<p>Your listen 443 need to have ssl parameter to tell Nginx that all connections accepted on this port should work in SSL mode.</p>
<p>See example at <a href="https://nginx.org/en/docs/http/configuring_https_servers.html#single_http_https_server" rel="nofollow noreferrer">https://nginx.org/en/docs/http/configuring_https_servers.html#single_http_https_server</a></p>
<p>Shown here for convenience:</p>
<pre><code>server {
    listen              80;
    listen              443 ssl;
    server_name         www.example.com;
    ssl_certificate     www.example.com.crt;
    ssl_certificate_key www.example.com.key;
    ...
}
</code></pre>

CC BY-SA 4.0
2021-02-13T14:26:34.273Z
2021-02-13T14:26:34.273Z
Sharuzzaman Ahmat Raslan
<p>I have a website running at <a href="https://domain.com" rel="nofollow noreferrer">https://domain.com</a> and IP a.a.a.a, with an SSL cert issued by GoDaddy. The server is deployed with Nginx. Everything is working fine as it is.</p>
<p>However I'm trying to deploy the same website with Docker in a new server with IP b.b.b.b, so I did the following:</p>
<ol>
<li>Pull nginx image from Docker</li>
<li><strong>Copy the domain.com.chained.crt and domain.com.key files from server a.a.a.a to server b.b.b.b</strong></li>
<li>In the Docker file, I copy the cert files to the image</li>
<li>When I run the container and check nginx with <code>nginx -t</code>, it seems to be working fine.</li>
<li>Ports 443 and 80 are open for external requests</li>
<li>I check that the website is running by accessing to b.b.b.b:80 from an external client</li>
<li>Configure the DNS to resolve to b.b.b.b instead of a.a.a.a</li>
<li>Check that <a href="http://domain.com" rel="nofollow noreferrer">http://domain.com</a> is working</li>
</ol>
<p>Up to that point everything is working fine. But when I try to access <a href="https://domain.com" rel="nofollow noreferrer">https://domain.com</a> I get the following errors:</p>
<ul>
<li>With firefox: ERR_SSL_PROTOCOL_ERROR</li>
<li>With chrome: SSL_ERROR_RX_RECORD_TOO_LONG</li>
<li>The site <a href="https://www.sslshopper.com/ssl-checker.html" rel="nofollow noreferrer">https://www.sslshopper.com/ssl-checker.html</a> tells me this: <code>No SSL certificates were found on domain.com. Make sure that the name resolves to the correct server and that the SSL port (default is 443) is open on your server's firewall.</code></li>
</ul>
<p>The Nginx error logs don't tell me much, although I have them in debug mode.</p>
<p>My main question is: Can I copy the cert files from one server to another or do I have to generate them again?</p>
<p>Edit:
This is the docker-compose.yml</p>
<pre><code>sevices:  
  nginx:
    build: ./nginx
    image: nginx
    ports:
      - &quot;80:80&quot;
      - &quot;443:443&quot;
  redis:
    image: redis
    ports: 
      - &quot;6379:6379&quot;
  mongo:
    image: mongo
    ports: 
      - &quot;27017:27017&quot;
    volumes:
      - /var/mongodata:/data/db
</code></pre>
<p>Dockerfile</p>
<pre><code>FROM custom:latest

COPY nginx.conf /etc/nginx/nginx.conf
COPY /ssl/domain.com.key /etc/nginx/ssl/domain.com.key
COPY /ssl/domain.com.chained.crt /etc/nginx/ssl/domain.com.chained.crt


RUN apt-get -y install nodejs libssl1.0-dev  nodejs-dev node-gyp npm  
[...]
CMD [&quot;nginx&quot;, &quot;-g&quot;, &quot;daemon off;&quot;]
</code></pre>
<p>nginx.conf</p>
<pre><code>user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
    # multi_accept on;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log debug;

    ##
    # Gzip Settings
    ##

    gzip on;

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    #include /etc/nginx/sites-enabled/*;

    server {
        listen 80;
        listen [::]:80;
        listen 443;
                
        server_name www.domain.com;
        ssl_certificate /etc/nginx/ssl/domain.com.chained.crt;
        ssl_certificate_key /etc/nginx/ssl/domain.com.key;

        location / {
            root /domain.com/;
            try_files $uri$args $uri$args/ /index.html;
        }
    }
}
</code></pre>

