title: Certbot command in docker-compose issues SSL certificate with invalid CA
body: <h1>The problem</h1>
  <p>I'm trying to use <code>certbot</code> to auto-generate a TLS certificate for Nginx in my multi-container Docker configuration. Everything works as expected except the Certificate Authority (CA) is invalid.</p>
  <p>When I visit my site, I see that <code>Fake LE Intermediate X1</code>, an invalid authority, issued the certificate:</p>
  <p><a href="https://i.stack.imgur.com/56LwT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/56LwT.png" alt="enter image description here" /></a></p>
  <h2>My setup</h2>
  <p>Here is the <strong>docker-compose.yml</strong> file where I call <code>certbot</code> to generate the certificate:</p>
  <pre><code>version: '2'
  services:
    apollo:
      restart: always
      networks:
        - app-network
      build: .
      ports:
        - '1337:1337'
    certbot:
      image: certbot/certbot
      container_name: certbot
      volumes:
        - certbot-etc:/etc/letsencrypt
        - certbot-var:/var/lib/letsencrypt
        - web-root:/var/www/html
      depends_on:
        - webserver
      command: certonly --noninteractive --keep-until-expiring --webroot --webroot-path=/var/www/html --email myemail@example.com --agree-tos --no-eff-email -d mydomain.com
    webserver:
      image: nginx:latest
      container_name: webserver
      restart: unless-stopped
      ports:
        - &quot;80:80&quot;
        - &quot;443:443&quot;
      volumes:
        - web-root:/var/www/html
        - ./nginx.conf:/etc/nginx/nginx.conf
        - certbot-etc:/etc/letsencrypt
        - certbot-var:/var/lib/letsencrypt
        - dhparam:/etc/ssl/certs
      depends_on:
        - apollo
      networks:
        - app-network
  
  volumes:
    postgres: ~
    certbot-etc:
    certbot-var:
    dhparam:
      driver: local
      driver_opts:
        type: none
        device: /home/user/project_name/dhparam/
        o: bind
    web-root:
  
  networks:
    app-network:
  </code></pre>
  <p>I don't <em>think</em> that Nginx is the issue because the HTTP -&gt; HTTPS redirect works, and the browser receives a certificate. But just in case it's relevant: here's the <strong>nginx.conf</strong> where I refer to the certificate and configure an HTTP -&gt; HTTPS redirect.</p>
  <pre><code>events {}
  http {
    server {
      listen 80;
      listen [::]:80;
      server_name mydomain.com;
  
      location ~ /.well-known/acme-challenge {
        allow all;
        root /var/www/html;
      }
  
      location / {
        rewrite ^ https://$host$request_uri? permanent;
      }
    }
  
    server {
      listen 443 ssl http2;
      listen [::]:443 ssl http2;        
      server_name mydomain.com;
  
      server_tokens off;
  
      ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;
  
      ssl_buffer_size 8k;
  
      ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
  
      ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
      ssl_prefer_server_ciphers on;
  
      ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
  
      ssl_ecdh_curve secp384r1;
      ssl_session_tickets off;
  
      ssl_stapling on;
      ssl_stapling_verify on;
      resolver 8.8.8.8;
  
      location / {
        try_files $uri @apollo;
      }
  
      location @apollo {
        proxy_pass http://apollo:1337;
        add_header X-Frame-Options &quot;SAMEORIGIN&quot; always;
        add_header X-XSS-Protection &quot;1; mode=block&quot; always;
        add_header X-Content-Type-Options &quot;nosniff&quot; always;
        add_header Referrer-Policy &quot;no-referrer-when-downgrade&quot; always;
        add_header Content-Security-Policy &quot;default-src * data: 'unsafe-eval' 'unsafe-inline'&quot; always;
      }
  
      root /var/www/html;
      index index.html index.htm index.nginx-debian.html;
    }
  }
  </code></pre>
  <h2>What I've tried</h2>
  <ol>
  <li><p>Initially, I called <code>certonly</code> with the <code>--staging</code> argument in the <code>cerbot</code> container definition in <code>docker-compose.yml</code>. This could definitely cause the invalid CA problem. However, I have since tried revoking the CA and re-running the command multiple times, but no luck.</p>
  </li>
  <li><p>I have tried removing the <code>--keep-until-expiring</code> flag in the <code>cerbot</code> container definition of <code>docker-compose.yml</code>. This causes <code>cerbot</code> to generate a new certificate, but it did not resolve the CA issue.</p>
  </li>
  <li><p>Visiting <a href="https://crt.sh/" rel="nofollow noreferrer">crt.sh</a>, I can see that certbot did issue valid certificates for my domain:</p>
  </li>
  </ol>
  <p><a href="https://i.stack.imgur.com/AD1QE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/AD1QE.png" alt="enter image description here" /></a></p>
  <p>So, the problem seems to lie not in the generation of these certificates, but in the way my docker-compose/cerbot configuration is referring to them.</p>