CentOS 7 Apache Web サーバー構築 TLS 対応 Let’s Encrypt

目的

公開用のWebサーバーにLet’s Encryptで発行した証明書をインストールしSSL化する。Let’s Encryptはドメイン認証（ドメインに登録されている登録者を確認することにより発行される証明書）であり、企業認証やEV認証には対応していない。尚、Let’s Encryptの証明書は殆どのOSやブラウザで対応しており、警告が表示されずに正式な証明書として認識される。

対象ホスト

外部サーバー

前提条件

マニュアル名：「Webサーバー構築」が完了していること。

設定手順

インストール

[root@centos ~]# yum install certbot python-certbot-apache

SSL証明書の作成

certbotコマンドを実行する。実行後に対話形式となり必要項目を応答する。-dでドメイン名を2つ登録しているが、SANに対応させるためとなる。最初がCommon Nameとして使われ、SANとしては両方が登録される。

[root@centos ~]# certbot certonly --webroot -w /var/www/html -d www.mydomain.com -d mydomain.com

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): [mailaddress]
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Starting new HTTPS connection (1): supporters.eff.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for www.mydomain.com
Using the webroot path /var/www/html for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/www.mydomain.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/www.mydomain.com/privkey.pem
   Your cert will expire on 2019-09-14. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

実行後は下記に証明書が配置される。

[root@centos ~]# ls -l /etc/letsencrypt/live/www.mydomain.com

合計 4
-rw-r--r-- 1 root root 692  6月 16 22:53 README
lrwxrwxrwx 1 root root  38  6月 16 22:53 cert.pem -> ../../archive/www.mydomain.com/cert1.pem
lrwxrwxrwx 1 root root  39  6月 16 22:53 chain.pem -> ../../archive/www.mydomain.com/chain1.pem
lrwxrwxrwx 1 root root  43  6月 16 22:53 fullchain.pem -> ../../archive/www.mydomain.com/fullchain1.pem
lrwxrwxrwx 1 root root  41  6月 16 22:53 privkey.pem -> ../../archive/www.mydomain.com/privkey1.pem

/etc/httpd/conf.d/ssl.conf

[root@centos ~]# vim /etc/httpd/conf.d/ssl.conf

#SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateFile /etc/letsencrypt/live/www.mydomain.com/cert.pem
#SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
SSLCertificateKeyFile /etc/letsencrypt/live/www.mydomain.com/privkey.pem
#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
SSLCertificateChainFile /etc/letsencrypt/live/www.mydomain.com/chain.pem

サービス再起動

[root@centos ~]# systemctl restart httpd

証明書更新の自動化

cronで証明書更新を自動化する。certbot renewは「–dry-run」オプションを付与することでシミュレーション（実際に更新しない）のみとするとができる。

[root@centos ~]# vim /root/bin/letsencrypt

#!/bin/sh
certbot renew 2>&1 | mail -s "Let's Encrypt update information" root && systemctl restart httpd

[root@centos ~]# echo "00 04 01 * * root /root/bin/letsencrypt" /etc/cron.d/letsencrypt

戻る