Answers: <p>Your listen 443 need to have ssl parameter to tell Nginx that all connections accepted on this port should work in SSL mode.</p>
  <p>See example at <a href="https://nginx.org/en/docs/http/configuring_https_servers.html#single_http_https_server" rel="nofollow noreferrer">https://nginx.org/en/docs/http/configuring_https_servers.html#single_http_https_server</a></p>
  <p>Shown here for convenience:</p>
  <pre><code>server {
      listen              80;
      listen              443 ssl;
      server_name         www.example.com;
      ssl_certificate     www.example.com.crt;
      ssl_certificate_key www.example.com.key;
      ...
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2021-02-13T14:26:34.273Z
Answers: 2021-02-13T14:26:34.273Z
Answers: Sharuzzaman Ahmat Raslan
Body: <p>I have a website running at <a href="https://domain.com" rel="nofollow noreferrer">https://domain.com</a> and IP a.a.a.a, with an SSL cert issued by GoDaddy. The server is deployed with Nginx. Everything is working fine as it is.</p>
  <p>However I'm trying to deploy the same website with Docker in a new server with IP b.b.b.b, so I did the following:</p>
  <ol>
  <li>Pull nginx image from Docker</li>
  <li><strong>Copy the domain.com.chained.crt and domain.com.key files from server a.a.a.a to server b.b.b.b</strong></li>
  <li>In the Docker file, I copy the cert files to the image</li>
  <li>When I run the container and check nginx with <code>nginx -t</code>, it seems to be working fine.</li>
  <li>Ports 443 and 80 are open for external requests</li>
  <li>I check that the website is running by accessing to b.b.b.b:80 from an external client</li>
  <li>Configure the DNS to resolve to b.b.b.b instead of a.a.a.a</li>
  <li>Check that <a href="http://domain.com" rel="nofollow noreferrer">http://domain.com</a> is working</li>
  </ol>
  <p>Up to that point everything is working fine. But when I try to access <a href="https://domain.com" rel="nofollow noreferrer">https://domain.com</a> I get the following errors:</p>
  <ul>
  <li>With firefox: ERR_SSL_PROTOCOL_ERROR</li>
  <li>With chrome: SSL_ERROR_RX_RECORD_TOO_LONG</li>
  <li>The site <a href="https://www.sslshopper.com/ssl-checker.html" rel="nofollow noreferrer">https://www.sslshopper.com/ssl-checker.html</a> tells me this: <code>No SSL certificates were found on domain.com. Make sure that the name resolves to the correct server and that the SSL port (default is 443) is open on your server's firewall.</code></li>
  </ul>
  <p>The Nginx error logs don't tell me much, although I have them in debug mode.</p>
  <p>My main question is: Can I copy the cert files from one server to another or do I have to generate them again?</p>
  <p>Edit:
  This is the docker-compose.yml</p>
  <pre><code>sevices:  
    nginx:
      build: ./nginx
      image: nginx
      ports:
        - &quot;80:80&quot;
        - &quot;443:443&quot;
    redis:
      image: redis
      ports: 
        - &quot;6379:6379&quot;
    mongo:
      image: mongo
      ports: 
        - &quot;27017:27017&quot;
      volumes:
        - /var/mongodata:/data/db
  </code></pre>
  <p>Dockerfile</p>
  <pre><code>FROM custom:latest
  
  COPY nginx.conf /etc/nginx/nginx.conf
  COPY /ssl/domain.com.key /etc/nginx/ssl/domain.com.key
  COPY /ssl/domain.com.chained.crt /etc/nginx/ssl/domain.com.chained.crt
  
