FreeBSD15.1 : WebサーバーSSL化、Webminインストール

# pkg search certbot

py311-certbot-4.2.0,1          Let's Encrypt client
py311-certbot-apache-4.2.0     Apache plugin for Certbot
py311-certbot-dns-cloudflare-4.2.0 Cloudflare DNS plugin for Certbot
py311-certbot-dns-cpanel-0.4.0_1 CPanel DNS Authenticator plugin for Certbot
py311-certbot-dns-digitalocean-4.2.0 DigitalOcean DNS Authenticator plugin for Certbot
py311-certbot-dns-dnsimple-4.2.0 DNSimple DNS Authenticator plugin for Certbot
py311-certbot-dns-dnsmadeeasy-4.2.0 DNS Made Easy DNS Authenticator plugin for Certbot
py311-certbot-dns-gandi-1.5.0_1 Gandi LiveDNS plugin for Certbot
-----------------------------------------------------------------------------------------------------

# pkg install py311-certbot py311-certbot-apache

# vi  /usr/local/etc/apache24/httpd.conf

53行目あたりに追加
Listen 443

92行目当たりコメント解除
LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so

148行目あたりコメント解除
LoadModule ssl_module libexec/apache24/mod_ssl.so

# vi /usr/local/etc/apache24/httpd.conf
 
181行目あたりコメント解除
LoadModule rewrite_module libexec/apache24/mod_rewrite.so

# service apache24 restart

# service apache24 stop

# certbot certonly --standalone -d [FQDN]

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
 (Enter 'c' to cancel): [E-mail address]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.7-June-04-2026.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered.
Requesting a certificate for [FQDN]

Successfully received certificate.
Certificate is saved at: /usr/local/etc/letsencrypt/live/[FQDN]/fullchain.pem
Key is saved at:         /usr/local/etc/letsencrypt/live/[FQDN]/privkey.pem
This certificate expires on 2026-09-15.
These files will be updated when the certificate renews.

NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

# service apache24 start

# cp /usr/local/etc/apache24/extra/httpd-ssl.conf /usr/local/etc/apache24/extra/bsd-httpd-ssl.conf

# vi /usr/local/etc/apache24/extra/bsd-httpd-ssl.conf 
36行目 : コメントアウト
#Listen 443

124-128行目 : 下記のように変更
 DocumentRoot "/usr/local/www/apache24/data/[FQDN]"
 ServerName [FQDN]:443
 ServerAdmin [mail address]
 ErrorLog "/var/log/[FQDN].httpd-error.log"
 TransferLog "/var/log/[FQDN].httpd-access.log"

129行目 : 追加
 CustomLog "/var/log/httpd/[FQDN].httpd-ssl-access.log" combined

144行目 : コメント 
#SSLCertificateFile "/usr/local/etc/apache24/server.crt"

147行目 : 追加
 SSLCertificateFile "/usr/local/etc/letsencrypt/live/[FQDN]/cert.pem"

154行目 : コメント
#SSLCertificateKeyFile "/usr/local/etc/apache24/server.key"

157行目 : 追加
 SSLCertificateKeyFile "/usr/local/etc/letsencrypt/live/[FQDN]/privkey.pem"

166行目 : 追加
 SSLCertificateChainFile "/usr/local/etc/letsencrypt/live/[FQDN]/chain.pem"
 
287,288行目 : コメント 
#CustomLog "/var/log/httpd-ssl_request.log" \
 #           "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

# ln -s /usr/local/etc/apache24/extra/bsd-httpd-ssl.conf /usr/local/etc/apache24/Includes/bsd-httpd-ssl.conf

# cd /usr/local/etc/apache24/extra
# vi bsd-vhost.conf

<VirtualHost *:80>
    RewriteEngine on
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
    ServerAdmin [E-mail address]
    DocumentRoot "/usr/local/www/apache24/data/[FQDN]"
    ServerName [FQDN]
    ErrorLog "/var/log/httpd/[FQDN].error_log"
    CustomLog "/var/log/httpd/[FQDN].access_log" common
</VirtualHost>
<Directory /usr/local/www/apache24/data/[FQDN]>
   AddHandler cgi-script .cgi
   Options FollowSymlinks Includes
   AllowOverride All
   Require all granted
</Directory>

# pkg install webmin

# /usr/local/lib/webmin/setup.sh

# sysrc webmin_enable=YES
webmin_enable:  -> YES

# service webmin start
Starting webmin.
Starting Webmin server in /usr/local/lib/webmin

# cat /usr/local/etc/letsencrypt/live/[FQDN]/fullchain.pem /usr/local/etc/letsencrypt/live/[FQDN]/privkey.pem > webmin.pem

# mv webmin.pem /usr/local/etc/webmin/

# vi /usr/local/etc/webmin/miniserv.conf

30行目 : 変更
keyfile=/usr/local/etc/webmin/webmin.pem

# service webmin restart