Webサーバー間通信内容暗号化（Apache+mod_SSL+Certbot）

最終更新日： 2022.10.16

[root@centos ~]# yum -y install epel-release　←　yum用EPELリポジトリインストール

[root@centos ~]# yum -y install snapd　←　snapdインストール

[root@centos ~]# systemctl enable --now snapd.socket　←　snapd.socket有効化

[root@centos ~]# ln -s /var/lib/snapd/snap /snap　←　/var/lib/snapd/snapから/snapへリンクを張る

[root@centos ~]# snap install --classic certbot　←　certbotインストール

[root@centos ~]# ln -s /snap/bin/certbot /usr/bin/certbot　←　/snap/bin/certbotから/usr/bin/certbotへリンクを張る

[root@centos ~]# certbot certonly --webroot -w ドキュメントルート -m メールアドレス -d Webサーバー名 --agree-tos　←　サーバー証明書取得


−−パラメータ指定例−−
ドキュメントルート⇒/var/www/html/centos/
メールアドレス⇒任意のメールアドレス
Webサーバー名⇒centossrv.com


Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for centossrv.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/centossrv.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/centossrv.com/privkey.pem
This certificate expires on 2023-01-14.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[root@centos ~]# yum -y install mod_ssl　←　mod_sslインストール

[root@centos ~]# vi /etc/httpd/conf.d/ssl.conf　←　SSL設定ファイル編集
#   Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate.  If
# the certificate is encrypted, then you will be prompted for a
# pass phrase.  Note that a kill -HUP will prompt again.  A new
# certificate can be generated using the genkey(1) command.
SSLCertificateFile /etc/letsencrypt/live/centossrv.com/cert.pem　←　公開鍵指定

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile /etc/letsencrypt/live/centossrv.com/privkey.pem　←　秘密鍵指定

#   Server Certificate Chain:
#   Point SSLCertificateChainFile at a file containing the
#   concatenation of PEM encoded CA certificates which form the
#   certificate chain for the server certificate. Alternatively
#   the referenced file can be the same as SSLCertificateFile
#   when the CA certificates are directly appended to the server
#   certificate for convinience.
SSLCertificateChainFile /etc/letsencrypt/live/centossrv.com/chain.pem　←　中間証明書指定

[root@centos ~]# vi /etc/httpd/conf.d/ssl.conf　←　SSL設定ファイル編集
#   SSL Protocol support:
# List the enable protocol levels with which clients will be able to
# connect.  Disable SSLv2 access by default:
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1　←　TLS 1.2のみ有効

#   Speed-optimized SSL Cipher configuration:
#   If speed is your main concern (on busy HTTPS servers e.g.),
#   you might want to force clients to specific, performance
#   optimized ciphers. In this case, prepend those ciphers
#   to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
#   Caveat: by giving precedence to RC4-SHA and AES128-SHA
#   (as in the example below), most connections will no longer
#   have perfect forward secrecy - if the server's key is
#   compromised, captures of past or future traffic must be
#   considered compromised, too.
#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
#SSLHonorCipherOrder on
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS　←　追加（使用する暗号化方法）
SSLHonorCipherOrder on　←　追加（暗号化方法をサーバー側で決定）

Header always set Strict-Transport-Security "max-age=15768000"　←　追加（HSTS＝常時HTTPSアクセスの有効化）
</VirtualHost>

[root@centos ~]# vi /etc/httpd/conf.d/ssl.conf　←　SSL設定ファイル編集
# Use separate log files for the SSL virtual host; note that LogLevel
# is not inherited from httpd.conf.
ErrorLog logs/error_log　←　ログファイル名変更
CustomLog logs/access_log combined env=!no_log　←　ログ取得ディレクティブとログファイル名変更
LogLevel warn

[root@centos ~]# systemctl reload httpd　←　Apache設定反映

[root@centos ~]# vi /etc/cron.monthly/certbot　←　サーバー証明書自動更新スクリプト作成
#!/bin/bash
log=`mktemp`
code=0

which certbot > /dev/null 2>&1
if [ $? -eq 0 ]; then
    CERTBOT=`which certbot`
else
    CERTBOT=`which certbot-auto`
fi

#
# 証明書更新
#
for conf in `ls /etc/letsencrypt/renewal/`
do
    # ドメイン名取得
    domain=`echo ${conf}|sed -e 's/\([^ ]*\)\.conf/\1/p' -e d`

    # 認証方式取得
    authenticator=`grep authenticator /etc/letsencrypt/renewal/${conf}|awk '{print $3}'`

    if [ ${authenticator} = 'webroot' ]; then
        # Web認証の場合

        # ドキュメントルート取得
        webroot=`grep webroot_path /etc/letsencrypt/renewal/${conf}|grep =|awk '{print $3}'|awk -F '[,]' '{print $1}'`

        # 証明書更新
        ${CERTBOT} certonly --webroot \
        -w ${webroot} -d ${domain} --renew-by-default >> ${log} 2>&1
        [ $? -ne 0 ] && cat ${log}
    else
        # スタンドアロン認証の場合

        # 証明書更新
        lsof -i:80 > /dev/null 2>&1
        if [ $? -eq 0 ]; then
            echo 'Webサーバー稼働中のためスタンドアロン認証不可'
        else
            ${CERTBOT} certonly -a standalone \
            -d ${domain} --renew-by-default >> ${log} 2>&1
            [ $? -ne 0 ] && cat ${log}
        fi
    fi
    
    # 古い証明書を削除
    find /etc/letsencrypt/archive/${domain}/ -mtime +30 -delete
    
done

#
# 証明書更新反映
#

# Webサーバー設定再読込み
lsof -i:443 > /dev/null 2>&1
if [ $? -eq 0 ]; then
    rpm -q systemd > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        systemctl reload httpd
    else
        /etc/rc.d/init.d/httpd reload > /dev/null 2>&1
    fi
fi

# SMTPサーバー設定再読込み
lsof -i:465 > /dev/null 2>&1
if [ $? -eq 0 ]; then
    rpm -q systemd > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        systemctl reload postfix
    else
        /etc/rc.d/init.d/postfix reload > /dev/null 2>&1
    fi
fi

# IMAPサーバー設定再読込み
lsof -i:995 > /dev/null 2>&1
if [ $? -eq 0 ]; then
    rpm -q systemd > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        systemctl reload dovecot
    else
        /etc/rc.d/init.d/dovecot reload > /dev/null 2>&1
    fi
fi

#
# ログをsyslogへ出力後削除
#
cat ${log}|logger -t `basename ${0}` ; rm -f ${log}

[root@centos ~]# chmod +x /etc/cron.monthly/certbot　←　サーバー証明書自動更新スクリプトへ実行権限付加