Contents
1.Obtain an SSL certificate ( Let's Encrypt )
Install the latest open ssl
|
1 |
# dnf install openssl-devel |
1.1 advance preparation
1.Package management system Snappy installed
Since the SSL certificate issuing tool "certbot" of Let's Encrypt is recommended to be installed using "snap" after 2021, install Snapd first.(Can also be installed the traditional way with dnf or yum)
|
1 2 3 |
# dnf install epel-release # dnf upgrade # yum install snapd |
|
1 2 |
# systemctl enable --now snapd.socket Created symlink /etc/systemd/system/sockets.target.wants/snapd.socket → /usr/lib/systemd/system/snapd.socket. |
|
1 |
# ln -s /var/lib/snapd/snap /snap |
|
1 2 3 4 5 6 |
# snap --version snap 2.57.6-2.el9 snapd 2.57.6-2.el9 series 16 almalinux 9.1 kernel 5.14.0-162.6.1.el9_1.x86_64 |
2.certbot package install
|
1 2 |
# snap install --classic certbot certbot 1.32.2 from Certbot Project (certbot-eff?) installed |
Create symbolic link to /snap/bin/certbot
|
1 |
# ln -s /snap/bin/certbot /usr/bin/certbot |
Confirmation
|
1 2 3 4 5 |
# ls -la /usr/bin/certbot lrwxrwxrwx 1 root root 17 Jan 5 13:06 /usr/bin/certbot -> /snap/bin/certbot # ls -la /snap/bin/certbot lrwxrwxrwx 1 root root 13 Jan 5 13:04 /snap/bin/certbot -> /usr/bin/snap |
1.2 Obtaining Certificates
|
1 |
# certbot certonly --webroot -w /var/www/html/[FQDN] -d [FQDN] |
# Specify an email address to receive
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
Saving debug log to /var/log/letsencrypt/letsencrypt.log Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): <mail address> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must agree in order to register with the ACME server. Do you agree? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: y - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Would you be willing, once your first certificate is successfully issued, to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: y Account registered. Requesting a certificate for [FQDN] Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/[FQDN]/fullchain.pem Key is saved at: /etc/letsencrypt/live/[FQDN]/privkey.pem This certificate expires on 2023-04-05. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background. We were unable to subscribe you the EFF mailing list because your e-mail address appears to be invalid. You can try again later by visiting https://act.eff.org. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If you like Certbot, please consider supporting our work by: * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate * Donating to EFF: https://eff.org/donate-le - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
Success if displayed"Successfully received certificate".
# The following certificate is obtained under [/etc/letsencrypt/live/<FQDN>/] as described in the message
# cert.pem ⇒ SSL server certificate (including public key)
# chain.pem ⇒ intermediate certificate
# fullchain.pem ⇒ File containing cert.pem and chain.pem combined
# privkey.pem ⇒ private key
※ Obtaining a Let's Encrypt certificate when the web server is not running
It is a prerequisite that the server on which the work is to be performed is accessible from the Internet at port 80.
# Use the simple Web server function by specifying [--standalone].
# -d [FQDN from which you want to obtain a certificate].
# FQDN (Fully Qualified Domain Name) :Hostname. Domain name without abbreviation
# If there are multiple FQDNs for which you want to obtain certificates, specify multiple -d [FQDNs for which you want to obtain certificates
|
1 |
# certbot certonly --standalone -d <FQDN> |
Renewing certificates already obtained
# Renew all certificates with an expiration date of less than 30 days
# If you want to renew regardless of the number of days remaining on the expiration date, specify [--force-renewal] as well.
|
1 |
# certbot [--force-renewal] renew |
1.2 Automatic renewal of certificates(Let's Encrypt)
①Pre-registration testing
First, test the automatic update using the following --dry-run option.
With this option, certificates are not renewed, only checked, so there is no need to worry about getting stuck with a limit on the number of times a certificate can be obtained.
