[SSL] Let's Encrypt免費的SSL憑證(三個月) @新精讚

[SSL] Let's Encrypt免費的SSL憑證(三個月)

“ 免費三個月的SSL憑證，讓你的網頁變成HTTPS ”

分享完整連結 //n.sfs.tw/m10373

分享連結 [SSL] Let's Encrypt免費的SSL憑證(三個月)@精讚

(文章歡迎轉載，請尊重版權註明連結來源)

2017-09-26 11:00:31 By 張○○

能找到有上下游都授權正確的憑證中心而且是免費的，雖然只有免費三個月，但還是值得推薦，設定和操作上很容易，對經驗不夠的人來說也很快能上手。

安裝及設定

安裝設定很簡單

[CENTOS7]

# yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

# yum install certbot python2-certbot-apache
# certbot --apache

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org

Which names would you like to activate HTTPS for?
-------------------------------------------------------------------------------
1: n.sfs.tw
-------------------------------------------------------------------------------
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for n.sfs.tw
Waiting for verification...
Cleaning up challenges
Created an SSL vhost at /etc/httpd/conf.d/wildfly-le-ssl.conf
Deploying Certificate for n.sfs.tw to VirtualHost /etc/httpd/conf.d/wildfly-le-ssl.conf

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for <== 原本的http會導轉到https
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Redirecting vhost in /etc/httpd/conf.d/wildfly.conf to ssl vhost in /etc/httpd/conf.d/wildfly-le-ssl.conf

-------------------------------------------------------------------------------
Congratulations! You have successfully enabled https://n.sfs.tw

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=n.sfs.tw
-------------------------------------------------------------------------------

IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/oidc.boe.ttct.edu.tw/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/oidc.boe.ttct.edu.tw/privkey.pem
   Your cert will expire on 2017-12-25. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

這樣就好了

重啟APACHE，打開你的https://exampe.com 網站吧

三個月到期刷新你的憑證

# certbot renew

[CENTOS6]

centos6 沒辦法像centos7一樣安裝

# yum install certbot-apache
Loaded plugins: fastestmirror
Setting up Install Process
Loading mirror speeds from cached hostfile
* base: ftp.tc.edu.tw
* epel: mirror01.idc.hinet.net
* extras: ftp.tc.edu.tw
* updates: ftp.tc.edu.tw
No package certbot-apache available.
Error: Nothing to do

還好[1]這裡有解決方法：

# yum -y install epel-release
# wget https://dl.eff.org/certbot-auto
# chmod 755 certbot-auto

# ./certbot-auto --apache

Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): user@example.com

Please read the Terms of Service at ...
(A)gree/(C)ancel: a
share your email ...
(Y)es/(N)o: n

Which names would you like to activate HTTPS for?

-------------------------------------------------------------------------------
1: n.sfs.tw
2: ...
你的網域會列在這裡，如果沒有列出，就是你的apache沒設定好

Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1 你的網域號碼

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

重啟apache即可

# apachectl restart

參考資料

[1] https://bobcares.com/blog/setup-lets-encrypt-centos-6-centos-7/

[2] Epel https://fedoraproject.org/wiki/EPEL#Quickstart