{"id":978,"date":"2017-02-23T15:02:54","date_gmt":"2017-02-23T06:02:54","guid":{"rendered":"https:\/\/takumi9942.net\/blog\/?p=978"},"modified":"2024-09-15T14:49:37","modified_gmt":"2024-09-15T05:49:37","slug":"how-to-setup-nginx-with-letsencrypt","status":"publish","type":"post","link":"https:\/\/takumi9942.net\/blog\/?p=978","title":{"rendered":"\u3010Conoha\u3011CentOS7+Nginx\u306e\u74b0\u5883\u306bLet’s Encrypt\u3092\u5165\u308c\u3066https\u306b\u5bfe\u5fdc\u3055\u305b\u3066\u307f\u305f"},"content":{"rendered":"

\u524d\u56de\u3001VPS\u306b\u300cCentOS7+Nginx+PHP\u300d\u306e\u74b0\u5883\u3092\u69cb\u7bc9\u3057\u307e\u3057\u305f\u3002
\n\u4eca\u56de\u306fLet’s Encrypt\u3092\u4f7f\u7528\u3057\u3066\u3001\u7121\u6599\u3067\u30b5\u30a4\u30c8\u3092https\u306b\u5bfe\u5fdc\u3055\u305b\u305f\u3044\u3068\u601d\u3044\u307e\u3059\u3002
\n
\n0. Let’s Encrypt\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u306b\u306fepel\u30ec\u30dd\u30b8\u30c8\u30ea\u304c\u5fc5\u8981\u3067\u3059\u3002epel\u30ec\u30dd\u30b8\u30c8\u30ea\u3092\u307e\u3060\u5c0e\u5165\u3057\u3066\u3044\u306a\u3044\u5834\u5408\u306f\u3001\u524d\u56de\u306e\u8a18\u4e8b<\/a>\u3092\u53c2\u8003\u306b\u3057\u3066\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n

1.\u307e\u305a\u8a3c\u660e\u66f8\u767a\u884c\u306b\u5fc5\u8981\u306a\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059\u3002<\/p>\n

yum install certbot\r\n<\/pre>\n
2.\u30c9\u30e1\u30a4\u30f3\u540d\u3067Nginx\u306e\u30c6\u30b9\u30c8\u30da\u30fc\u30b8\u3078\u30a2\u30af\u30bb\u30b9\u3067\u304d\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u30c9\u30e1\u30a4\u30f3\u3092\u8a2d\u5b9a\u3057\u3066\u3044\u306a\u3044\u5834\u5408\u306f\u3001DNS\u8a2d\u5b9a\u304b\u3089VPS\u306eIP\u30a2\u30c9\u30ec\u30b9\u3092A\u30ec\u30b3\u30fc\u30c9\u306b\u767b\u9332\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n
3.\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3066\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n
certbot certonly\r\n<\/pre>\n
4.\u30e1\u30cb\u30e5\u30fc\u753b\u9762\u304c\u8868\u793a\u3055\u308c\u308b\u306e\u30671\u3092\u9078\u629e\u3057\u3066OK\u3092\u9078\u629e\u3057\u307e\u3059<\/p>\n
\"\"<\/a><\/p>\n
5.\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3092\u5165\u529b\u3057\u307e\u3059<\/p>\n
\"\"<\/a><\/p>\n
6.\u5229\u7528\u898f\u7d04\u3092\u8aad\u307f\u3001\u540c\u610f\uff08Agree\uff09\u3057\u307e\u3059\u3002<\/p>\n
\"\"<\/a><\/p>\n
7.https\u5316\u3057\u305f\u3044\u30c9\u30e1\u30a4\u30f3\u3092\u30b3\u30f3\u30de\u3067\u533a\u5207\u3063\u3066\u6307\u5b9a\u3057\u307e\u3059\u3002\u4e00\u5ea6\u306b\u8907\u6570\u6307\u5b9a\u51fa\u6765\u308b\u306e\u3067\u3001\u6301\u3063\u3066\u3044\u308b\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u3092\u8ffd\u8a18\u3057\u3066\u304a\u304f\u3068\u826f\u3044\u3067\u3057\u3087\u3046\u3002<\/p>\n
\uff08\u4f8b \uff1a takumi9942.net,aaa.takumi9942.net,bbb.takumi9942\/net,ccc.takumi9942.net\uff09<\/p>\n
