ubuntu LetsEncrypt 初期設定

超簡単ubuntu18.04 + nginx + Let's Encrypt https初期設定

September 3, 2019

#ubuntu #https #nginx #LetsEncrypt #初期設定

https初期設定(ubuntu18.04 + nginx + Let’s Encrypt)

1. nginx及びcertbotインストール

 $ sudo apt update
 $ sudo apt install python-certbot-nginx

2. certbot実行

 $ sudo certbot --nginx -d <hostname>
 
 # メールアドレス入力
 Saving debug log to /var/log/letsencrypt/letsencrypt.log
 Plugins selected: Authenticator nginx, Installer nginx
 Enter email address (used for urgent renewal and security notices) (Enter 'c' to
 cancel): <email address>
 
 # ライセンス認証 
 -------------------------------------------------------------------------------
 Please read the Terms of Service at
 https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
 agree in order to register with the ACME server at
 https://acme-v01.api.letsencrypt.org/directory
 -------------------------------------------------------------------------------
 (A)gree/(C)ancel: A
 
 # メール共有
 -------------------------------------------------------------------------------
 Would you be willing to share your email address with the Electronic Frontier
 Foundation, a founding partner of the Let's Encrypt project and the non-profit
 organization that develops Certbot? We'd like to send you email about EFF and
 our work to encrypt the web, protect its users and defend digital rights.
 -------------------------------------------------------------------------------
 (Y)es/(N)o: N
 
 # 証明書を/etc/nginx/sites-enabled/defaultへ格納
 Obtaining a new certificate
 Performing the following challenges:
 http-01 challenge for <hostname>
 Waiting for verification...
 Cleaning up challenges
 Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/default
 
 # httpをhttpsへリダイレクト
 Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
 -------------------------------------------------------------------------------
 1: No redirect - Make no further changes to the webserver configuration.
 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
 new sites, or if you're confident your site works on HTTPS. You can undo this
 change by editing your web server's configuration.
 -------------------------------------------------------------------------------
 Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
 Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled/default
 
 # 成功すれば以下のメッセージ
 -------------------------------------------------------------------------------
 Congratulations! You have successfully enabled https://<hostname>
 
 You should test your configuration at:
 https://www.ssllabs.com/ssltest/analyze.html?d=<hostname>
 -------------------------------------------------------------------------------
 
 IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/<hostname>/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/<hostname>/privkey.pem
   Your cert will expire on 2019-12-02. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:
 Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 Donating to EFF:                    https://eff.org/donate-le

3. 証明書自動更新

 $ sudo certbot renew --dry-run

超簡単!

4. 参考

How To Secure Nginx with Let’s Encrypt on Ubuntu 18.04