  
  RUN apt-get -y install nodejs libssl1.0-dev  nodejs-dev node-gyp npm  
  [...]
  CMD [&quot;nginx&quot;, &quot;-g&quot;, &quot;daemon off;&quot;]
  </code></pre>
  <p>nginx.conf</p>
  <pre><code>user www-data;
  worker_processes auto;
  pid /run/nginx.pid;
  include /etc/nginx/modules-enabled/*.conf;
  
  events {
      worker_connections 768;
      # multi_accept on;
  }
  
  http {
  
      ##
      # Basic Settings
      ##
  
      sendfile on;
      tcp_nopush on;
      tcp_nodelay on;
      keepalive_timeout 65;
      types_hash_max_size 2048;
      # server_tokens off;
  
      # server_names_hash_bucket_size 64;
      # server_name_in_redirect off;
  
      include /etc/nginx/mime.types;
      default_type application/octet-stream;
  
      ##
      # SSL Settings
      ##
  
      ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
      ssl_prefer_server_ciphers on;
  
      ##
      # Logging Settings
      ##
  
      access_log /var/log/nginx/access.log;
      error_log /var/log/nginx/error.log debug;
  
      ##
      # Gzip Settings
      ##
  
      gzip on;
  
      # gzip_vary on;
      # gzip_proxied any;
      # gzip_comp_level 6;
      # gzip_buffers 16 8k;
      # gzip_http_version 1.1;
      # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
  
      ##
      # Virtual Host Configs
      ##
  
      include /etc/nginx/conf.d/*.conf;
      #include /etc/nginx/sites-enabled/*;
  
      server {
          listen 80;
          listen [::]:80;
          listen 443;
                  
          server_name www.domain.com;
          ssl_certificate /etc/nginx/ssl/domain.com.chained.crt;
          ssl_certificate_key /etc/nginx/ssl/domain.com.key;
  
          location / {
              root /domain.com/;
              try_files $uri$args $uri$args/ /index.html;
          }
      }
  }
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2021-02-12T18:41:30.150Z
Comments: what is the command that you use to start your docker container?
Comments: Sharuzzaman Ahmat Raslan
Comments: CC BY-SA 4.0
Comments: 2021-02-12T18:43:37.403Z
Comments: I use "docker-compose up -d" and the image has this command: CMD ["nginx", "-g", "daemon off;"]
Comments: puma91
Comments: CC BY-SA 4.0
Comments: 2021-02-12T18:46:52.923Z
Comments: please update the question with your docker-compose.yml file
Comments: Sharuzzaman Ahmat Raslan
Comments: CC BY-SA 4.0
Comments: 2021-02-12T18:53:26.980Z
Comments: I just updated the question.
Comments: puma91
Comments: CC BY-SA 4.0
Comments: 2021-02-12T18:58:00.250Z
Comments: Also added the Dockerfile and nginx.conf
Comments: puma91
Tags: <docker><nginx><ssl>
Title: Can I move SSL certificate files from one server to another for the same domain?
UserDisplayName: puma91
ThreadText: # Can I move SSL certificate files from one server to another for the same domain?
  
  (Asked by: username_0 on 2021-02-12)
  
  I have a website running at <https://domain.com> and IP a.a.a.a, with an SSL cert issued by GoDaddy. The server is deployed with Nginx. Everything is working fine as it is.
  
  However I'm trying to deploy the same website with Docker in a new server with IP b.b.b.b, so I did the following:
  
  1. Pull nginx image from Docker
  2. **Copy the domain.com.chained.crt and domain.com.key files from server a.a.a.a to server b.b.b.b**
  3. In the Docker file, I copy the cert files to the image
  4. When I run the container and check nginx with `nginx -t`, it seems to be working fine.
  5. Ports 443 and 80 are open for external requests
  6. I check that the website is running by accessing to b.b.b.b:80 from an external client
  7. Configure the DNS to resolve to b.b.b.b instead of a.a.a.a
  8. Check that <http://domain.com> is working
  
  Up to that point everything is working fine. But when I try to access <https://domain.com> I get the following errors:
  
  * With firefox: ERR\_SSL\_PROTOCOL\_ERROR
  * With chrome: SSL\_ERROR\_RX\_RECORD\_TOO\_LONG
  * The site <https://www.sslshopper.com/ssl-checker.html> tells me this: `No SSL certificates were found on domain.com. Make sure that the name resolves to the correct server and that the SSL port (default is 443) is open on your server's firewall.`
  
  The Nginx error logs don't tell me much, although I have them in debug mode.
  
