Skip to content

Instantly share code, notes, and snippets.

@gordonmurray
Last active February 26, 2024 07:48
Show Gist options
  • Star 16 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save gordonmurray/433e455653983adc67df6754e4e9b3f5 to your computer and use it in GitHub Desktop.
Save gordonmurray/433e455653983adc67df6754e4e9b3f5 to your computer and use it in GitHub Desktop.
Steps to convert certificates generated by Caddy Server to certificates that Nginx can use

Convert Caddy Server certificates to LetsEncrypt certificates to be used by Nginx

Caddy

When using Caddy Server, it stores certificates in ~/.caddy/acme/acme-v01.api.letsencrypt.org/sites/{your domain name}/

3 files are stored in the folder called:

  • {yourdomain}.crt
  • {yourdomain}.json
  • {yourdomain}.key

LetsEncrypt + Nginx

When using LetsEncrypt's Certbot and Nginx, LetsEncrypt will store its certificates in /etc/letsencrypt/archive/{your domain name}/ with symbolic links to /etc/letsencrypt/live/{your domain name}/ with the following files:

  • cert.pem
  • chain.pem
  • fullchain.pem
  • privkey.pem

Steps to convert Caddy to LetsEncrypt:

  • Copy ~/.caddy/acme/acme-v01.api.letsencrypt.org/sites/{yourdomain}/{yourdomain}.crt to cert.pem

  • Copy the Active 'Intermediate Certificate' from https://letsencrypt.org/certificates/ and safe it as chain.pem

  • copy cert.pem + chain.pem in that order to one file called fullchain.pem

  • copy ~/.caddy/acme/acme-v01.api.letsencrypt.org/sites/{yourdomain}/{yourdomain}.key to privkey.pem

You can then use the *.pem files in an Nginx virtual host config file similar to the following:

server {
 
    [..]
 
    location / {
        [..]
    }

    listen 443 ssl;
    ssl_certificate /your/chosen/path/to/fullchain.pem;
    ssl_certificate_key /your/chosen/path/to/privkey.pem;
    include /your/chosen/path/to/options-ssl-nginx.conf;
    ssl_dhparam /your/chosen/path/to/ssl-dhparams.pem;

}
@yifu
Copy link

yifu commented Apr 5, 2021

When you say

copy cert.pem + chain.pem in that order to one file called fullchain.pem

Do you mean cat cert.pem chain.pem > fullchain.pem ?

@gordonmurray
Copy link
Author

Do you mean cat cert.pem chain.pem > fullchain.pem ?

Yup, exactly

@yifu
Copy link

yifu commented Apr 5, 2021 via email

@allen-woods
Copy link

@gordonmurray: Am I correct in thinking that PEM_BUNDLE="$(cat privkey.pem chain.pem | tr '\n' ' ')" would satisfy this portion of HashiCorp Vault setup of PKI? (See warning in paragraph 1 here for context.)

@gordonmurray
Copy link
Author

@gordonmurray: Am I correct in thinking that PEM_BUNDLE="$(cat privkey.pem chain.pem | tr '\n' ' ')" would satisfy this portion of HashiCorp Vault setup of PKI?

It looks like that would suffice alright, though I don't know enough about Vault I'm afraid to know if its definitely going to work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment