py-certbot 설치 및 설정(HTTPS 적용)

- Install py-certbot

# cd /usr/ports/security/py-certbot/

# make install clean

- Configuration

# certbot certonly --webroot --webroot-path /usr/local/www/apache24/data/ -d do9.kr -d www.do9.kr

# certbot certonly --webroot --webroot-path /usr/local/www/apache24/rnd/ -d rnd.do9.kr

httpd.conf 파일 내용 추가

# vi /usr/local/etc/apache24/httpd.conf

Listen 80

Listen 443

<VirtualHost *:80>

    ServerName www.do9.kr

    Redirect / https://www.do9.kr/

</VirtualHost>

<VirtualHost *:443>

    ServerName www.do9.kr

    DocumentRoot /usr/local/www/apache24/data/

    SSLEngine on

    SSLProtocol -ALL +TLSv1 +TLSv1.1 +TLSv1.2

    SSLHonorCipherOrder On

    SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:HIGH:!MD5:!aNULL:!EDH:!RC4

    SSLCertificateFile "/usr/local/etc/letsencrypt/live/do9.kr/fullchain.pem"

    SSLCertificateKeyFile "/usr/local/etc/letsencrypt/live/do9.kr/privkey.pem"

</VirtualHost>  

<VirtualHost *:80>

    ServerName rnd.do9.kr

    Redirect / https://rnd.do9.kr/

</VirtualHost>

<VirtualHost *:443>

    ServerName rnd.do9.kr

    DocumentRoot /usr/local/www/apache24/rnd/

    SSLEngine on

    SSLProtocol -ALL +TLSv1 +TLSv1.1 +TLSv1.2

    SSLHonorCipherOrder On

    SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:HIGH:!MD5:!aNULL:!EDH:!RC4

    SSLCertificateFile "/usr/local/etc/letsencrypt/live/rnd.do9.kr/fullchain.pem"

    SSLCertificateKeyFile "/usr/local/etc/letsencrypt/live/rnd.do9.kr/privkey.pem"

    <Directory "/usr/local/www/apache24/rnd">

        AllowOverride None

        Options None

        Require all granted

    </Directory>

</VirtualHost>

# mod_ssl 모듈 주석 제거

LoadModule ssl_module libexec/apache24/mod_ssl.so

정보를 추가해주고 적용하기 위해서 서비스를 재시작

# apachectl restart

# service apache24 restart

Let’s Encrypt SSL 인증서는 90일마다 갱신이 필요

crontab 명령어를 이용해서 매주 월요일마다 새벽 4시에 인증서 갱신 후 5분 뒤 서버 설정 재적용

# crontab -e

00 4 * * 1 /usr/local/bin/certbot renew >> /var/log/letsencrypt/letsencrypt.log

05 4 * * 1 /usr/local/sbin/apachectl reload