Raspberry PiにLet’s EncryptのSSL証明書
現時点ですと、EncryptのSSLを発行する際に、通常の方法ですとポート８０を証明書を発行したい（SSL証明書を受け取りたい）サーバーで開放する必要がありました。
よって、Raspberry Piでは、自己証明書SSLを利用しておりました。Raspberry Piの自己証明書SSL
ポート８０を利用しているSynologyは、Synologyの機能を用いて、Let's Encryptの証明書を導入しております。Synology無料SSL証明書導入（Let’s Encrypt）
最近の便利さには、日々関心しておりますが、今回の驚きも大きかったです。
Apacheの設定まで確認し、必要な証明書を確認し、各種設定含め自動実行出来ます。
cerbotおよびpython-cerbot-apacheの導入
@raspberrypi:~ $ sudo apt-get install certbot @raspberrypi:~ $ sudo apt-get install python-certbot-apache
python-cerbot-apacheをインストール祭に、次のパケケージもインストールされます。python3-augeas python3-certbot-apache
cerbot --apacheを実行し、SSL証明書発行およびapacheのSSL設定
cerbot --apacheを実行し、SSL証明書を設定したいドメインを選択し、SSL証明書の発行およびApacheのSSL関係設定を実施します。
実際には、対象ドメインの選択のみで、全て自動で設定されます。
@raspberrypi:~ $ sudo certbot --apache Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Which names would you like to activate HTTPS for? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: www.domain1.com 2: aaa.domain2.com 3: www.domain2.com - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate numbers separated by commas and/or spaces, or leave input blank to select all options shown (Enter 'c' to cancel): 2,3 Obtaining a new certificate Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/aaa.domain2-ssl.conf Created an SSL vhost at /etc/apache2/sites-available/domain2-le-ssl.conf Deploying Certificate to VirtualHost /etc/apache2/sites-available/domain2-le-ssl.conf Enabling available site: /etc/apache2/sites-available/domain2-le-ssl.conf Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 Redirecting vhost in /etc/apache2/sites-enabled/aaa.domain2.conf to ssl vhost in /etc/apache2/sites-enabled/aaa.domain2-ssl.conf Redirecting vhost in /etc/apache2/sites-enabled/domain2.conf to ssl vhost in /etc/apache2/sites-available/domain2-le-ssl.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations! You have successfully enabled https://aaa.domain2.com and https://www.domain2.com You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=aaa.domain2.com https://www.ssllabs.com/ssltest/analyze.html?d=www.domain2.com - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/aaa.domain2.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/aaa.domain2.com/privkey.pem Your cert will expire on 2019-12-03. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
cerbot renewで証明書更新をテスト
証明書の有効期限が１ヶ月未満になると、証明書の再取得が行われます。
コマンド実行をテストし、次のステップで、cronの定期実行ジョブとして、コマンドラインを登録します。
@raspberrypi:/var/www/vhosts/aaa.domain2.com $ sudo certbot renew Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/domain2.com.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Cert not yet due for renewal - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/aaa.domain2.com.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Cert not yet due for renewal - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - The following certs are not due for renewal yet: /etc/letsencrypt/live/domain2.com/fullchain.pem expires on 2019-12-03 (skipped) /etc/letsencrypt/live/aaa.domain2.com/fullchain.pem expires on 2019-12-03 (skipped) No renewals were attempted. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
cronの定期実行ジョブ登録
以下の例では、毎週日曜日の深夜１時にcertbot renewが実行されるように登録しています。
0 1 * * 7 certbot renew
