Let’s EncryptでSSL化! Nginxにインストール

寄稿しました。詳しくは上記記事を見てください(๑❛ᴗ❛๑ )

 

Certbotのインストール

# cd /usr/local/src
# git clone https://github.com/certbot/certbot
# cd certbot/
# ./certbot-auto -n

 

証明書の発行

# systemctl stop nginx

 

 

証明書の発行

# ./certbot-auto certonly --standalone -d example.com,www.example.com -m postmaster@example.com.com --agree-tos -n

 

# systemctl start nginx

 

証明書の確認

# ls -laht /etc/letsencrypt/live/example.com/
 
total 12K
drwxr-xr-x 2 root root 4.0K Aug 24 18:56 .
-rw-r--r-- 1 root root  543 Aug 24 18:56 README
drwx------ 3 root root 4.0K Aug 24 18:56 ..
lrwxrwxrwx 1 root root   37 Aug 24 18:56 cert.pem -> ../../archive/example.com/cert1.pem
lrwxrwxrwx 1 root root   38 Aug 24 18:56 chain.pem -> ../../archive/example.com/chain1.pem
lrwxrwxrwx 1 root root   42 Aug 24 18:56 fullchain.pem -> ../../archive/example.com/fullchain1.pem
lrwxrwxrwx 1 root root   40 Aug 24 18:56 privkey.pem -> ../../archive/example.com/privkey1.pem

 

 

Nginx設定

適切な設定箇所に下記反映させます。

ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

 

 

# nginx -t
# systemctl reload nginx

 

更新の自動化

90日以内に更新が必要です。

# vi /etc/crontab

0 4 1 * * root /usr/local/src/certbot/certbot renew --no-self-upgrade --deploy-hook "systemctl restart nginx"

 

# systemctl restart crond