\uff08\u6ce8\uff1a\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u3092\u8ffd\u52a0\u3059\u308b\u306b\u306f\u3001\u3042\u3089\u304b\u3058\u3081\u305d\u306e\u30db\u30b9\u30c8\u540d\u306eA\u30ec\u30b3\u30fc\u30c9\u3092DNS\u306b\u767b\u9332\u3057\u3066\u304a\u304f\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\uff09<\/p>\n
\"\"<\/a><\/p>\n
8.\u8868\u793a\u3055\u308c\u305f\u30c9\u30e1\u30a4\u30f3\u306e\u30eb\u30fc\u30c8\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002\u300cEnter a new webroot\u300d\u3092\u9078\u629e\u3057\u3066\u5834\u6240\u3092\u8ffd\u52a0\u3057\u307e\u3059\u3002<\/p>\n
\"\"<\/a><\/p>\n
9.\u30eb\u30fc\u30c8\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3078\u306e\u7d76\u5bfe\u30d1\u30b9\u3092\u5165\u529b\u3057\u307e\u3059\u3002\uff08Nginx\u306e\u6a19\u6e96Root\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306f\/usr\/share\/nginx\/html\/\uff09<\/p>\n
\"\"<\/a><\/p>\n
10.\u8907\u6570\u30c9\u30e1\u30a4\u30f3\u3092\u8a18\u8ff0\u3057\u305f\u5834\u5408\u306f\u305d\u308c\u305e\u308c\u306e\u30eb\u30fc\u30c8\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u6307\u5b9a\u3057\u307e\u3059\u3002<\/p>\n
\"\"<\/a><\/p>\n
11.\u4ee5\u4e0b\u306e\u753b\u9762\u304c\u8868\u793a\u3055\u308c\u305f\u3089\u3001\u8a3c\u660e\u66f8\u306e\u767a\u884c\u306f\u5b8c\u4e86\u3067\u3059\u3002<\/p>\n
\"\"<\/a><\/p>\n
12.Nginx\u306b\u8a3c\u660e\u66f8\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002<\/p>\n
\r\n#\u6a19\u6e96\u306e\u30ad\u30fc\u306f\u77ed\u3044\u306e\u3067\u3001\u9577\u3044\u30ad\u30fc\u3092\u751f\u6210\u3057\u3066\u304a\u304d\u307e\u3059\u3002\r\nopenssl dhparam 2048 -out \/\u4efb\u610f\u306e\u30d1\u30b9\/dhparam.pem<\/pre>\n
vim \/etc\/nginx\/nginx.conf<\/pre>\n
#\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092include\u3057\u3066\u3042\u308b\u304b\u3069\u3046\u304b\u78ba\u8a8d\u3057\u307e\u3059\r\ninclude \/etc\/nginx\/conf.d\/*.conf;<\/pre>\n
vim \/etc\/nginx\/conf.d\/default.conf<\/pre>\n
\n
#listen443\u306eserver\u306b\u4ee5\u4e0b\u3092\u8ffd\u8a18<\/p>\n
ssl on;\r\n<\/pre>\n
ssl_certificate \"\/etc\/letsencrypt\/live\/1\u756a\u6700\u521d\u306b\u6307\u5b9a\u3057\u305f\u30c9\u30e1\u30a4\u30f3\u540d\/fullchain.pem\";\r\n<\/pre>\n
ssl_certificate_key \"\/etc\/letsencrypt\/live\/1\u756a\u6700\u521d\u306b\u6307\u5b9a\u3057\u305f\u30c9\u30e1\u30a4\u30f3\u540d\/privkey.pem\";\r\n<\/pre>\n
ssl_session_cache shared:SSL:1m;\r\n<\/pre>\n
ssl_session_timeout  10m;\r\n<\/pre>\n
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;\r\n<\/pre>\n
\r\n#\u3053\u3053\u3067\u5148\u7a0b\u751f\u6210\u3057\u305f\u30ad\u30fc\u3092\u8aad\u307f\u8fbc\u307f\u307e\u3059\r\nssl_dhparam \/\u30ad\u30fc\u3092\u7f6e\u3044\u305f\u30d1\u30b9\/dhparam.pem;\r\n<\/pre>\n
\r\nssl_ciphers \"EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4\";\r\n<\/pre>\n
ssl_prefer_server_ciphers on;\r\n<\/pre>\n<\/div>\n
13.\u6700\u5f8c\u306b\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306e\u6587\u6cd5\u3092\u30c1\u30a7\u30c3\u30af\u3057\u3001Nginx\u3092\u518d\u8d77\u52d5\u3059\u308c\u3070\u5b8c\u4e86\u3067\u3059\u3002<\/p>\n
nginx -t<\/pre>\n
systemctl restart nginx<\/pre>\n
