文書の表示以前のリビジョンバックリンク文書の先頭へ この文書は読取専用です。文書のソースを閲覧することは可能ですが、変更はできません。もし変更したい場合は管理者に連絡してください。 ====== Certbot クライアント ====== ===== Fedora でのインストール ===== <WRAP color_term> <WRAP color_command><html><pre> $ sudo -s # cd ~ # dnf install python3-virtualenv # curl -O https://dl.eff.org/certbot-auto # chmod a+x certbot-auto # ./certbot-auto </pre></html></WRAP> <WRAP color_result><html><pre> Bootstrapping dependencies for RedHat-based OSes... (you can skip this with --no-bootstrap) dnf は /usr/bin/dnf です dnf はハッシュされています (/usr/bin/dnf) メタデータの期限切れの最終確認: 1:18:05 時間前の 2019年02月15日 10時47分08秒 に実施しました。 パッケージ gcc-8.2.1-6.fc29.x86_64 は既にインストールされています。 パッケージ augeas-libs-1.10.1-3.fc29.x86_64 は既にインストールされています。 パッケージ openssl-1:1.1.1a-1.fc29.x86_64 は既にインストールされています。 パッケージ openssl-devel-1:1.1.1a-1.fc29.x86_64 は既にインストールされています。 パッケージ libffi-devel-3.1-18.fc29.x86_64 は既にインストールされています。 パッケージ redhat-rpm-config-118-1.fc29.noarch は既にインストールされています。 パッケージ ca-certificates-2018.2.26-2.fc29.noarch は既にインストールされています。 パッケージ python2-libs-2.7.15-11.fc29.x86_64 は既にインストールされています。 パッケージ python2-setuptools-40.4.3-1.fc29.noarch は既にインストールされています。 パッケージ python2-devel-2.7.15-11.fc29.x86_64 は既にインストールされています。 パッケージ python2-virtualenv-16.0.0-5.fc29.noarch は既にインストールされています。 パッケージ python2-tools-2.7.15-11.fc29.x86_64 は既にインストールされています。 パッケージ python2-pip-18.1-1.fc29.noarch は既にインストールされています。 パッケージ mod_ssl-1:2.4.38-2.fc29.x86_64 は既にインストールされています。 依存関係が解決しました。 行うべきことはありません。 完了しました! Creating virtual environment... Installing Python packages... Installation succeeded. Saving debug log to /var/log/letsencrypt/letsencrypt.log Error while running apachectl configtest. AH00526: Syntax error on line 101 of /etc/httpd/conf.d/ssl.conf: SSLCertificateFile: file '/etc/pki/tls/certs/localhost.crt' does not exist or is empty Certbot doesn't know how to automatically configure the web server on this system. However, it can still get a certificate for you. Please run "certbot-auto certonly" to do so. You'll need to manually configure your web server to use the resulting certificate. </pre></html></WRAP> </WRAP> ===== インストール ===== <WRAP color_term> <WRAP color_command><html><pre> $ sudo dnf install certbot python-certbot-apache </pre></html></WRAP> </WRAP> ===== 使用方法 [--help] ===== <WRAP color_term> <WRAP color_command><html><pre> $ certbot --help </pre></html></WRAP> <WRAP color_result_long><html><pre> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ... Certbot can obtain and install HTTPS/TLS/SSL certificates. By default, it will attempt to use a webserver both for obtaining and installing the certificate. The most common SUBCOMMANDS and flags are: obtain, install, and renew certificates: (default) run Obtain & install a certificate in your current webserver certonly Obtain or renew a certificate, but do not install it renew Renew all previously obtained certificates that are near expiry enhance Add security enhancements to your existing configuration -d DOMAINS Comma-separated list of domains to obtain a certificate for (the certbot apache plugin is not installed) --standalone Run a standalone webserver for authentication (the certbot nginx plugin is not installed) --webroot Place files in a server's webroot folder for authentication --manual Obtain certificates interactively, or using shell script hooks -n Run non-interactively --test-cert Obtain a test certificate from a staging server --dry-run Test "renew" or "certonly" without saving any certificates to disk manage certificates: certificates Display information about certificates you have from Certbot revoke Revoke a certificate (supply --cert-name or --cert-path) delete Delete a certificate (supply --cert-name) manage your account: register Create an ACME account unregister Deactivate an ACME account update_account Update an ACME account show_account Display account details --agree-tos Agree to the ACME server's Subscriber Agreement -m EMAIL Email address for important account notifications More detailed help: -h, --help [TOPIC] print this message, or detailed help on a topic; the available TOPICS are: all, automation, commands, paths, security, testing, or any of the subcommands or plugins (certonly, renew, install, register, nginx, apache, standalone, webroot, etc.) -h all print a detailed help page including all topics --version print the version number - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - </pre></html></WRAP> </WRAP> ===== テスト実行 ===== <WRAP color_term> <WRAP color_command><html><pre> $ sudo certbot </pre></html></WRAP> <WRAP color_result><html><pre> Saving debug log to /var/log/letsencrypt/letsencrypt.log Certbot doesn't know how to automatically configure the web server on this system. However, it can still get a certificate for you. Please run "certbot certonly" to do so. You'll need to manually configure your web server to use the resulting certificate. $ sudo less /var/log/letsencrypt/letsencrypt.log </pre></html></WRAP> </WRAP> <WRAP color_term> <WRAP color_mincode><file /var/log/letsencrypt/letsencrypt.log> 2019-02-15 11:53:24,221:DEBUG:certbot.main:certbot version: 0.30.2 2019-02-15 11:53:24,222:DEBUG:certbot.main:Arguments: [] 2019-02-15 11:53:24,222:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot) 2019-02-15 11:53:24,246:DEBUG:certbot.log:Root logging level set at 20 2019-02-15 11:53:24,247:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log 2019-02-15 11:53:24,248:DEBUG:certbot.plugins.selection:Requested authenticator None and installer None 2019-02-15 11:53:24,248:DEBUG:certbot.plugins.selection:No candidate plugin 2019-02-15 11:53:24,248:DEBUG:certbot.plugins.selection:Selected authenticator None and installer None </file></WRAP> </WRAP> ===== 証明書取得の実行 ===== <WRAP color_term> <WRAP color_command><html><pre> $ sudo certbot certonly --webroot -w /var/www/vhosts/letsencrypt -d monsters-g.com -w /var/www/vhosts/letsencrypt -d www.monsters-g.com </pre></html></WRAP> <WRAP color_result_long><html><pre> Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator webroot, Installer None Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): tomoyan@tomoyan.net - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must agree in order to register with the ACME server at https://acme-v02.api.letsencrypt.org/directory - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (A)gree/(C)ancel: A - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Would you be willing to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: Y Obtaining a new certificate Performing the following challenges: http-01 challenge for monsters-g.com http-01 challenge for www.monsters-g.com Using the webroot path /var/www/vhosts/letsencrypt for all unmatched domains. Waiting for verification... Cleaning up challenges IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/www.monsters-g.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/www.monsters-g.com/privkey.pem Your cert will expire on 2019-05-16. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le </pre></html></WRAP> </WRAP> ===== 既に取得済みの証明書にサブドメインを追加 ===== **redmine.monsters-g.com** サブドメインを追加する場合、既存ドメインに **monsters-g.com**、**www.monsters-g.com** のあとに追記する🤔\\ コマンドラインでは、<html><code>-w /var/www/vhosts/letsencrypt -d redmine.monsters-g.com</code></html>を追加で指定する。\\ <WRAP color_term> <WRAP color_command><html><pre> <b class=GRN>$</b> <b class=HIY>sudo</b> ls -al /etc/letsencrypt/live </pre></html></WRAP> <WRAP color_result><html><pre> 合計 3 drwx------. 1 root root 88 8月 28 06:47 . drwxr-xr-x. 1 root root 106 8月 28 06:47 .. -rw-r--r--. 1 root root 740 2月 15 2019 README drwxr-xr-x 1 root root 94 8月 28 06:47 monsters-g.com drwxr-xr-x. 1 root root 94 8月 28 06:15 tomoyan.net </pre></html></WRAP> </WRAP> <WRAP color_term> <WRAP color_command><html><pre> <b class=GRN>$</b> <b class=HIY>sudo</b> certbot certonly <b class=HIK>--force-renew --webroot -w</b> /var/www/vhosts/letsencrypt <b class=HIK>-d</b> monsters-g.com <b class=HIK>-w</b> /var/www/vhosts/letsencrypt <b class=HIK>-d</b> www.monsters-g.com <b class=HIK>-w</b> /var/www/vhosts/letsencrypt <b class=HIK>-d</b> redmine.monsters-g.com </pre></html></WRAP> <WRAP color_result><html><pre> Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - An RSA certificate named monsters-g.com already exists. Do you want to update its key type to ECDSA? