Let’s encryptを使い証明書を取得します。

apache2でもnginxでも証明書を作成する手順は変わらない。

photo.viasv.comの名前解決が出来るよう、DNSを設定しnslookupなどで解決できているか確認します。

確認出来れば、作業を開始する。

最初に、photo.viasv.comを公開するディレクトリを作成

mkdir /var/www/html/photo
chown www-data:www-data /var/www/html/photo

ls -la /var/www/html/
total 48
drwxr-xr-x 5 root     www-data  4096 Oct  9 08:59 .
drwxr-xr-x 3 root     root      4096 Sep 27 14:30 ..
drwxr-xr-x 2 www-data www-data  4096 Oct  9 08:59 photo

nginxのVirtualHostの設定を行い、https://photo.viasv.com/を表示出来るか確認する。最初は、sslの設定はコメントアウトしておく。

server {
        listen 443 ssl;
        listen [::]:443 ssl;

        server_name photo.viasv.com;

        root /var/www/html/photo;
#        ssl_certificate /etc/letsencrypt/live/photo.viasv.com/fullchain.pem;
#        ssl_certificate_key /etc/letsencrypt/live/photo.viasv.com/privkey.pem;
#       ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

        index index.html index.htm index.php index.nginx-debian.html;

        location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        include         fastcgi_params;
        }

        location / {
                try_files $uri $uri/ =404;
        }
}

nginxの設定が終われば、再起動する。

$ sudo service nginx restart

きちんと、表示出来れば、certbotを使い、証明書を取得する。

certbot certonly --webroot -w /var/www/html/photo -d photo.viasv.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
An unexpected error occurred:
There were too many requests of a given type :: Error creating new authz :: too many failed authorizations recently: see https://letsencrypt.org/docs/rate-limits/
Please see the logfiles in /var/log/letsencrypt for more details.
root@ras:/var/www/html/photo/.well-known# certbot certonly --webroot -w /var/www/html/photo -d photo.viasv.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for photo.viasv.com
Using the webroot path /var/www/html/photo for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/0002_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0002_csr-certbot.pem

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/photo.viasv.com/fullchain.pem. Your cert will
   expire on 2019-01-07. To obtain a new or tweaked version of this
   certificate in the future, simply run certbot again. To
   non-interactively renew *all* of your certificates, run "certbot
   renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

証明書を確認する。

$ ls /etc/letsencrypt/live/photo.viasv.com/
cert.pem  chain.pem  fullchain.pem  privkey.pem  README

証明書がきちんと出来ていることを確認出来れば、nginxの設定でsslのコメントを外し、nginxを再起動する。