Automated TLS Certificate Renewal for Docker Gateway

Ignition
1

I am trying to setup automated TLS certificate renewal for my gateway running 8.1.39 in Docker. My system is running on Ubuntu 22.04 and I am using certbot 2.10.0.

To generate the certificate, I am using certbot's standalone webserver by using certbot certonly --standalone to generate my certificate. Once generated if I manually add the certificate to the gateway everything works as expected. However, when I export the certificate using openssl pkcs12 -export -out ${IGNITION_DOCKER_VOLUME}/data/local/ssl.pfx -inkey privkey.pem -in fullchain.pem -certfile root.pemand move the file to ${IGNITION_DOCKER_VOLUME}/data/local as outlined here, I do not see the TLS certificate applying inside of the gateway.

While the manual procedure does work, I am looking for a solution that will handle the automatic renewal of the TLS certs. Has anyone done something similar such that TLS certificates will automatically renew on the gateway running in Docker?

2

@Nick_Gendron1, I think you would need to create a custom Ignition docker image that adds a cronjob that calls a script similar to the one noted in the Automated Renewal section of the following guide:

Garth