Let’s encryptを使い証明書を取得します。
apache2でもnginxでも証明書を作成する手順は変わらない。
photo.viasv.comの名前解決が出来るよう、DNSを設定しnslookupなどで解決できているか確認します。
確認出来れば、作業を開始する。
最初に、photo.viasv.comを公開するディレクトリを作成
mkdir /var/www/html/photo chown www-data:www-data /var/www/html/photo ls -la /var/www/html/ total 48 drwxr-xr-x 5 root www-data 4096 Oct 9 08:59 . drwxr-xr-x 3 root root 4096 Sep 27 14:30 .. drwxr-xr-x 2 www-data www-data 4096 Oct 9 08:59 photo
nginxのVirtualHostの設定を行い、https://photo.viasv.com/を表示出来るか確認する。最初は、sslの設定はコメントアウトしておく。
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name photo.viasv.com;
root /var/www/html/photo;
# ssl_certificate /etc/letsencrypt/live/photo.viasv.com/fullchain.pem;
# ssl_certificate_key /etc/letsencrypt/live/photo.viasv.com/privkey.pem;
# ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
index index.html index.htm index.php index.nginx-debian.html;
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
}
nginxの設定が終われば、再起動する。
$ sudo service nginx restart
きちんと、表示出来れば、certbotを使い、証明書を取得する。
certbot certonly --webroot -w /var/www/html/photo -d photo.viasv.com Saving debug log to /var/log/letsencrypt/letsencrypt.log Obtaining a new certificate An unexpected error occurred: There were too many requests of a given type :: Error creating new authz :: too many failed authorizations recently: see https://letsencrypt.org/docs/rate-limits/ Please see the logfiles in /var/log/letsencrypt for more details. root@ras:/var/www/html/photo/.well-known# certbot certonly --webroot -w /var/www/html/photo -d photo.viasv.com Saving debug log to /var/log/letsencrypt/letsencrypt.log Obtaining a new certificate Performing the following challenges: http-01 challenge for photo.viasv.com Using the webroot path /var/www/html/photo for all unmatched domains. Waiting for verification... Cleaning up challenges Generating key (2048 bits): /etc/letsencrypt/keys/0002_key-certbot.pem Creating CSR: /etc/letsencrypt/csr/0002_csr-certbot.pem IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at /etc/letsencrypt/live/photo.viasv.com/fullchain.pem. Your cert will expire on 2019-01-07. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
証明書を確認する。
$ ls /etc/letsencrypt/live/photo.viasv.com/ cert.pem chain.pem fullchain.pem privkey.pem README
証明書がきちんと出来ていることを確認出来れば、nginxの設定でsslのコメントを外し、nginxを再起動する。
| cert.pem | 証明書 |
| privkey.pem | 秘密鍵 |
| chain.pem | 中間証明書 |
| fullchain.pem | 証明書+中間証明書(結合したもの) |
