OpenSUSE15.4 ; SSL証明書を取得 (Let's Encrypt) 、Webサーバー SSL化

Contents

1.SSL証明書を取得する (Let's Encrypt)
- 1.1 証明書のインストール
2. WebサーバーSSL化
- 2.1 SSLの設定
- 2.2 HTTP 通信を HTTPS へリダイレクト

1.SSL証明書を取得する (Let's Encrypt)

事前作業
mod_sslを有効にする
mod_sslが有効になっていない場合には、有効化しておきます

# a2enmod ssl

1	# a2enmod ssl

1.1 証明書のインストール

# zypper -n install certbot
# certbot certonly --webroot -w /srv/www/htdocs/[webサイト公開ディレクトリー] -d <FQDN>

1 2	# zypper -n install certbot # certbot certonly --webroot -w /srv/www/htdocs/[webサイト公開ディレクトリー] -d <FQDN>

# 初回のみメールアドレスの登録と利用条件への同意が必要
# 受信可能なメールアドレスを指定

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): <Email address>

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017-w-v1.3-notice.pdf.
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered.
Requesting a certificate for <FQDN>

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/<FQDN>/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/<FQDN>/privkey.pem
This certificate expires on 2022-12-15.
These files will be updated when the certificate renews.

NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Enter email address (used for urgent renewal and security notices)

(Enter 'c' to cancel): <Email address>

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Please read the Terms of Service at

https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017-w-v1.3-notice.pdf.

You must agree in order to register with the ACME server. Do you agree?

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Would you be willing, once your first certificate is successfully issued, to

share your email address with the Electronic Frontier Foundation, a founding

partner of the Let's Encrypt project and the non-profit organization that

develops Certbot? We'd like to send you email about our work encrypting the web,

EFF news, campaigns, and ways to support digital freedom.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: y

Account registered.

Requesting a certificate for <FQDN>

Successfully received certificate.

Certificate is saved at: /etc/letsencrypt/live/<FQDN>/fullchain.pem

Key is saved at: /etc/letsencrypt/live/<FQDN>/privkey.pem

This certificate expires on 2022-12-15.

These files will be updated when the certificate renews.

NEXT STEPS:

- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

If you like Certbot, please consider supporting our work by:

* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate

* Donating to EFF: https://eff.org/donate-le

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

「Successfully received certificate.」と表示されれば成功
# メッセージ中に記載の通り [/etc/letsencrypt/live/<FQDN>/] 配下に次の証明書が取得されている

# cert.pem ⇒ SSLサーバー証明書(公開鍵含む)
# chain.pem ⇒ 中間証明書
# fullchain.pem ⇒ cert.pem と chain.pem が結合されたファイル
# privkey.pem ⇒ 公開鍵に対する秘密鍵

2. WebサーバーSSL化

2.1 SSLの設定

# a2enmod ssl
# a2enmod -l
actions alias auth_basic authn_core authn_file authz_host authz_groupfile authz_core authz_user autoindex cgi dir env expires include log_config mime negotiation setenvif ssl socache_shmcb userdir reqtimeout cgid php7 version

# a2enmod ssl

# a2enmod -l

actions alias auth_basic authn_core authn_file authz_host authz_groupfile authz_core authz_user autoindex cgi dir env expires include log_config mime negotiation setenvif ssl socache_shmcb userdir reqtimeout cgid php7 version

# vi /etc/apache2/listen.conf
● 17行目：コメント解除
Listen 443

# vi /etc/apache2/listen.conf

● 17行目：コメント解除

Listen 443

# vi /etc/apache2/vhosts.d/default-ssl.conf
# 新規作成
<VirtualHost *:443>
DocumentRoot "/srv/www/htdocs/[webサイト公開ディレクトリー]"
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCertificateFile /etc/letsencrypt/live/<FQDN>/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/<FQDN>/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/<FQDN>/chain.pem
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/srv/www/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
</VirtualHost>

# vi /etc/apache2/vhosts.d/default-ssl.conf

# 新規作成

DocumentRoot "/srv/www/htdocs/[webサイト公開ディレクトリー]"

SSLEngine on

SSLProtocol all -SSLv2 -SSLv3

SSLCertificateFile /etc/letsencrypt/live/<FQDN>/cert.pem

SSLCertificateKeyFile /etc/letsencrypt/live/<FQDN>/privkey.pem

SSLCertificateChainFile /etc/letsencrypt/live/<FQDN>/chain.pem

SSLOptions +StdEnvVars

</FilesMatch>

SSLOptions +StdEnvVars

</Directory>

</VirtualHost>

# systemctl restart apache2

1	# systemctl restart apache2

2.2 HTTP 通信を HTTPS へリダイレクト

HTTP 通信も全て HTTPS へリダイレクトする場合は下記のようにそれぞれのVirtualhost 設定内へ記述します。

# vi /etc/apache2/vhosts.d/virtual_host.conf

<VirtualHost *:80>
ServerName <FQDN>
ServerAdmin <Email address>
DocumentRoot /srv/www/htdocs/<FQDN>
ErrorLog /var/log/apache2/<FQDN>.error.log
CustomLog /var/log/apache2/<FQDN>.access.log combined
LogLevel warn
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</VirtualHost>

# vi /etc/apache2/vhosts.d/virtual_host.conf

ServerName <FQDN>

ServerAdmin <Email address>

DocumentRoot /srv/www/htdocs/<FQDN>

ErrorLog /var/log/apache2/<FQDN>.error.log

CustomLog /var/log/apache2/<FQDN>.access.log combined

LogLevel warn

RewriteEngine On

RewriteCond %{HTTPS} off

RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

</VirtualHost>

# a2enmod rewrite
# a2enmod -l
actions alias auth_basic authn_core authn_file authz_host authz_groupfile authz_core authz_user autoindex cgi dir env expires include log_config mime negotiation setenvif ssl socache_shmcb userdir reqtimeout cgid php7 version rewrite

# a2enmod rewrite

# a2enmod -l

Firewalld を有効にしている場合は HTTPS サービスの許可が必要。HTTPS は 443/TCP を使用します。

# firewall-cmd --add-service=https --permanent
success
# firewall-cmd --reload
success

# firewall-cmd --add-service=https --permanent

success

# firewall-cmd --reload

success

ページのトップへ