1. 查看80端口sudo lsof -i :80 sudo pkill nginx2. 啟動 80 測試程序啟動Ubuntu的Nginx服務 sudo systemctl start nginx 啟動docker的80服務無效可以嘗試做端口映射可能行但是沒有嘗試過 測試過不行因為Lets Encrypt 無法重啟docker裡面的Nginx。 vb_build_myerp_local3. 生成證書如果之前做過證書讓certbot重新生成 sudo certbot renew生成的證書文件如下4. Copy 證書到工程目錄將cp symlink過去 sudo cp -a /etc/letsencrypt/live/erp.vital-base.com/. /opt/workspace/worker_**/ssl2/ #正確 cp privkey.pem fullchain.pem cert.pem chain.pem /opt/workspace/worker_**/ssl2/5. 啟動nginx 443停掉所有的80端口開啟443服務。6. 檢查docker通過-a 包括啟動失敗的docker docker ps -a | grep myerp-vue3 查看docker內的證書 docker exec myerp-vue3 ls -l /etc/ssl/myerp/ 查看docker內的nginx docker exec myerp-vue3 nginx -t7. 關於symlinks的問題如果cp過去只是一個鏈接docker將無法獲得證書刪除symlink rm -f /opt/workspace/worker_myerp/ssl2/privkey.pem rm -f /opt/workspace/worker_myerp/ssl2/fullchain.pem rm -f /opt/workspace/worker_myerp/ssl2/cert.pem rm -f /opt/workspace/worker_myerp/ssl2/chain.pem copy後再次check ls -lah /opt/workspace/worker_***/ssl2/8. 簡要說明Ubuntu默認的nginx路徑 /etc/nginx/sites-available#Let’s Encrypt的配置路徑 /etc/letsencrypt/renewal #Let’s Encrypt 生成證書後的存放路徑 /etc/letsencrypt/liveapp.abc.com.conf文件# renew_before_expiry 30 days version 1.21.0 archive_dir /etc/letsencrypt/archive/erp.vital-base.com cert /etc/letsencrypt/live/erp.vital-base.com/cert.pem privkey /etc/letsencrypt/live/erp.vital-base.com/privkey.pem chain /etc/letsencrypt/live/erp.vital-base.com/chain.pem fullchain /etc/letsencrypt/live/erp.vital-base.com/fullchain.pem # Options used in the renewal process [renewalparams] account your account authenticator username webroot_path /var/www/html, server https://acme-v02.api.letsencrypt.org/directory [[webroot_map]] erp.vital-base.com /var/www/html