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (U)pdate key type/(K)eep existing key type: u Renewing an existing certificate for monsters-g.com and 2 more domains Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/monsters-g.com/fullchain.pem Key is saved at: /etc/letsencrypt/live/monsters-g.com/privkey.pem This certificate expires on 2023-07-02. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If you like Certbot, please consider supporting our work by: * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate * Donating to EFF: https://eff.org/donate-le - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - </pre></html></WRAP> </WRAP> Apache の場合は、新しく取得した証明書を有効化する為にリロードする🤔\\ <WRAP color_term> <WRAP color_command><html><pre> <b class=GRN>$</b> <b class=HIY>sudo</b> systemctl reload httpd </pre></html></WRAP> </WRAP> ===== 証明書更新テストの実行 ===== <WRAP color_term> <WRAP color_command><html><pre> $ sudo certbot renew --dry-run </pre></html></WRAP> <WRAP color_result><html><pre> Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/monsters-g.com.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Simulating renewal of an existing certificate for monsters-g.com and www.monsters-g.com - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/tomoyan.net.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Simulating renewal of an existing certificate for tomoyan.net and 3 more domains - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations, all simulated renewals succeeded: /etc/letsencrypt/live/monsters-g.com/fullchain.pem (success) /etc/letsencrypt/live/tomoyan.net/fullchain.pem (success) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - </pre></html></WRAP> </WRAP> ===== 証明書更新の実行 ===== <WRAP color_term> <WRAP color_command><html><pre> $ sudo certbot renew </pre></html></WRAP> <WRAP color_result_long><html><pre> Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/monsters-g.com.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Cert is due for renewal, auto-renewing... Plugins selected: Authenticator webroot, Installer None Renewing an existing certificate Performing the following challenges: http-01 challenge for monsters-g.com http-01 challenge for www.monsters-g.com Waiting for verification... Cleaning up challenges - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - new certificate deployed without reload, fullchain is /etc/letsencrypt/live/monsters-g.com/fullchain.pem - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/tomoyan.net.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Cert is due for renewal, auto-renewing... Plugins selected: Authenticator webroot, Installer None Renewing an existing certificate Performing the following challenges: http-01 challenge for redmine.tomoyan.net http-01 challenge for repos.tomoyan.net http-01 challenge for tomoyan.net http-01 challenge for www.tomoyan.net Waiting for verification... Cleaning up challenges - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - new certificate deployed without reload, fullchain is /etc/letsencrypt/live/tomoyan.net/fullchain.pem - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations, all renewals succeeded. The following certs have been renewed: /etc/letsencrypt/live/monsters-g.com/fullchain.pem (success) /etc/letsencrypt/live/tomoyan.net/fullchain.pem (success) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - </pre></html></WRAP> </WRAP> 新しい証明書を反映させるために、Apache をリロードする😉\\ <WRAP color_term> <WRAP color_command><html><pre> $ sudo systemctl reload httpd </pre></html></WRAP> </WRAP> linux/certbot_client.txt 最終更新: 2023/08/28 08:27by ともやん
ともやん ともやん