Ubuntu 18.04
에서 Let’s Encrypt SSL Cert 설치 방법이 달라졌다.
1. Install Let’s Encrypt client (Certbot)
|
1 2 3 4 5 |
sudo add-apt-repository ppa:certbot/certbot sudo apt update sudo apt install python-certbot-apache |
2. Get an SSL Certificate
|
1 2 3 |
sudo certbot --apache -d test.com -d www.test.com |
결과
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 1:수정없이 2:자동수정되게 (아래와 같은 문제 발생됨) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Your existing certificate has been successfully renewed, and the new certificate has been installed. The new certificate covers the following domains: https://aaa.auctionpro.co.kr You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=aaa.auctionpro.co.kr - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
2.1 delete SSL (필요시)
|
1 2 3 |
sudo certbot delete --cert-name example.com |
3. Test SSL
4. Auto Renewal (최신버전 설치 되면 자동으로 Renewal 됩니다)
Ubuntu에서 Let’s Encrypt를 설치하고 인증서를 발급하면, 기본적으로 인증서 갱신 작업이 자동으로 설정됩니다. Ubuntu의 Certbot 패키지는 systemd 타이머를 사용하여 자동 갱신을 관리합니다.
확인
|
1 2 3 4 |
# sudo systemctl list-timers | grep certbot Wed 2024-06-12 03:06:06 KST 11h left Tue 2024-06-11 13:54:46 KST 1h 22min ago certbot.timer certbot.service |
:::::::::::::::::::::::::::::::::: 아래 사항 생략:::::::::::::::::::::::::::::::::::
|
1 2 3 |
sudo certbot renew --dry-run |
결과
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/aaa.auctionpro.co.kr.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Cert not due for renewal, but simulating renewal for dry run Plugins selected: Authenticator apache, Installer apache Renewing an existing certificate Performing the following challenges: http-01 challenge for aaa.auctionpro.co.kr Waiting for verification... Cleaning up challenges - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - new certificate deployed with reload of apache server; fullchain is /etc/letsencrypt/live/aaa.auctionpro.co.kr/fullchain.pem - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
참조 : https://devanswers.co/lets-encrypt-ssl-apache-ubuntu-18-04/
Err _체크중
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
The following certs could not be renewed: /etc/letsencrypt/live/test.co.kr/fullchain.pem (failure) ** DRY RUN: simulating 'certbot renew' close to cert expiry ** (The test certificates above have not been saved.) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 renew failure(s), 0 parse failure(s) IMPORTANT NOTES: - The following errors were reported by the server: Domain: test.co.kr Type: unauthorized Detail: Invalid response from http://test.co.kr/.well-known/acme-challenge/gIhY691KGj6PEy7kvTEqozV UPaLBRXQ4dnJs1C6pZEY [211.233.46.9]: "<!doctype html><html lang=\"en\"><head><title>HTTP Status 404 – Not Found</title><style type=\"text/css\">h1 {font-family:Tahoma,A" To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address. |
위사항은 jsp 를 연결 할 포트가 달라서 발생하는 오류 입니다. php 연결로 잠시 변경하고 renewal 하면 됩니다.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/images.mysite.co.kr.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Attempting to parse the version 0.27.1 renewal configuration file found at /etc/letsencrypt/renewal/images.mysite.co.kr.conf with version 0.26.1 of Certbot. This might not work. Cert is due for renewal, auto-renewing... Plugins selected: Authenticator standalone, Installer None Renewing an existing certificate Performing the following challenges: http-01 challenge for images.mysite.co.kr Cleaning up challenges Attempting to renew cert (images.mysite.co.kr) from /etc/letsencrypt/renewal/images.mysite.co.kr.conf produced an unexpected error: Problem binding to port 80: Could not bind to IPv4 or IPv6.. Skipping. The following certs could not be renewed: /etc/letsencrypt/live/uapi.ihavenomoney.co.kr/fullchain.pem (failure) /etc/letsencrypt/live/bitcoin.ihavenomoney.co.kr/fullchain.pem (failure) /etc/letsencrypt/live/images.mysite.co.kr/fullchain.pem (failure) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ** DRY RUN: simulating 'certbot renew' close to cert expiry ** (The test certificates below have not been saved.) The following certs were successfully renewed: /etc/letsencrypt/live/jsp.mysite.co.kr/fullchain.pem (success) The following certs could not be renewed: /etc/letsencrypt/live/uapi.ihavenomoney.co.kr/fullchain.pem (failure) /etc/letsencrypt/live/bitcoin.ihavenomoney.co.kr/fullchain.pem (failure) /etc/letsencrypt/live/images.mysite.co.kr/fullchain.pem (failure) ** DRY RUN: simulating 'certbot renew' close to cert expiry ** (The test certificates above have not been saved.) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 3 renew failure(s), 0 parse failure(s) |
다음 에러시
|
1 2 3 4 |
/etc/apache2/sites-available# systemctl reload apache2 Job for apache2.service failed because the control process exited with error code. |
|
1 2 3 |
sudo a2enmod rewrite |