CC BY-SA 4.0
2021-02-12T18:41:30.150Z
what is the command that you use to start your docker container?
Sharuzzaman Ahmat Raslan
CC BY-SA 4.0
2021-02-12T18:43:37.403Z
I use "docker-compose up -d" and the image has this command: CMD ["nginx", "-g", "daemon off;"]
puma91
CC BY-SA 4.0
2021-02-12T18:46:52.923Z
please update the question with your docker-compose.yml file
Sharuzzaman Ahmat Raslan
CC BY-SA 4.0
2021-02-12T18:53:26.980Z
I just updated the question.
puma91
CC BY-SA 4.0
2021-02-12T18:58:00.250Z
Also added the Dockerfile and nginx.conf
puma91
<docker><nginx><ssl>
Can I move SSL certificate files from one server to another for the same domain?
puma91
# Can I move SSL certificate files from one server to another for the same domain?

(Asked by: username_0 on 2021-02-12)

I have a website running at https://domain.com and IP a.a.a.a, with an SSL cert issued by GoDaddy. The server is deployed with Nginx. Everything is working fine as it is.
However I'm trying to deploy the same website with Docker in a new server with IP b.b.b.b, so I did the following:

Pull nginx image from Docker
Copy the domain.com.chained.crt and domain.com.key files from server a.a.a.a to server b.b.b.b
In the Docker file, I copy the cert files to the image
When I run the container and check nginx with nginx -t, it seems to be working fine.
Ports 443 and 80 are open for external requests
I check that the website is running by accessing to b.b.b.b:80 from an external client
Configure the DNS to resolve to b.b.b.b instead of a.a.a.a
Check that http://domain.com is working

Up to that point everything is working fine. But when I try to access https://domain.com I get the following errors:

With firefox: ERR_SSL_PROTOCOL_ERROR
With chrome: SSL_ERROR_RX_RECORD_TOO_LONG
The site https://www.sslshopper.com/ssl-checker.html tells me this: No SSL certificates were found on domain.com. Make sure that the name resolves to the correct server and that the SSL port (default is 443) is open on your server's firewall.

The Nginx error logs don't tell me much, although I have them in debug mode.
My main question is: Can I copy the cert files from one server to another or do I have to generate them again?
Edit:
This is the docker-compose.yml
sevices:  
  nginx:
    build: ./nginx
    image: nginx
    ports:
      - "80:80"
      - "443:443"
  redis:
    image: redis
    ports: 
      - "6379:6379"
  mongo:
    image: mongo
    ports: 
      - "27017:27017"
    volumes:
      - /var/mongodata:/data/db

Dockerfile
FROM custom:latest

COPY nginx.conf /etc/nginx/nginx.conf
COPY /ssl/domain.com.key /etc/nginx/ssl/domain.com.key
COPY /ssl/domain.com.chained.crt /etc/nginx/ssl/domain.com.chained.crt


RUN apt-get -y install nodejs libssl1.0-dev  nodejs-dev node-gyp npm  
[...]
CMD ["nginx", "-g", "daemon off;"]

nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
    # multi_accept on;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log debug;

    ##
    # Gzip Settings
    ##

    gzip on;

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    #include /etc/nginx/sites-enabled/*;

    server {
        listen 80;
        listen [::]:80;
        listen 443;
                
        server_name www.domain.com;
        ssl_certificate /etc/nginx/ssl/domain.com.chained.crt;
        ssl_certificate_key /etc/nginx/ssl/domain.com.key;

        location / {
            root /domain.com/;
            try_files $uri$args $uri$args/ /index.html;
        }
    }
}

**Tags:** docker, nginx, ssl

> **Comments:**
> **username_1**: what is the command that you use to start your docker container?  
> **username_0**: I use "docker-compose up -d" and the image has this command: CMD ["nginx", "-g", "daemon off;"]  
> **username_1**: please update the question with your docker-compose.yml file  
> **username_0**: I just updated the question.  
> **username_0**: Also added the Dockerfile and nginx.conf  

---

## 1 answers

### Answer by username_1 on 2021-02-13. Score: 1 | Accepted answer

Your listen 443 need to have ssl parameter to tell Nginx that all connections accepted on this port should work in SSL mode.
See example at https://nginx.org/en/docs/http/configuring_https_servers.html#single_http_https_server
Shown here for convenience:
server {
    listen              80;
    listen              443 ssl;
    server_name         www.example.com;
    ssl_certificate     www.example.com.crt;
    ssl_certificate_key www.example.com.key;
    ...
}


---

