docker compose中的Certbot命令发出具有无效CA的SSL证书 问题

我正在尝试使用

certbot

在我的多容器Docker配置中为Nginx自动生成TLS证书。除证书颁发机构（CA）无效外，一切正常

当我访问我的站点时，我看到一个无效的权威机构

Fake LE Intermediate X1

，颁发了证书：

version: '2'
services:
  apollo:
    restart: always
    networks:
      - app-network
    build: .
    ports:
      - '1337:1337'
  certbot:
    image: certbot/certbot
    container_name: certbot
    volumes:
      - certbot-etc:/etc/letsencrypt
      - certbot-var:/var/lib/letsencrypt
      - web-root:/var/www/html
    depends_on:
      - webserver
    command: certonly --noninteractive --keep-until-expiring --webroot --webroot-path=/var/www/html --email myemail@example.com --agree-tos --no-eff-email -d mydomain.com
  webserver:
    image: nginx:latest
    container_name: webserver
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - web-root:/var/www/html
      - ./nginx.conf:/etc/nginx/nginx.conf
      - certbot-etc:/etc/letsencrypt
      - certbot-var:/var/lib/letsencrypt
      - dhparam:/etc/ssl/certs
    depends_on:
      - apollo
    networks:
      - app-network

volumes:
  postgres: ~
  certbot-etc:
  certbot-var:
  dhparam:
    driver: local
    driver_opts:
      type: none
      device: /home/user/project_name/dhparam/
      o: bind
  web-root:

networks:
  app-network:

我的设置 下面是docker compose.yml文件，我在其中调用

certbot

生成证书：

version: '2'
services:
  apollo:
    restart: always
    networks:
      - app-network
    build: .
    ports:
      - '1337:1337'
  certbot:
    image: certbot/certbot
    container_name: certbot
    volumes:
      - certbot-etc:/etc/letsencrypt
      - certbot-var:/var/lib/letsencrypt
      - web-root:/var/www/html
    depends_on:
      - webserver
    command: certonly --noninteractive --keep-until-expiring --webroot --webroot-path=/var/www/html --email myemail@example.com --agree-tos --no-eff-email -d mydomain.com
  webserver:
    image: nginx:latest
    container_name: webserver
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - web-root:/var/www/html
      - ./nginx.conf:/etc/nginx/nginx.conf
      - certbot-etc:/etc/letsencrypt
      - certbot-var:/var/lib/letsencrypt
      - dhparam:/etc/ssl/certs
    depends_on:
      - apollo
    networks:
      - app-network

volumes:
  postgres: ~
  certbot-etc:
  certbot-var:
  dhparam:
    driver: local
    driver_opts:
      type: none
      device: /home/user/project_name/dhparam/
      o: bind
  web-root:

networks:
  app-network:

我不认为Nginx是一个问题，因为HTTP->HTTPS重定向是有效的，浏览器会收到一个证书。但以防万一：这里是nginx.conf，我在这里引用证书并配置HTTP->HTTPS重定向

events {}
http {
  server {
    listen 80;
    listen [::]:80;
    server_name mydomain.com;

    location ~ /.well-known/acme-challenge {
      allow all;
      root /var/www/html;
    }

    location / {
      rewrite ^ https://$host$request_uri? permanent;
    }
  }

  server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;        
    server_name mydomain.com;

    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;

    ssl_buffer_size 8k;

    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;

    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;

    location / {
      try_files $uri @apollo;
    }

    location @apollo {
      proxy_pass http://apollo:1337;
      add_header X-Frame-Options "SAMEORIGIN" always;
      add_header X-XSS-Protection "1; mode=block" always;
      add_header X-Content-Type-Options "nosniff" always;
      add_header Referrer-Policy "no-referrer-when-downgrade" always;
      add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
    }

    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;
  }
}

我试过的

最初，我在

docker compose.yml

中的

cerbot

容器定义中使用

-staging

参数调用了

certonly

。这肯定会导致无效CA问题。然而，此后我多次尝试撤销CA并重新运行该命令，但没有成功

我已尝试在

docker compose.yml

的

cerbot

容器定义中删除

--keep to expiring

标志。这导致

cerbot

生成一个新证书，但它没有解决CA问题

访问时，我可以看到certbot确实为我的域颁发了有效的证书：

因此，问题似乎不在于这些证书的生成，而在于docker compose/cerbot配置引用它们的方式