SSL Certificates

Overview

All public-facing SSERIS services are served over HTTPS. SSL termination happens at the Nginx reverse proxy (dev_nginx, a global-mode service in the DEV stack) which handles TLS for all domains.

Certificate Setup

Property	Value
Termination point	`dev_nginx` (global mode, runs on both nodes)
Certificate type	Let’s Encrypt (free, auto-renewable)
Domains covered	All `*.ayinza.dev` subdomains
Renewal	Needs manual renewal or certbot cron

How It Works

Clients connect to *.ayinza.dev over HTTPS (port 443)
DNS points to Contabo’s public IP (84.247.134.135)
Nginx on Contabo terminates SSL and proxies to backend services
Backend services receive plain HTTP traffic internally

Checking Certificate Status

# Check expiry for any domain
echo | openssl s_client -connect ayinza.dev:443 2>/dev/null | openssl x509 -noout -dates

# Check which certificate is being served
echo | openssl s_client -connect auth.ayinza.dev:443 2>/dev/null | openssl x509 -noout -subject -issuer

# Check certificate from inside the server
certbot certificates

Renewing Certificates

Using Certbot

# Dry run (test without actually renewing)
certbot renew --dry-run

# Actual renewal
certbot renew

# Force renewal for a specific domain
certbot certonly --force-renewal -d ayinza.dev -d "*.ayinza.dev"

After Renewal

After renewing certificates, Nginx needs to pick up the new certs:

# Reload Nginx to use new certificates
docker service update --force dev_nginx

Adding SSL for a New Domain

When you add a new subdomain:

Add the DNS record pointing to Contabo (84.247.134.135)
If using a wildcard cert (*.ayinza.dev), no new cert is needed
If the domain is outside the wildcard, generate a new cert:
Terminal window
```
certbot certonly -d newdomain.example.com
```
Update the Nginx config to include the new server block with SSL
Redeploy Nginx

Certificate File Locations

# Let's Encrypt certificates (standard location)
/etc/letsencrypt/live/ayinza.dev/fullchain.pem   # Certificate + chain
/etc/letsencrypt/live/ayinza.dev/privkey.pem      # Private key

# Check all managed certificates
ls -la /etc/letsencrypt/live/

Troubleshooting

Certificate Expired

Browsers will show a security warning. Renew immediately:

certbot renew
docker service update --force dev_nginx

Certificate Not Trusted

Check that the full chain is being served (not just the leaf certificate)
Verify the certificate matches the domain being accessed
Check that the Nginx config references fullchain.pem, not just cert.pem

Certbot Renewal Failing

# Check certbot logs
cat /var/log/letsencrypt/letsencrypt.log

# Common issues:
# - Port 80 not accessible (needed for HTTP-01 challenge)
# - DNS not pointing to this server (needed for DNS-01 challenge)
# - Rate limit exceeded (Let's Encrypt limits ~50 certs per week per domain)