  My main question is: Can I copy the cert files from one server to another or do I have to generate them again?
  
  Edit:
  This is the docker-compose.yml
  
  ```
  sevices:  
    nginx:
      build: ./nginx
      image: nginx
      ports:
        - "80:80"
        - "443:443"
    redis:
      image: redis
      ports: 
        - "6379:6379"
    mongo:
      image: mongo
      ports: 
        - "27017:27017"
      volumes:
        - /var/mongodata:/data/db
  
  ```
  
  Dockerfile
  
  ```
  FROM custom:latest
  
  COPY nginx.conf /etc/nginx/nginx.conf
  COPY /ssl/domain.com.key /etc/nginx/ssl/domain.com.key
  COPY /ssl/domain.com.chained.crt /etc/nginx/ssl/domain.com.chained.crt
  
  RUN apt-get -y install nodejs libssl1.0-dev  nodejs-dev node-gyp npm  
  [...]
  CMD ["nginx", "-g", "daemon off;"]
  
  ```
  
  nginx.conf
  
  ```
  user www-data;
  worker_processes auto;
  pid /run/nginx.pid;
  include /etc/nginx/modules-enabled/*.conf;
  
  events {
      worker_connections 768;
      # multi_accept on;
  }
  
  http {
  
      ##
      # Basic Settings
      ##
  
      sendfile on;
      tcp_nopush on;
      tcp_nodelay on;
      keepalive_timeout 65;
      types_hash_max_size 2048;
      # server_tokens off;
  
      # server_names_hash_bucket_size 64;
      # server_name_in_redirect off;
  
      include /etc/nginx/mime.types;
      default_type application/octet-stream;
  
      ##
      # SSL Settings
      ##
  
      ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
      ssl_prefer_server_ciphers on;
  
      ##
      # Logging Settings
      ##
  
      access_log /var/log/nginx/access.log;
      error_log /var/log/nginx/error.log debug;
  
      ##
      # Gzip Settings
      ##
  
      gzip on;
  
      # gzip_vary on;
      # gzip_proxied any;
      # gzip_comp_level 6;
      # gzip_buffers 16 8k;
      # gzip_http_version 1.1;
      # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
  
      ##
      # Virtual Host Configs
      ##
  
      include /etc/nginx/conf.d/*.conf;
      #include /etc/nginx/sites-enabled/*;
  
      server {
          listen 80;
          listen [::]:80;
          listen 443;
                  
          server_name www.domain.com;
          ssl_certificate /etc/nginx/ssl/domain.com.chained.crt;
          ssl_certificate_key /etc/nginx/ssl/domain.com.key;
  
          location / {
              root /domain.com/;
              try_files $uri$args $uri$args/ /index.html;
          }
      }
  }
  
  ```
  
  **Tags:** docker, nginx, ssl
  
  > **Comments:**
  > **username_1**: what is the command that you use to start your docker container?  
  > **username_0**: I use "docker-compose up -d" and the image has this command: CMD ["nginx", "-g", "daemon off;"]  
  > **username_1**: please update the question with your docker-compose.yml file  
  > **username_0**: I just updated the question.  
  > **username_0**: Also added the Dockerfile and nginx.conf  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-02-13. Score: 1 | Accepted answer
  
  Your listen 443 need to have ssl parameter to tell Nginx that all connections accepted on this port should work in SSL mode.
  
  See example at <https://nginx.org/en/docs/http/configuring_https_servers.html#single_http_https_server>
  
  Shown here for convenience:
  
  ```
  server {
      listen              80;
      listen              443 ssl;
      server_name         www.example.com;
      ssl_certificate     www.example.com.crt;
      ssl_certificate_key www.example.com.key;
      ...
  }
  
  ```
  
  
  ---
  
  