri $uri/ /index.php?$args;
#}
location / {
return 301 https://$host$request_uri;
}
}
server {
listen 443 ssl;
server_name cars4me.ru;
server_tokens off;
root /var/www/html;
index index.php;
ssl_certificate /etc/letsencrypt/live/cars4me.ru/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/cars4me.ru/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ /index.php?$args;
}
# pass the PHP scripts to FastCGI server listening on wordpress:9000
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass wordpress:9000;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
}
}
My docker-compose.yml
version: '3'
services:
wordpress-db:
image: mysql:5.7
volumes:
- ../db:/var/lib/mysql
environment:
MYSQL_ROOT_PASSWORD: somewordpress
MYSQL_DATABASE: wordpress
MYSQL_USER: wordpress
MYSQL_PASSWORD: wordpress
restart: always
wordpress:
image: wordpress:php7.4-fpm-alpine
volumes:
- ../src:/var/www/html
- ../conf:/usr/local/etc/php
depends_on:
- wordpress-db
environment:
WORDPRESS_DB_HOST: wordpress-db:3306
WORDPRESS_DB_NAME: wordpress
WORDPRESS_DB_USER: wordpress
WORDPRESS_DB_PASSWORD: wordpress
links:
- wordpress-db
restart: always
user: "33:82"
nginx:
image: nginx:alpine
volumes:
- ../nginx:/etc/nginx/conf.d
- ../src:/var/www/html
- ./data/certbot/conf:/etc/letsencrypt
- ./data/certbot/www:/var/www/certbot
ports:
- 80:80
- 443:443
links:
- wordpress
command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
certbot:
image: certbot/certbot
volumes:
- ./data/certbot/conf:/etc/letsencrypt
- ./data/certbot/www:/var/www/certbot
entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
My init-letsencrypt.sh
version: '3'
services:
wordpress-db:
image: mysql:5.7
volumes:
- ../db:/var/lib/mysql
environment:
MYSQL_ROOT_PASSWORD: somewordpress
MYSQL_DATABASE: wordpress
MYSQL_USER: wordpress
MYSQL_PASSWORD: wordpress
restart: always
wordpress:
image: wordpress:php7.4-fpm-alpine
volumes:
- ../src:/var/www/html
- ../conf:/usr/local/etc/php
depends_on:
- wordpress-db
environment:
WORDPRESS_DB_HOST: wordpress-db:3306
WORDPRESS_DB_NAME: wordpress
WORDPRESS_DB_USER: wordpress
WORDPRESS_DB_PASSWORD: wordpress
links:
- wordpress-db
restart: always
user: "33:82"
nginx:
image: nginx:alpine
volumes:
- ../nginx:/etc/nginx/conf.d
- ../src:/var/www/html
- ./data/certbot/conf:/etc/letsencrypt
- ./data/certbot/www:/var/www/certbot
ports:
- 80:80
- 443:443
links:
- wordpress
command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
certbot:
image: certbot/certbot
volumes:
- ./data/certbot/conf:/etc/letsencrypt
- ./data/certbot/www:/var/www/certbot
entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
root#enid:/home/bitbucket/www/wordpress/docker3# ls
data docker-compose.yml init-letsencrypt.sh
root#enid:/home/bitbucket/www/wordpress/docker3# cat init-letsencrypt.sh
#!/bin/bash
if ! [ -x "$(command -v docker-compose)" ]; then
echo 'Error: docker-compose is not installed.' >&2
exit 1
fi
domains=(cars4me.ru www.cars4me.ru)
rsa_key_size=4096
data_path="./data/certbot"
email="deemax3x3#mail.ru" # Adding a valid address is strongly recommended
staging=1 # Set to 1 if you're testing your setup to avoid hitting request limits
if [ -d "$data_path" ]; then
read -p "Existing data found for $domains. Continue and replace existing certificate? (y/N) " decision
if [ "$decision" != "Y" ] && [ "$decision" != "y" ]; then
exit
fi
fi
if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then
echo "### Downloading recommended TLS parameters ..."
mkdir -p "$data_path/conf"
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf"
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem"
echo
fi
echo "### Creating dummy certificate for $domains ..."
path="/etc/letsencrypt/live/$domains"
mkdir -p "$data_path/conf/live/$domains"
docker-compose run --rm --entrypoint "\
openssl req -x509 -nodes -newkey rsa:$rsa_key_size -days 1\
-keyout '$path/privkey.pem' \
-out '$path/fullchain.pem' \
-subj '/CN=localhost'" certbot
echo
echo "### Starting nginx ..."
docker-compose up --force-recreate -d nginx
echo
echo "### Deleting dummy certificate for $domains ..."
docker-compose run --rm --entrypoint "\
rm -Rf /etc/letsencrypt/live/$domains && \
rm -Rf /etc/letsencrypt/archive/$domains && \
rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot
echo
echo "### Requesting Let's Encrypt certificate for $domains ..."
#Join $domains to -d args
domain_args=""
for domain in "${domains[#]}"; do
domain_args="$domain_args -d $domain"
done
# Select appropriate email arg
case "$email" in
"") email_arg="--register-unsafely-without-email" ;;
*) email_arg="--email $email" ;;
esac
# Enable staging mode if needed
if [ $staging != "0" ]; then staging_arg="--staging"; fi
docker-compose run --rm --entrypoint "\
certbot certonly -v --webroot -w /var/www/certbot \
$staging_arg \
$email_arg \
$domain_args \
--rsa-key-size $rsa_key_size \
--agree-tos \
--force-renewal" certbot
echo
echo "### Reloading nginx ..."
docker-compose exec nginx nginx -s reload
When i start bash init-letsencrypt.sh there no errors:
Existing data found for cars4me.ru. Continue and replace existing certificate? (y/N) y
Creating dummy certificate for cars4me.ru ...
Creating docker3_certbot_run ... doneGenerating a RSA private key.....................++++....................................................................................................................................++++writing new private key to '/etc/letsencrypt/live/cars4me.ru/privkey.pem'
Starting nginx ...
Recreating docker3_wordpress-db_1 ... doneRecreating docker3_wordpress_1 ... doneRecreating docker3_nginx_1 ... done
Deleting dummy certificate for cars4me.ru ...
Creating docker3_certbot_run ... done
Requesting Let's Encrypt certificate for cars4me.ru ...
Creating docker3_certbot_run ... doneSaving debug log to /var/log/letsencrypt/letsencrypt.logPlugins selected: Authenticator webroot, Installer NoneRequesting a certificate for cars4me.ru and www.cars4me.ru
Successfully received certificate.Certificate is saved at: /etc/letsencrypt/live/cars4me.ru/fullchain.pemKey is saved at: /etc/letsencrypt/live/cars4me.ru/privkey.pemThis certificate expires on 2023-02-13.These files will be updated when the certificate renews.
NEXT STEPS:
The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.
Reloading nginx ...
2022/11/15 09:34:02 [notice] 10#10: signal process started
I check SSL in ssllabs.com and saw not trusted:
enter image description here
What could be the problem?