Moving from apache to nginx+apache

[l33tmmx]

I'm moving my webserver from 'apache-only' to 'apache+nginx-as-reverse-proxy'-configuration. No major problems there, but I'm somewhat unsure about how to handle the certbot-managed certificates and related things during the change. The certbot documentation is a bit lacking on the subject.

The certificates are meant to be handled by nginx in the end.

Any suggestions? Or documentation I have overlooked?
_________________
"Trust me, I know what I'm doing!"
- Sledge Hammer

[szatox]

"Handle certbot-managed certificates" is quite a vague phrase. What is the thing that actually gives you troubles?

If you generate certificates using http challenge, I suggest you check out this undocumented (last time I checked) trick: https://forums.gentoo.org/viewtopic-p-8667849.html#8667849
Certbot also can run hooks, which you can use to change the format of certificates, concatenate leaf and chain, or even trigger nginx reload after getting a new certificate. Alternatively just put all those extras into crontab; it is a dumb idea, but it is simple and certbot will let you get away with it.
Also, certbot automagically creates links to the newest certificates, so there is no need to update any configs, just reload or restart services to start using new cert.
_________________
Make Computing Fun Again

[Banana]

If you are talking about EFF certbot, there is even a specific page here: https://certbot.eff.org/instructions?ws=nginx&os=gentoo
_________________
Forum Guidelines

PFL - Portage file list - find which package a file or command belongs to.
My delta-labs.org snippets do expire

[l33tmmx]

@szatox: Thanks, I was mainly just wondering whether I could/should reuse the certificates. I think I'll now know how to proceed
_________________
"Trust me, I know what I'm doing!"
- Sledge Hammer

[Hu]

Generally, you should reuse the certificate in a case like this, since the underlying site is the same. I expect the certificates are reusable as-is, though it is possible that you would need to re-encode them if they are in a server-specific format. I cannot recall hearing of apache or nginx having a special encoding like that.

[szatox]

In setups with reverse-proxy it's also quite common to just terminate ssl on the proxy and connect to the backend server without encryption. On a single machine there is pretty much no downside to that, since proxy and upstream can talk over loopback, and any attacker capable of snooping there will have easier and juicier targets.
_________________
Make Computing Fun Again