ApacheのVirtualhostを使って多数のサイトを公開の中、pi.homeunix.net を追加したいとする。
まずはport80と443で開けるように、それぞれのvirtualhostのconfを用意する。443用のconfに、ssl鍵のエントリは不要。 ServerNameとServerAdmin、DocumentRoot とDirectoryが有ればよい。
その上で
# certbot -d pi.homeunix.net
とすると*.443のconfファイルにletsencryptの鍵が自動的に追加される。
実例(2020/11/28)
root@hyper:/etc/apache2/sites-enabled# certbot -d pi.homeunix.net
Saving debug log to /var/log/letsencrypt/letsencrypt.log)
Plugins selected: Authenticator apache, Installer apache
Obtaining a new certificate
Created an SSL vhost at /etc/apache2/sites-enabled/vhost-le-ssl.conf
Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/vhost-le-ssl.conf
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 1
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://pi.homeunix.net
You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=pi.homeunix.net
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/pi.homeunix.net-0001/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/pi.homeunix.net-0001/privkey.pem
Your cert will expire on 2021-02-26. To obtain a new or tweaked
version of this certificate in the future, simply run certbot again
with the "certonly" option. To non-interactively renew *all* of
your certificates, run "certbot renew"
- Some rewrite rules copied from
/etc/apache2/sites-enabled/vhost.conf were disabled in the vhost
for your HTTPS site located at
/etc/apache2/sites-enabled/vhost-le-ssl.conf because they have the
potential to create redirection loops.
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
root@hyper:/etc/apache2/sites-enabled#
コメント