Webサーバー間通信内容暗号化（Apache+mod_SSL+Certbot）

最終更新日： 2017.11.25

【CentOS7の場合】
[root@centos ~]# cd /usr/local/　←　ディレクトリ移動

[root@centos local]# git clone https://github.com/certbot/certbot　←　Certbotクライアントダウンロード

[root@centos local]# cd　←　ディレクトリ移動

[root@centos ~]# /usr/local/certbot/certbot-auto -n　←　Certbotクライアントインストール

【CentOS6の場合】
[root@centos ~]# yum -y install epel-release　←　EPELリポジトリインストール

[root@centos ~]# cd /usr/local/　←　ディレクトリ移動

[root@centos local]# git clone https://github.com/certbot/certbot　←　Certbotクライアントダウンロード

[root@centos local]# cd　←　ディレクトリ移動

[root@centos ~]# /usr/local/certbot/certbot-auto -n　←　Certbotクライアントインストール

[root@centos ~]# /usr/local/certbot/certbot-auto certonly --webroot -w ドキュメントルート -m メールアドレス -d Webサーバー名 --agree-tos
　←　サーバー証明書取得


−−パラメータ指定例−−
ドキュメントルート⇒/var/www/html/centos/
メールアドレス⇒任意のメールアドレス
Webサーバー名⇒centossrv.com


IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/centossrv.com/fullchain.pem. Your cert
   will expire on 2016-07-24. To obtain a new version of the
   certificate in the future, simply run Certbot again.
 - If you lose your account credentials, you can recover through
   e-mails sent to xxxxxxxx@xxxxxxxx.com.
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/certbot. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Let's
   Encrypt so making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Certbot:   https://certbot.org/donate
   Donating to EFF:                    https://eff.org/donate-le

[root@centos ~]# yum -y install mod_ssl　←　mod_sslインストール

[root@centos ~]# vi /etc/httpd/conf.d/ssl.conf　←　SSL設定ファイル編集
#   Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate.  If
# the certificate is encrypted, then you will be prompted for a
# pass phrase.  Note that a kill -HUP will prompt again.  A new
# certificate can be generated using the genkey(1) command.
SSLCertificateFile /etc/letsencrypt/live/centossrv.com/cert.pem　←　公開鍵指定

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile /etc/letsencrypt/live/centossrv.com/privkey.pem　←　秘密鍵指定

#   Server Certificate Chain:
#   Point SSLCertificateChainFile at a file containing the
#   concatenation of PEM encoded CA certificates which form the
#   certificate chain for the server certificate. Alternatively
#   the referenced file can be the same as SSLCertificateFile
#   when the CA certificates are directly appended to the server
#   certificate for convinience.
SSLCertificateChainFile /etc/letsencrypt/live/centossrv.com/chain.pem　←　中間証明書指定

[root@centos ~]# vi /etc/httpd/conf.d/ssl.conf　←　SSL設定ファイル編集
#   SSL Protocol support:
# List the enable protocol levels with which clients will be able to
# connect.  Disable SSLv2 access by default:
SSLProtocol all -SSLv2 -SSLv3　←　SSLv2,SSLv3を無効化

#   Speed-optimized SSL Cipher configuration:
#   If speed is your main concern (on busy HTTPS servers e.g.),
#   you might want to force clients to specific, performance
#   optimized ciphers. In this case, prepend those ciphers
#   to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
#   Caveat: by giving precedence to RC4-SHA and AES128-SHA
#   (as in the example below), most connections will no longer
#   have perfect forward secrecy - if the server's key is
#   compromised, captures of past or future traffic must be
#   considered compromised, too.
#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
#SSLHonorCipherOrder on
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS　←　追加（使用する暗号化方法）
SSLHonorCipherOrder on　←　追加（暗号化方法をサーバー側で決定）

Header always set Strict-Transport-Security "max-age=15768000"　←　追加（HSTS＝常時HTTPSアクセスの有効化）
</VirtualHost>

[root@centos ~]# vi /etc/httpd/conf.d/ssl.conf　←　SSL設定ファイル編集
# Use separate log files for the SSL virtual host; note that LogLevel
# is not inherited from httpd.conf.
ErrorLog logs/error_log　←　ログファイル名変更
CustomLog logs/access_log combined env=!no_log　←　ログ取得ディレクティブとログファイル名変更
LogLevel warn

[root@centos ~]# systemctl reload httpd　←　Apache設定反映※CentOS7の場合
[root@centos ~]# /etc/rc.d/init.d/httpd reload　←　Apache設定反映※CentOS6の場合

[root@centos ~]# vi /etc/cron.monthly/certbot　←　サーバー証明書自動更新スクリプト作成
#!/bin/sh
log=`mktemp`
code=0

#
# 証明書更新
#
for conf in `ls /etc/letsencrypt/renewal/`
do
    # ドメイン名取得
    domain=`echo ${conf}|sed -e 's/\([^ ]*\)\.conf/\1/p' -e d`

    # 認証方式取得
    authenticator=`grep authenticator /etc/letsencrypt/renewal/${conf}|awk '{print $3}'`

    if [ ${authenticator} = 'webroot' ]; then
        # Web認証の場合

        # ドキュメントルート取得
        webroot=`grep -A 1 webroot_map  /etc/letsencrypt/renewal/${conf}|grep =|awk '{print $3}'`

        # 証明書更新
        /usr/local/certbot/certbot-auto certonly --webroot \
        -w ${webroot} -d ${domain} --renew-by-default >> ${log} 2>&1
        [ $? -ne 0 ] && cat ${log}
    else
        # スタンドアロン認証の場合

        # 証明書更新
        lsof -i:80 > /dev/null 2>&1
        if [ $? -eq 0 ]; then
            echo 'Webサーバー稼働中のためスタンドアロン認証不可'
        else
            /usr/local/certbot/certbot-auto certonly -a standalone \
            -d ${domain} --renew-by-default >> ${log} 2>&1
            [ $? -ne 0 ] && cat ${log}
        fi
    fi
done

#
# 証明書更新反映
#

# Webサーバー設定再読込み
lsof -i:443 > /dev/null 2>&1
if [ $? -eq 0 ]; then
    rpm -q systemd > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        systemctl reload httpd
    else
        /etc/rc.d/init.d/httpd reload > /dev/null 2>&1
    fi
fi

# SMTPサーバー設定再読込み
lsof -i:465 > /dev/null 2>&1
if [ $? -eq 0 ]; then
    rpm -q systemd > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        systemctl reload postfix
    else
        /etc/rc.d/init.d/postfix reload > /dev/null 2>&1
    fi
fi

# IMAPサーバー設定再読込み
lsof -i:995 > /dev/null 2>&1
if [ $? -eq 0 ]; then
    rpm -q systemd > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        systemctl reload dovecot
    else
        /etc/rc.d/init.d/dovecot reload > /dev/null 2>&1
    fi
fi

#
# ログをsyslogへ出力後削除
#
cat ${log}|logger -t `basename ${0}` ; rm -f ${log}

[root@centos ~]# chmod +x /etc/cron.monthly/certbot　←　サーバー証明書自動更新スクリプトへ実行権限付加