LetsEncrypt 명령어 하나로 간단 셋팅하기

 https://letsencrypt.org

자가 서명 인증서 (무료)

인증서 유효기간은 90일 (30일 미만 남았을때 부터 인증서 갱신 가능)

*.domain 일괄 서브 도메인 등록 불가 (서브 도메인 하나씩 인증서 발급)

certbot 이라는 스크립트 이용하여 인증서 자동 생성, 갱신 가능

도메인 : test.kensei.co.kr

Centos 7 64bit

httpd, mod_ssl (RPM)

yum install epel-release

yum install certbot

yum install python2-certbot-apache

yum install python2-certbot-nginx

SSL 모듈 설치 필요 (mod_ssl)

1. 발급받을 도메인이 certbot을 실행하는 서버 아이피를 바라보고 있어야 함

2. SSL 설정이 되어 있어야 함

ServerName test.kensei.co.kr:443

[root@iwinvhelper-8053 wordpress]# certbot –apache -m takakocap@naver.com -d test.kensei.co.kr -n –agree-tos
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Cert not yet due for renewal
Keeping the existing certificate
Deploying Certificate for test.kensei.co.kr to VirtualHost /etc/httpd/conf.d/ssl.conf

——————————————————————————-
Congratulations! You have successfully enabled https://test.kensei.co.kr

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=test.kensei.co.kr
——————————————————————————-

IMPORTANT NOTES:
 – Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/test.kensei.co.kr/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/test.kensei.co.kr/privkey.pem
   Your cert will expire on 2017-12-19. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the “certonly” option. To non-interactively renew *all* of
   your certificates, run “certbot renew”
 – If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let’s Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le 

SSLCertificateFile /etc/letsencrypt/live/test.kensei.co.kr/cert.pem

SSLCertificateKeyFile /etc/letsencrypt/live/test.kensei.co.kr/privkey.pem

SSLCertificateChainFile /etc/letsencrypt/live/test.kensei.co.kr/chain.pem

ServerAlias test.kensei.co.kr

[root@iwinvhelper-7795 etc]# certbot –nginx -m takakocap@naver.com -d cert.kensei.co.kr -n –agree-tos
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for cert.kensei.co.kr
Waiting for verification…
Cleaning up challenges
Deployed Certificate to VirtualHost /etc/ngi 설치nx/nginx.conf for set([‘cert.kensei.

——————————————————————————-
Congratulations! You have successfully enabled https://cert.kensei.co.kr

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=cert.kensei.co.kr
——————————————————————————-

IMPORTANT NOTES:
 – Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/cert.kensei.co.kr/fullchain.pem. Your cert
   will expire on 2017-12-06. To obtain a new or tweaked version of
   this certificate in the future, simply run certbot again with the
   “certonly” option. To non-interactively renew *all* of your
   certificates, run “certbot renew”
 – If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let’s Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

certbot renew