14.\u81ea\u52d5\u66f4\u65b0\u306e\u8a2d\u5b9a\u3092\u3059\u308b\u524d\u306b\u81ea\u52d5\u66f4\u65b0\u304c\u53ef\u80fd\u3067\u3042\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3001\u753b\u50cf\u306e\u3088\u3046\u306a\u51fa\u529b\u304c\u3055\u308c\u308c\u3070\u6b63\u5e38\u306b\u8a2d\u5b9a\u3067\u304d\u3066\u3044\u307e\u3059\u3002<\/p>\n
certbot renew --dry-run<\/pre>\n
\"\"<\/a><\/p>\n
15.Cron\u306b\u8a3c\u660e\u66f8\u3092\u81ea\u52d5\u3067\u66f4\u65b0\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n
crontab -e<\/pre>\n
MAILTO=\"\"\r\n1 5 * * * certbot renew --quiet\r\n(Cron\u306f\u300c\u5206\u300d\u300c\u6642\u300d\u300c\u65e5\u300d\u300c\u6708\u300d\u300c\u66dc\u65e5\u300d\u300c\u5b9f\u884c\u30b3\u30de\u30f3\u30c9\u300d\u306e\u9806\u756a\u3067\u8a18\u8ff0\u3059\u308b)\r\n<\/pre>\n
\u4ee5\u4e0a\u3067\u30b5\u30a4\u30c8\u306ehttps\u5316\u306f\u5b8c\u4e86\u3067\u3059\u3002
\nVPS\u3060\u3068\u300cLet’s encrypt\u300d\u3092\u4f7f\u7528\u3059\u308c\u3070\u7121\u6599\u3067https\u306e\u30b5\u30a4\u30c8\u3092\u4f5c\u308a\u653e\u984c\u306a\u3068\u3053\u308d\u304c\u3044\u3044\u3067\u3059\u306d( \u00b4\u2200\uff40)<\/p>\n","protected":false},"excerpt":{"rendered":"\u524d\u56de\u3001VPS\u306b\u300cCentOS7+Nginx+PHP\u300d\u306e\u74b0\u5883\u3092\u69cb\u7bc9\u3057\u307e\u3057\u305f\u3002 \u4eca\u56de\u306fLet’s Encrypt\u3092\u4f7f\u7528\u3057\u3066\u3001\u7121\u6599\u3067\u30b5\u30a4\u30c8\u3092https\u306b\u5bfe\u5fdc\u3055\u305b\u305f\u3044\u3068\u601d\u3044\u307e\u3059\u3002","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"csco_display_header_overlay":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","csco_post_video_location":[],"csco_post_video_location_hash":"","csco_post_video_url":"","csco_post_video_bg_start_time":0,"csco_post_video_bg_end_time":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[14],"tags":[],"class_list":{"0":"post-978","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-conoha","7":"cs-entry","8":"cs-video-wrap"},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/takumi9942.net\/blog\/index.php?rest_route=\/wp\/v2\/posts\/978","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/takumi9942.net\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/takumi9942.net\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/takumi9942.net\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/takumi9942.net\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=978"}],"version-history":[{"count":1,"href":"https:\/\/takumi9942.net\/blog\/index.php?rest_route=\/wp\/v2\/posts\/978\/revisions"}],"predecessor-version":[{"id":2564,"href":"https:\/\/takumi9942.net\/blog\/index.php?rest_route=\/wp\/v2\/posts\/978\/revisions\/2564"}],"wp:attachment":[{"href":"https:\/\/takumi9942.net\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=978"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/takumi9942.net\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=978"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/takumi9942.net\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=978"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}