Windows Server2022 : ＷＥＢサイト、FTP SSL化

Contents

Let's Encrypt証明書取得及びＷＥＢサイト SSL化
FTP SSL化

Let's Encrypt証明書取得及びＷＥＢサイト SSL化

1.事前準備
・Let's Encrypt から SSL 証明書を定期的に取得する win-acme をダウンロード
・[win-acme.v2.2.9.1701.x64.trimmed.zip]をダウンロード
・[win-acme.v2.2.9.1701.x64.trimmed.zip]の中身をWindows Server の任意のフォルダへ展開

http-01でドメイン名の所有確認する時に、\inetpub/win.korodes.com/.well-known/acme-challenge/に下記内容のファイルを設置しておく必要があります。(\inetpub/win.korodes.com/.well-known/acme-challenge/フォルダがない場合は事前作成しておく)

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
     <system.webServer>
         <staticContent>
             <mimeMap fileExtension="." mimeType="text/xml" />
         </staticContent>
     </system.webServer>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>

<system.webServer>

</staticContent>

</system.webServer>

</configuration>

2.証明書取得
・win-acme の実行(展開したファイルの「wacs.exe」を「管理者権限」で起動)

A simple Windows ACMEv2 client (WACS)
Software version 2.1.23.1315 (release, trimmed, standalone, 64-bit)
Connecting to https://acme-v02.api.letsencrypt.org/...
Connection OK!
Scheduled task not configured yet
Please report issues at https://github.com/win-acme/win-acme

N: Create certificate (default settings)
M: Create certificate (full options)
R: Run renewals (0 currently due)
A: Manage renewals (0 total)
O: More options...
Q: Quit

Please choose from the menu: N　←新しく作成するので「N」を入力

A simple Windows ACMEv2 client (WACS)

Software version 2.1.23.1315 (release, trimmed, standalone, 64-bit)

Connecting to https://acme-v02.api.letsencrypt.org/...

Connection OK!

Scheduled task not configured yet

Please report issues at https://github.com/win-acme/win-acme

N: Create certificate (default settings)

M: Create certificate (full options)

R: Run renewals (0 currently due)

A: Manage renewals (0 total)

O: More options...

Q: Quit

Please choose from the menu: N　←新しく作成するので「N」を入力

Running in mode: Interactive, Simple

Please select which website(s) should be scanned for host names. You may
input one or more site identifiers (comma-separated) to filter by those
sites, or alternatively leave the input empty to scan *all* websites.

2: win.korodes.com (1 binding)

Site identifier(s) or &lt;Enter&gt; to choose all: 2　←対象のサイトの番号を入力

Running in mode: Interactive, Simple

Please select which website(s) should be scanned for host names. You may

input one or more site identifiers (comma-separated) to filter by those

sites, or alternatively leave the input empty to scan *all* websites.

2: win.korodes.com (1 binding)

Site identifier(s) or <Enter> to choose all: 2　←対象のサイトの番号を入力

1: win.korodes.com (Site 2)

Listed above are the bindings found on the selected site(s). By default all
of them will be included, but you may either pick specific ones by typing the
host names or identifiers (comma-separated) or filter them using one of the
options from the menu.

P: Pick bindings based on a search pattern
A: Pick *all* bindings
 
Binding identifiers(s) or menu option: A　←通常はA

1: win.korodes.com (Site 2)

Listed above are the bindings found on the selected site(s). By default all

of them will be included, but you may either pick specific ones by typing the

host names or identifiers (comma-separated) or filter them using one of the

options from the menu.

P: Pick bindings based on a search pattern

A: Pick *all* bindings

Binding identifiers(s) or menu option: A　←通常はA

1: win.korodes.com (Site 2)

Continue with this selection? (y*/n) - yes ←yesで確定する

Source generated using plugin IIS: win.korodes.com

1: win.korodes.com (Site 2)

Continue with this selection? (y*/n) - yes ←yesで確定する

Source generated using plugin IIS: win.korodes.com

途中でTerms of service (利用規約)の同意確認、メールアドレス登録問い合わせもあります

Cached order has status invalid, discarding
[win.korodes.com] Authorizing...
[win.korodes.com] Authorizing using http-01 validation (SelfHosting)
[win.korodes.com] Authorization result: valid
Downloading certificate [IIS] win.korodes.com, (any host)
Store with CertificateStore...
Installing certificate in the certificate store
Adding certificate [IIS] win.korodes.com, (any host) @ 2022/12/4 16:06:21 to store WebHosting
Installing with IIS...
Adding new https binding *:443:win.korodes.com
Committing 1 https binding changes to IIS while updating site 2
Adding Task Scheduler entry with the following settings
- Name win-acme renew (acme-v02.api.letsencrypt.org)
- Path C:\Users\Administrator\Downloads\win-acme.v2.1.23.1315.x64.trimmed
- Command wacs.exe --renew --baseuri "https://acme-v02.api.letsencrypt.org/"
- Start at 09:00:00
- Random delay 04:00:00
- Time limit 02:00:00
Adding renewal for [IIS] win.korodes.com, (any host)
Next renewal due at 2023/1/28 16:06:30
Certificate [IIS] win.korodes.com, (any host) created