You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Mageas 3cc92925fc
Fix: - instead of _ to match the sni dummy cert
5 months ago
certbot POSIX complient 1 year ago
nginx/conf.d Initial commit 1 year ago
LICENSE Add LICENSE 1 year ago Fix: - instead of _ to match the sni dummy cert 5 months ago
docker-compose.yml Remove permissions 1 year ago


Certginx is a helper tool to generate certbot certificates. It is compatible with multiple domains and support multiple applications.

This project is neither affiliated with cerbot nor nginx.

How to use certginx

Configuring firewall

Make sure your firewall allows the incoming 80 and 443 ports.

Open ports with iptables:

iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT

Configuring nginx


Replace all the occurrences of with your domain name.

Rename up-app with up-<app-name>, it may create conflicts if you use the same name between files.

Rename ./nginx/conf.d/ with ./nginx/conf.d/<your-domain>.conf.

Configuring certbot

Every time you want to add a new domain. You need to configure the file below.


Update DOMAINS and EMAIL variables to begin the installation. If you are testing, put STAGING to 1 to avoid hitting request limits.

Executing the script

Run the script with ./certbot/

Configuring after script

Update ./nginx/conf.d/<your-domain>.conf to suit your needs.


Update localhost in up-<app-name> section with the name of your docker container.

Communicating between certginx and your app

I will use example-app as network, you may rename it.


At the end of nginx service, add:

    - example-app

At the end of the file, add:

        external: true

External networks are not automatically created by docker-compose. To do so, just run the command below:

docker network create example-app

You need to do the same thing in your docker-compose.yml app, but instead of nginx service, it will be your communicating service.

Best practice to deploy

The best way to deploy your app with certginx is to create a user per application (eg. user certginx for certgins and user website for your website).

Secure your nginx

Use the latest ssl protocols.

ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers off;

Catch bad sni (replace dummy-certificate with a dummy certificate).

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name _;

    ssl_certificate /etc/letsencrypt/live/dummy-certificate/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dummy-certificate/privkey.pem;

    return 444;

Generate dummy certificate:



SCRIPT_PATH="$( cd "$(dirname "${0}")" >/dev/null 2>&1 ; pwd -P )"

mkdir -p "$SCRIPT_PATH/conf/live/${DUMMY_NAME}"
docker-compose run --rm --entrypoint "\
openssl req -x509 -nodes -newkey rsa:$RSA_KEY_SIZE -days 3650\
    -keyout '/etc/letsencrypt/live/${DUMMY_NAME}/privkey.pem' \
    -out '/etc/letsencrypt/live/${DUMMY_NAME}/fullchain.pem' \
    -subj '/CN=localhost'" certbot \
|| ERROR "Unable to create dummy certificates"

Catch bad vhost.

server {
    listen 80;
    listen [::]:80;
    server_name _;

    return 444;