Infrastructure / Installation

Install SSL on Docker.

Mount certificate files read-only into an Nginx TLS terminator.

Before you begin: use an issued production certificate and its matching private key. Back up the current configuration. Staging certificates are not publicly trusted.

1Keep secrets outside your image

Create a certs directory on the host, restrict private-key permissions, and place fullchain.pem and privkey.pem there. Add this directory to your ignore files. Never COPY private keys into a Docker image.

2Mount files read-only

This Compose service terminates TLS. Prepare nginx.conf using the Nginx guide and point it to /etc/nginx/certs/fullchain.pem and /etc/nginx/certs/privkey.pem. Add an upstream application as needed.

Mount files read-only

services:
  web:
    image: nginx:stable-alpine
    restart: unless-stopped
    ports:
      - '443:443'
    volumes:
      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./certs:/etc/nginx/certs:ro

3Reload after renewal

Validate configuration before reloading. Replacing files inside the bind-mounted directory lets Nginx read the updated certificate without rebuilding the image.

Reload after renewal

docker compose exec web nginx -t
docker compose exec web nginx -s reload

Confirm the connection.

Check the installed certificate and chain, then keep an eye on the expiry date.

Open SSL Checker