title: Reverse proxy cannot load ssl certificates
body: <p>I am trying to run an nginx proxy in a docker container, coupled to a letsencrypt container that generates and updates the certificates.</p>
  <p>Without ssl enabled the configuration runs fine
  with ssl enabled i get the following error</p>
  <blockquote>
  <p>emerg] 1#1: cannot load certificate &quot;/etc/ssl/private/fullchain.pem&quot;:
  BIO_new_file() failed (SSL: error:02001002:system library:fopen:No
  such file or directory:fopen('/etc/ssl/private/fullchain.pem','r')
  error:2006D080:BIO routines:BIO_new_file:no such file) reverse_proxy<br />
  | nginx: [emerg] cannot load certificate
  &quot;/etc/ssl/private/fullchain.pem&quot;: BIO_new_file() failed (SSL:
  error:02001002:system library:fopen:No such file or
  directory:fopen('/etc/ssl/private/fullchain.pem','r')
  error:2006D080:BIO routines:BIO_new_file:no such file)</p>
  </blockquote>
  <p>the following is my configuration</p>
  <p><strong>/conf.d/sites-avaidable/heimdall.conf</strong></p>
  <pre><code>  upstream heimdall {
    server        192.168.178.215:8888;
  }
  
  server {
    listen        443 ssl;
    #listen       80;
    server_name   heimdall.domain.tld;
  
     include      common.conf;
     include      /etc/nginx/ssl.conf;
  
    location / {
      proxy_pass  http://192.168.178.215:8888;
      include     common_location.conf;
  
    }
  }
  </code></pre>
  <p>And from /etc/nginx</p>
  <p><strong>nginx.conf</strong></p>
  <pre><code>user  nginx;
  worker_processes  1;
  
  error_log  /var/log/nginx/error.log warn;
  pid        /var/run/nginx.pid;
  
  
  events {
      worker_connections  1024;
  }
  
  
  http {
      include       /etc/nginx/mime.types;
      default_type  application/octet-stream;
  
      log_format  main  '$remote_addr - $remote_user [$time_local] &quot;$request&quot; '
                        '$status $body_bytes_sent &quot;$http_referer&quot; '
                        '&quot;$http_user_agent&quot; &quot;$http_x_forwarded_for&quot;';
  
      access_log  /var/log/nginx/access.log  main;
  
      sendfile        on;
      #tcp_nopush     on;
  
      keepalive_timeout  65;
  
      #gzip  on;
  
      include /etc/nginx/conf.d/sites-enabled/*.conf;
  }
  </code></pre>
  <p><strong>common.conf</strong></p>
  <pre><code>add_header Strict-Transport-Security    &quot;max-age=31536000; includeSubDomains&quot; always;
  add_header X-Frame-Options              SAMEORIGIN;
  add_header X-Content-Type-Options       nosniff;
  add_header X-XSS-Protection             &quot;1; mode=block&quot;;
  </code></pre>
  <p><strong>common_location.conf</strong></p>
  <pre><code>proxy_set_header    X-Real-IP           $remote_addr;
  proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
  proxy_set_header    X-Forwarded-Proto   $scheme;
  proxy_set_header    Host                $host;
  proxy_set_header    X-Forwarded-Host    $host;
  proxy_set_header    X-Forwarded-Port    $server_port;
  </code></pre>
  <p>ssl.conf</p>
  <pre><code>ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
  ssl_ecdh_curve              secp384r1;
  ssl_ciphers                 &quot;ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384 OLD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 OLD_TLS_ECDHE_RSA_WITH_CH$
  ssl_prefer_server_ciphers   on;
  ssl_dhparam                 /etc/nginx/dhparams.pem;
  ssl_certificate             /etc/ssl/private/fullchain.pem;
  ssl_certificate_key         /etc/ssl/private/privkey.pem;
  ssl_session_timeout         10m;
  ssl_session_cache           shared:SSL:10m;
  ssl_session_tickets         off;
  ssl_stapling                on;
  ssl_stapling_verify         on;
  </code></pre>
  <p>/etc/ssl/private is filled with symlinks to the certificates, that are generated by another docker container.
  mounting  the directory directly leads to the exact same behaviour.</p>
  <p>Here is the folder that is mounted at /etc/ssl/private</p>
  <pre><code>total 28
  drwxr-xr-x 2 pi pi 4096 juin  22 20:19 .
  drwxr-xr-x 4 pi pi 4096 juin  22 22:39 ..
  lrwxrwxrwx 1 pi pi   69 juin  22 20:19 cert.pem -&gt; /home/pi/letsencrypt/config/etc/letsencrypt/live/site.tld/cert.pem
  lrwxrwxrwx 1 pi pi   70 juin  22 20:19 chain.pem -&gt; /home/pi/letsencrypt/config/etc/letsencrypt/live/site.tld/chain.pem
  lrwxrwxrwx 1 pi pi   74 juin  22 20:19 fullchain.pem -&gt; /home/pi/letsencrypt/config/etc/letsencrypt/live/site.tld/fullchain.pem
  lrwxrwxrwx 1 pi pi   72 juin  22 20:19 privkey.pem -&gt; /home/pi/letsencrypt/config/etc/letsencrypt/live/site.tld/privkey.pem
  lrwxrwxrwx 1 pi pi   67 juin  22 20:19 README -&gt; /home/pi/letsencrypt/config/etc/letsencrypt/live/site.tld/README
  </code></pre>
  <p>and here is the symlink target folder</p>
  <pre><code>total 12
  drwxr-xr-x 2 pi pi 4096 juin  22 16:03 .
  drwx------ 4 pi pi 4096 juin  22 16:23 ..
  lrwxrwxrwx 1 pi pi   35 juin  22 16:03 cert.pem -&gt; ../../archive/site.tld/cert1.pem
  lrwxrwxrwx 1 pi pi   36 juin  22 16:03 chain.pem -&gt; ../../archive/site.tld/chain1.pem
  lrwxrwxrwx 1 pi pi   40 juin  22 16:03 fullchain.pem -&gt; ../../archive/site.tld/fullchain1.pem
  lrwxrwxrwx 1 pi pi   38 juin  22 16:03 privkey.pem -&gt; ../../archive/site.tld/privkey1.pem
  -rw-r--r-- 1 pi pi  692 juin  22 16:03 README
  </code></pre>
  <p>and here is a ls -la from a terminal inside the container</p>
  <pre><code>root@reverse_proxy:/etc/ssl/private# ls -la
  total 12
  drwxr-xr-x 2 1000 1000 4096 Jun 22 14:03 .
  drwxr-xr-x 4 root root 4096 Jun  9 05:06 ..
  -rw-r--r-- 1 1000 1000  692 Jun 22 14:03 README
  lrwxrwxrwx 1 1000 1000   35 Jun 22 14:03 cert.pem -&gt; ../../archive/site.tld/cert1.pem
  lrwxrwxrwx 1 1000 1000   36 Jun 22 14:03 chain.pem -&gt; ../../archive/site.tld/chain1.pem
  lrwxrwxrwx 1 1000 1000   40 Jun 22 14:03 fullchain.pem -&gt; ../../archive/site.tld/fullchain1.pem
  lrwxrwxrwx 1 1000 1000   38 Jun 22 14:03 privkey.pem -&gt; ../../archive/site.tld/privkey1.pem
  </code></pre>
  <p>I do hope someone can point me in the right direction
  i searched and searched, regenerated my dhparams.pem but nothing i find seems to fix my issue.</p>