Web�T�[�o�[�ԒʐM���e�Í����iApache+mod_SSL+Certbot�j

�ŏI�X�V���F 2023.02.23

[root@centos ~]# yum -y install epel-release�@���@yum�pEPEL���|�W�g���C���X�g�[��

[root@centos ~]# yum -y install snapd�@���@snapd�C���X�g�[��

[root@centos ~]# systemctl enable --now snapd.socket�@���@snapd.socket�L����

[root@centos ~]# ln -s /var/lib/snapd/snap /snap�@���@/var/lib/snapd/snap����/snap�փ����N�𒣂�

[root@centos ~]# snap install --classic certbot�@���@certbot�C���X�g�[��

[root@centos ~]# ln -s /snap/bin/certbot /usr/bin/certbot�@���@/snap/bin/certbot����/usr/bin/certbot�փ����N�𒣂�

[root@centos ~]# certbot certonly --webroot -w �h�L�������g���[�g -m ���[���A�h���X -d Web�T�[�o�[�� --agree-tos�@���@�T�[�o�[�ؖ����擾


�|�|�p�����[�^�w���|�|
�h�L�������g���[�g��/var/www/html/centos/
���[���A�h���X�˔C�ӂ̃��[���A�h���X
Web�T�[�o�[����centossrv.com


Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for centossrv.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/centossrv.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/centossrv.com/privkey.pem
This certificate expires on 2023-01-14.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[root@centos ~]# yum -y install mod_ssl�@���@mod_ssl�C���X�g�[��

[root@centos ~]# vi /etc/httpd/conf.d/ssl.conf�@���@SSL�ݒ�t�@�C���ҏW
#   Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate.  If
# the certificate is encrypted, then you will be prompted for a
# pass phrase.  Note that a kill -HUP will prompt again.  A new
# certificate can be generated using the genkey(1) command.
SSLCertificateFile /etc/letsencrypt/live/centossrv.com/cert.pem�@���@���J���w��

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile /etc/letsencrypt/live/centossrv.com/privkey.pem�@���@�閧���w��

#   Server Certificate Chain:
#   Point SSLCertificateChainFile at a file containing the
#   concatenation of PEM encoded CA certificates which form the
#   certificate chain for the server certificate. Alternatively
#   the referenced file can be the same as SSLCertificateFile
#   when the CA certificates are directly appended to the server
#   certificate for convinience.
SSLCertificateChainFile /etc/letsencrypt/live/centossrv.com/chain.pem�@���@���ԏؖ����w��

[root@centos ~]# vi /etc/httpd/conf.d/ssl.conf�@���@SSL�ݒ�t�@�C���ҏW
#   SSL Protocol support:
# List the enable protocol levels with which clients will be able to
# connect.  Disable SSLv2 access by default:
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1�@���@TLS 1.2�̂ݗL��

#   Speed-optimized SSL Cipher configuration:
#   If speed is your main concern (on busy HTTPS servers e.g.),
#   you might want to force clients to specific, performance
#   optimized ciphers. In this case, prepend those ciphers
#   to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
#   Caveat: by giving precedence to RC4-SHA and AES128-SHA
#   (as in the example below), most connections will no longer
#   have perfect forward secrecy - if the server's key is
#   compromised, captures of past or future traffic must be
#   considered compromised, too.
#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
#SSLHonorCipherOrder on
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS�@���@�lj��i�g�p����������@�j
SSLHonorCipherOrder on�@���@�lj��i�Í������@���T�[�o�[���Ō���j

Header always set Strict-Transport-Security "max-age=15768000"�@���@�lj��iHSTS���펞HTTPS�A�N�Z�X�̗L�����j
</VirtualHost>

[root@centos ~]# vi /etc/httpd/conf.d/ssl.conf�@���@SSL�ݒ�t�@�C���ҏW
# Use separate log files for the SSL virtual host; note that LogLevel
# is not inherited from httpd.conf.
ErrorLog logs/error_log�@���@���O�t�@�C�����ύX
CustomLog logs/access_log combined env=!no_log�@���@���O�擾�f�B���N�e�B�u�ƃ��O�t�@�C�����ύX
LogLevel warn

[root@centos ~]# systemctl reload httpd�@���@Apache�ݒ蔽�f

[root@centos ~]# vi /etc/cron.monthly/certbot�@���@�T�[�o�[�ؖ��������X�V�X�N���v�g�쐬
#!/bin/bash
log=`mktemp`
code=0

which certbot > /dev/null 2>&1
if [ $? -eq 0 ]; then
    CERTBOT=`which certbot`
else
    CERTBOT=`which certbot-auto`
fi

#
# �ؖ����X�V
#
for conf in `ls /etc/letsencrypt/renewal/`
do
    # �h���C�����擾
    domain=`echo ${conf}|sed -e 's/\([^ ]*\)\.conf/\1/p' -e d`

    # �F�ؕ����擾
    authenticator=`grep authenticator /etc/letsencrypt/renewal/${conf}|awk '{print $3}'`

    if [ ${authenticator} = 'webroot' ]; then
        # Web�F�؂̏ꍇ

        # �h�L�������g���[�g�擾
        webroot=`grep webroot_path /etc/letsencrypt/renewal/${conf}|grep =|awk '{print $3}'|awk -F '[,]' '{print $1}'`

        # �ؖ����X�V
        ${CERTBOT} certonly --webroot \
        -w ${webroot} -d ${domain} --renew-by-default >> ${log} 2>&1
        [ $? -ne 0 ] && cat ${log}
    else
        # �X�^���h�A�����F�؂̏ꍇ

        # �ؖ����X�V
        lsof -i:80 > /dev/null 2>&1
        if [ $? -eq 0 ]; then
            echo 'Web�T�[�o�[�ғ����̂��߃X�^���h�A�����F�ؕs��'
        else
            ${CERTBOT} certonly -a standalone \
            -d ${domain} --renew-by-default >> ${log} 2>&1
            [ $? -ne 0 ] && cat ${log}
        fi
    fi
    
    # �Â��ؖ������폜
    find /etc/letsencrypt/archive/${domain}/ -mtime +30 -delete
    
done

#
# �ؖ����X�V���f
#

# Web�T�[�o�[�ݒ�ēǍ���
lsof -i:443 > /dev/null 2>&1
if [ $? -eq 0 ]; then
    rpm -q systemd > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        systemctl reload httpd
    else
        /etc/rc.d/init.d/httpd reload > /dev/null 2>&1
    fi
fi

# SMTP�T�[�o�[�ݒ�ēǍ���
lsof -i:465 > /dev/null 2>&1
if [ $? -eq 0 ]; then
    rpm -q systemd > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        systemctl reload postfix
    else
        /etc/rc.d/init.d/postfix reload > /dev/null 2>&1
    fi
fi

# IMAP�T�[�o�[�ݒ�ēǍ���
lsof -i:995 > /dev/null 2>&1
if [ $? -eq 0 ]; then
    rpm -q systemd > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        systemctl reload dovecot
    else
        /etc/rc.d/init.d/dovecot reload > /dev/null 2>&1
    fi
fi

#
# ���O��syslog�֏o�͌�폜
#
cat ${log}|logger -t `basename ${0}` ; rm -f ${log}

[root@centos ~]# chmod +x /etc/cron.monthly/certbot�@���@�T�[�o�[�ؖ��������X�V�X�N���v�g�֎��s�����t��