certbotのインストール
nginxにSSLを入れるのでこちらをインストール
# emerge app-crypt/certbot-nginx
証明書の発行
let's encryptがサイトの存在を確認しにファイルを探しに来るので、そのファイルにアクセスできるようにしておく、なんかファイル置いてブラウザで見れるか確認しておいた方がいい。
# mkdir -p /var/www/localhost/htdocs/.well-known/acme-challengeでcertbotを実行
# certbot certonly --webroot -w /var/www/localhost/htdocs -d www.karky7.com Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator webroot, Installer None Obtaining a new certificate Performing the following challenges: http-01 challenge for www.karky7.com Using the webroot path /var/www/localhost/htdocs for all unmatched domains. Waiting for verification... Cleaning up challenges Unable to clean up challenge directory /var/www/localhost/htdocs/.well-known/acme-challenge IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/www.karky7.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/www.karky7.com/privkey.pem Your cert will expire on 2018-07-21. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
nginxへ設定
nginx.confにSSLの設定をいれる
server {
listen IP.xxx.xxx.xxx:443;
server_name www.karky7.com;
access_log /var/log/nginx/kuso.access_log_443 main;
error_log /var/log/nginx/kuso.error_log_443 info;
ssl on;
ssl_certificate /etc/letsencrypt/live/www.karky7.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.karky7.com/privkey.pem;
root /var/kuso/www;
autoindex on;
error_page 404 /error/404.html;
}
で完了、結構簡単にできました、ちなみに「certbot run」はうまくいきませんでした。あとはrenewで自動更新すればいいらしい、今度設定する
