Raspberry PiにLet's EncryptのSSL証明書
現時点ですと、EncryptのSSLを発行する際に、通常の方法ですとポート８０を証明書を発行したい（SSL証明書を受け取りたい）サーバーで開放する必要がありました。
よって、Raspberry Piでは、自己証明書SSLを利用しておりました。Raspberry Piの自己証明書SSL
ポート８０を利用しているSynologyは、Synologyの機能を用いて、Let's Encryptの証明書を導入しております。Synology無料SSL証明書導入（Let’s Encrypt）
最近の便利さには、日々関心しておりますが、今回の驚きも大きかったです。
Apacheの設定まで確認し、必要な証明書を確認し、各種設定含め自動実行出来ます。
cerbotおよびpython-cerbot-apacheの導入
@raspberrypi:~ $ sudo apt-get install certbot
@raspberrypi:~ $ sudo apt-get install python-certbot-apache
python-cerbot-apacheをインストール祭に、次のパケケージもインストールされます。python3-augeas python3-certbot-apache
cerbot --apacheを実行し、SSL証明書発行およびapacheのSSL設定
cerbot --apacheを実行し、SSL証明書を設定したいドメインを選択し、SSL証明書の発行およびApacheのSSL関係設定を実施します。
実際には、対象ドメインの選択のみで、全て自動で設定されます。
@raspberrypi:~ $ sudo certbot --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: www.domain1.com
2: aaa.domain2.com
3: www.domain2.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 2,3
Obtaining a new certificate
Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/aaa.domain2-ssl.conf
Created an SSL vhost at /etc/apache2/sites-available/domain2-le-ssl.conf
Deploying Certificate to VirtualHost /etc/apache2/sites-available/domain2-le-ssl.conf
Enabling available site: /etc/apache2/sites-available/domain2-le-ssl.conf
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Redirecting vhost in /etc/apache2/sites-enabled/aaa.domain2.conf to ssl vhost in /etc/apache2/sites-enabled/aaa.domain2-ssl.conf
Redirecting vhost in /etc/apache2/sites-enabled/domain2.conf to ssl vhost in /etc/apache2/sites-available/domain2-le-ssl.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://aaa.domain2.com and
https://www.domain2.com
You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=aaa.domain2.com
https://www.ssllabs.com/ssltest/analyze.html?d=www.domain2.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/aaa.domain2.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/aaa.domain2.com/privkey.pem
Your cert will expire on 2019-12-03. To obtain a new or tweaked
version of this certificate in the future, simply run certbot again
with the "certonly" option. To non-interactively renew *all* of
your certificates, run "certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
cerbot renewで証明書更新をテスト
証明書の有効期限が１ヶ月未満になると、証明書の再取得が行われます。
コマンド実行をテストし、次のステップで、cronの定期実行ジョブとして、コマンドラインを登録します。
@raspberrypi:/var/www/vhosts/aaa.domain2.com $ sudo certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/domain2.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not yet due for renewal
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/aaa.domain2.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not yet due for renewal
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certs are not due for renewal yet:
/etc/letsencrypt/live/domain2.com/fullchain.pem expires on 2019-12-03 (skipped)
/etc/letsencrypt/live/aaa.domain2.com/fullchain.pem expires on 2019-12-03 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
cronの定期実行ジョブ登録
以下の例では、毎週日曜日の深夜１時にcertbot renewが実行されるように登録しています。
0 1 * * 7 certbot renew
アイ・オー・データ
¥7,280 (2024/11/23 11:38:18時点 Amazon調べ-詳細)
