[Linux + https] 443 https 적용 > Linux/Apm

[세팅환경] 

Linux Mint(Ubuntu 20.4)

xampp 설치(리눅스버전)

[letsencrypt 설치 + 인증키 발급]

sudo apt-get install letsencrypt 

sudo letsencrypt certonly --webroot-path=/opt/lampp/htdocs -d yesman.kr

인증키발급 받으면... 아래 저장소(/etc/letsencrypt/archive/yesman.kr)에 생성됨

root@okok-desktop:/etc/letsencrypt/archive/yesm​an.kr# ls -al

-rw-r--r-- 1 root root 1822  3월  7 19:02 cert1.pem

-rw-r--r-- 1 root root 1822  3월  7 19:09 cert2.pem

-rw-r--r-- 1 root root 3750  3월  7 19:02 chain1.pem

-rw-r--r-- 1 root root 3750  3월  7 19:09 chain2.pem       

-rw-r--r-- 1 root root 5572  3월  7 19:02 fullchain1.pem

-rw-r--r-- 1 root root 5572  3월  7 19:09 fullchain2.pem

-rw------- 1 root root 1704  3월  7 19:02 privkey1.pem

-rw------- 1 root root 1708  3월  7 19:09 privkey2.pem

/opt/lampp/etc/extra/httpd-ssl.conf      <= 리눅스mint httpd-ssl.conf 파일경로(extra설정파일) 

/etc/letsencrypt/live/yesman.kr  <== letsencrypt 인증받으면 이곳에서 pem키파일들을 링크해 놓고 있음

root@okok-desktop:/etc/letsencrypt/live/yesman.kr# ls -al         **루트권한으로 아래 목록 볼수 있음

lrwxrwxrwx 1 root root   31  3월  7 19:09 cert.pem -> ../../archive/yesman.kr/cert2.pem

lrwxrwxrwx 1 root root   32  3월  7 19:09 chain.pem -> ../../archive/yesman.kr/chain2.pem

lrwxrwxrwx 1 root root   36  3월  7 19:09 fullchain.pem -> ../../archive/yesman.kr/fullchain2.pem

lrwxrwxrwx 1 root root   34  3월  7 19:09 privkey.pem -> ../../archive/yesman.kr/privkey2.pem

/etc/letsencrypt/renewal/yesman.kr.conf  파일내용

root@okok-desktop:/etc/letsencrypt/renewal# cat yesman.kr.conf

# renew_before_expiry = 30 days

version = 0.40.0

archive_dir = /etc/letsencrypt/archive/yesman.kr

cert = /etc/letsencrypt/live/yesman.kr/cert.pem

privkey = /etc/letsencrypt/live/yesman.kr/privkey.pem

chain = /etc/letsencrypt/live/yesman.kr/chain.pem

fullchain = /etc/letsencrypt/live/yesman.kr/fullchain.pem

# Options used in the renewal process

[renewalparams]

account = 1f971017c331d297c9d61f08ff579c3e

authenticator = webroot

server = https://acme-v02.api.letsencrypt.org/directory

webroot_path = /opt/lampp/htdocs,

[[webroot_map]]

/opt/lampp/etc/extra/httpd-ssl.conf 편집

#General setup for the virtual host

DocumentRoot "/opt/lampp/htdocs"

ServerName www.yesman.kr:443

ServerAdmin yesman@gmail.com

ErrorLog "/opt/lampp/logs/error_log"

TransferLog "/opt/lampp/logs/access_log"

**기존 SSLCertificateFile 들은 주석처리.. 아래내용 추가

SSLCertificateFile /etc/letsencrypt/live/yesman.kr/cert.pem

SSLCertificateKeyFile /etc/letsencrypt/live/yesman.kr/privkey.pem

SSLCertificateChainFile /etc/letsencrypt/live/yesman.kr/chain.pem

service xampp restart

[letsencrypt 인증서 자동 갱신 설정]

crontab에 매달1일 인증서 갱신하는 하도록 추가.

sudo nano /etc/crontab

0 0 1 * * root certbot renew -q --renew-hook="systemctl restart xampp"

--renew-hook 옵션으로 인증키 재발급 후 웹서버 재시작

기타 필요한 크론탭 설정

*/10 * * * * root  /usr/bin/curl -s 'http://ddns.dns.com/set.html?user=yeman007&auth=b6hgh975jpo9nb&domain=yesman.kr&record=' >> /var/log/cron_dns.log 2>&1

service cron restart

service cron status

https://blogger.pe.kr/824

https://blog.jiniworld.me/137

https://devlog.jwgo.kr/2019/04/16/how-to-lets-encrypt-ssl-renew/