|
1 |
# certbot renew --dry-run |
②When you install the snap version of certbot, the automatic certificate renewal function is also installed.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
# systemctl list-timers | less NEXT LEFT LAST PASSED UNIT ACTIVATES Thu 2023-01-05 13:58:10 JST 11min left Thu 2023-01-05 13:28:14 JST 18min ago pmie_farm_check.timer pmie_farm _check.service Thu 2023-01-05 14:10:19 JST 24min left n/a n/a dnf-makecache.timer dnf-makecache.service Thu 2023-01-05 14:55:00 JST 1h 8min left n/a n/a snap.certbot.renew.timer snap.certbot.renew.service Fri 2023-01-06 00:00:00 JST 10h left Thu 2023-01-05 08:34:24 JST 5h 11min ago logrotate.timer logrotate.service Fri 2023-01-06 00:00:00 JST 10h left Thu 2023-01-05 08:34:24 JST 5h 11min ago mlocate-updatedb.timer mlocate-updatedb.service Fri 2023-01-06 00:00:00 JST 10h left n/a n/a sa-update.timer sa-update.service Fri 2023-01-06 00:00:00 JST 10h left Thu 2023-01-05 08:34:24 JST 5h 11min ago unbound-anchor.timer unbound-anchor.service Fri 2023-01-06 00:07:00 JST 10h left n/a n/a sysstat-summary.timer sysstat-summary.service Fri 2023-01-06 00:08:00 JST 10h left Thu 2023-01-05 08:34:39 JST 5h 11min ago pmie_daily.timer pmie_daily.service Fri 2023-01-06 00:10:00 JST 10h left Thu 2023-01-05 08:34:41 JST 5h 11min ago pmlogger_daily.timer pmlogger_daily.service Fri 2023-01-06 13:30:31 JST 23h left Thu 2023-01-05 13:30:31 JST 15min ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service |
snap.certbot.renew.timer is registered
Check the unit file snap.certbot.renew.timer
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
# vi /etc/systemd/system/snap.certbot.renew.timer [Unit] # Auto-generated, DO NOT EDIT Description=Timer renew for snap application certbot.renew Requires=var-lib-snapd-snap-certbot-2414.mount After=var-lib-snapd-snap-certbot-2414.mount X-Snappy=yes [Timer] Unit=snap.certbot.renew.service OnCalendar=*-*-* 04:49 OnCalendar=*-*-* 15:16 [Install] WantedBy=timers.target |
According to the above configuration, it will attempt to update at 4:49 and 15:16 every day as specified in the OnCalender parameter(However, the set time changes randomly with each update)
Check the unit file snap.certbot.renew.service
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
# vi /etc/systemd/system/snap.certbot.renew.service [Unit] # Auto-generated, DO NOT EDIT Description=Service for snap application certbot.renew Requires=var-lib-snapd-snap-certbot-2414.mount Wants=network.target After=var-lib-snapd-snap-certbot-2414.mount network.target snapd.apparmor.service X-Snappy=yes [Service] EnvironmentFile=-/etc/environment ExecStart=/usr/bin/snap run --timer="00:00~24:00/2" certbot.renew SyslogIdentifier=certbot.renew Restart=no WorkingDirectory=/var/snap/certbot/2414 TimeoutStopSec=30 Type=oneshot |
However, the web server using the certificate will not be restarted, so set up a script to run automatically after the update
|
1 2 3 4 |
# vim /etc/letsencrypt/renewal-hooks/post/web_restart.sh #!/bin/bash systemctl reload httpd |
|
1 |
# chmod 755 /etc/letsencrypt/renewal-hooks/post/web_restart.sh |
2. Converting Apache to https
Install the following just in case
|
1 |
# dnf -y install mod_ssl |
2.1 Edit ssl.conf file
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# vi /etc/httpd/conf.d/ssl.conf ●Line 43 : Uncomment and change DocumentRoot "/var/www/html/<FQDN>" ●Line 44 : Uncomment and change ServerName <Domain>:443 ●Line 85 : Make it a comment and add it below # SSLCertificateFile /etc/pki/tls/certs/localhost.crt SSLCertificateFile /etc/letsencrypt/live/<FQDN>/cert.pem ●Line 93 : Make it a comment and add it below # SSLCertificateKeyFile /etc/pki/tls/private/localhost.key SSLCertificateKeyFile /etc/letsencrypt/live/<FQDN>/privkey.pem ●Line 103 : Add SSLCertificateChainFile /etc/letsencrypt/live/<FQDN>/chain.pem |
|
1 |
# systemctl restart httpd |
|
1 2 3 4 |
# firewall-cmd --add-service=https --permanent success # firewall-cmd --reload success |
2.2 Redirect HTTP communications to HTTPS
|
1 2 3 |
RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] |
3. SSL/TLS (Let's Encrypt) settings on the mail server
3.1 Obtaining a certificate for the mail server
Obtain a certificate for the mail server, but it cannot be obtained in the same way as above, so the following with the "--standalone" option fails.
|
1 |
# certbot certonly --standalone -d mail.<domain name> |
If I stop the web server once and then do it, it succeeds as follows
|
1 2 |
# systemctl stop httpd.service # certbot certonly --standalone -d mail.<domain name> |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
Saving debug log to /var/log/letsencrypt/letsencrypt.log Requesting a certificate for mail.<domain name> Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/mail.<domain name>/fullchain.pem Key is saved at: /etc/letsencrypt/live/mail.<domain name>/privkey.pem This certificate expires on 2023-04-05. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If you like Certbot, please consider supporting our work by: * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate * Donating to EFF: https://eff.org/donate-le - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
3.2 Postfix Configuration
|
1 2 3 4 5 6 7 8 9 10 11 |
# vi /etc/postfix/main.cf ●Per lines 709, 715 : comment #smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem #smtpd_tls_key_file = /etc/pki/tls/private/postfix.key ● Add to the last line smtpd_use_tls = yes smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_cert_file = /etc/letsencrypt/live/mail.<domain name>/fullchain.pem smtpd_tls_key_file = /etc/letsencrypt/live/mail.<domain name>/privkey.pem smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache |
|
1 2 3 4 5 6 7 8 9 10 11 |
# vi /etc/postfix/master.cf ● Line 19-22 : Uncomment submission inet n - n - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes ● Line 31-34 : Uncomment smtps inet n - n - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes |
3.3 Dovecot Settings
|
1 2 3 4 5 6 |
# vi /etc/dovecot/conf.d/10-ssl.conf ● Line 8：confirmation ssl = yes ● Line 14,15：Make it a comment and add certificate/key file designation under it ssl_cert = </etc/letsencrypt/live/mail.<domain name>/fullchain.pem ssl_key = </etc/letsencrypt/live/mail.<domain name>/privkey.pem |
|
1 2 |
# firewall-cmd --add-port=587/tcp --permanent # firewall-cmd --reload |
|
1 |
# systemctl restart postfix dovecot |
3.4 Thunderbird Settings
Connection security : STARTTLS
Authentication method : Normal password
Connection security : STARTTLS
Authentication method : Normal password
