{"id":4834,"date":"2021-08-08T15:05:58","date_gmt":"2021-08-08T06:05:58","guid":{"rendered":"https:\/\/hobby.mydns.jp\/teruki.wp\/?p=4834"},"modified":"2021-08-08T16:46:22","modified_gmt":"2021-08-08T07:46:22","slug":"post-4834","status":"publish","type":"post","link":"https:\/\/hobby.mydns.jp\/teruki.wp\/2021\/08\/08\/post-4834\/","title":{"rendered":"SSL\u8a3c\u660e\u66f8\u66f4\u65b0\u3067\u304d\u305a\u65b9\u6cd5\u5909\u66f4(ZeroSSL)"},"content":{"rendered":"

\u4ee5\u524d\u3001SSL\u8a3c\u660e\u66f8\u3092\u53d6\u5f97<\/a>\u3057\u307e\u3057\u305f\u304c\u3001\u5148\u6708\u304b\u3089\u66f4\u65b0\u304c\u3067\u304d\u305a\u3001\u30a8\u30e9\u30fc\u3092\u8d77\u3053\u3059\u3088\u3046\u306b\u306a\u3063\u3066\u3057\u307e\u3044\u307e\u3057\u305f\u3002\u305d\u308c\u306b\u3088\u3063\u3066\u3001\u672c\u30b5\u30fc\u30d0\u30fc\u3078\u306ehttps\u3067\u306e\u30a2\u30af\u30bb\u30b9\u304c\u3067\u304d\u306a\u304f\u306a\u3063\u3066\u3057\u307e\u3044\u307e\u3057\u305f\u3002<\/p>\n

\u3053\u308c\u307e\u3067\u7121\u6599\u306e\u8a3c\u660e\u66f8\u767a\u884c\u3092Let\u2019s Encrypt\u306b\u983c\u3063\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u3044\u308d\u3044\u308d\u8a66\u884c\u932f\u8aa4\u3092\u7e70\u308a\u8fd4\u3057\u3066\u3082\u66f4\u65b0\u304c\u3067\u304d\u305a\u3001Let\u2019s Encrypt\u306e\u4ee3\u66ff\u3068\u306a\u308b\u30b5\u30fc\u30d3\u30b9\u3092\u63a2\u3057\u307e\u3057\u305f\u3002\u3044\u308d\u3044\u308d\u8a66\u3057\u3066\u3044\u3066\u3001Let\u2019s Encrypt\u81ea\u4f53\u306e\u554f\u984c\u3067\u306f\u306a\u304f\u3001\u81ea\u4f5c\u30b5\u30fc\u30d0\u30fc\u3078\u306e\u627f\u8a8d\u78ba\u8a8d\u306e\u305f\u3081\u306e\u30a2\u30af\u30bb\u30b9\u304c\u4f55\u3089\u304b\u306e\u7406\u7531\u3067\u3067\u304d\u306a\u304f\u3066\u62d2\u5426\u3055\u308c\u3066\u3044\u305f\u306e\u3060\u3068\u601d\u3044\u307e\u3059\u3002\u305f\u3076\u3093Let\u2019s Encrypt\u306e\u627f\u8a8d\u306e\u78ba\u8a8d\u65b9\u6cd5\u3082\u5909\u308f\u3063\u305f\u306e\u3060\u3068\u601d\u3044\u307e\u3059\u3002<\/p>\n

\u3053\u308c\u307e\u3067\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u30e1\u30c3\u30bb\u30fc\u30b8\u306f\u51fa\u306a\u304b\u3063\u305f\u3068\u601d\u3044\u307e\u3059\u3002\u305d\u308c\u304c\u3001.well-known\/acme-challenge\u3068\u3044\u3046\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u4f5c\u6210\u3057\u3066\u305d\u3053\u306b\u30d5\u30a1\u30a4\u30eb\u3092\u751f\u6210\u3057\u3066\u78ba\u8a8d\u3059\u308b\u4ed5\u65b9\u306b\u66ff\u308f\u3063\u3066\u3044\u308b\u3088\u3046\u306b\u601d\u3044\u307e\u3057\u305f\u3002\u3053\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u304c\u751f\u6210\u3055\u308c\u305a\u3001\u30a2\u30af\u30bb\u30b9\u5236\u9650\u306a\u3069\u3044\u308d\u3044\u308d\u3068\u8a66\u884c\u932f\u8aa4\u3057\u305f\u306e\u3067\u3059\u304c\u3001\u3046\u307e\u304f\u3044\u304d\u307e\u305b\u3093\u3067\u3057\u305f\u3002
\n——————————————————
\nDetail: Fetching http:\/\/hobby.mydns.jp\/.well-known\/acme-challenge\/~: Timeout during connect (likely firewall problem)<\/p>\n

To fix these errors, please make sure that your domain name was entered correctly and the DNS A\/AAAA record(s) for that domain contain(s) the right IP address. Additionally, please check that your computer has a publicly routable IP address and that no firewalls are preventing the server from communicating with the client. If you’re using the webroot plugin, you should also verify that you are serving files from the webroot path you provided.
\n——————————————————<\/p>\n

Let\u2019s Encrypt\u306e\u4ee3\u66ff\u3068\u3057\u3066\u3001ZeroSSL<\/a>\u3092\u5229\u7528\u3057\u3066\u307f\u308b\u3053\u3068\u306b\u3057\u307e\u3057\u305f\u3002ZeroSSL\u306fWEB\u4e0a\u3067SSL\u8a3c\u660e\u66f8\u3092\u53d6\u5f97\u3067\u304d\u308b\u3088\u3046\u3067\u3059\u3002\u3053\u3061\u3089\u306e\u624b\u6cd5\u3067\u3082”Let\u2019s Encrypt”\u3068\u540c\u3058\u304fHTTP\u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u30e2\u30fc\u30c9\u3067\u306e\u8a8d\u8a3c\u304c\u3042\u308a\u307e\u3059\u304c\u3001\u3053\u308c\u3082\u30a2\u30af\u30bb\u30b9\u5236\u9650\u306b\u3088\u308b\u3082\u306e\u306a\u306e\u304b”Let\u2019s Encrypt”\u3068\u540c\u3058\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u3067\u5c0e\u5165\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f\u306e\u3067\u3001DNS\u8a8d\u8a3c\u3067\u53d6\u5f97<\/a>\u3059\u308b\u3088\u3046\u306b\u3057\u307e\u3057\u305f\u3002<\/p>\n

DNS\u8a8d\u8a3c\u306e\u5834\u5408\u306e\u52d5\u4f5c\u3068\u3057\u3066\u3001\u4e0a\u8a18\u30ea\u30f3\u30af\u306e\u624b\u9806\u3067\u9032\u3081\u3066\u3044\u3063\u3066\u8868\u793a\u3055\u308c\u305fName\u3068PointTo\u306e\u5024\u3092\u30c9\u30e1\u30a4\u30f3\u8a2d\u5b9a\u30b5\u30a4\u30c8(\u79c1\u306e\u5834\u5408\uff1amydns)\u306b\u8a2d\u5b9a\u3057\u3066\u3001\u5be9\u67fb\u3092\u53d7\u3051\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002
\n\"\"<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

\u30ec\u30b3\u30fc\u30c9\u30bf\u30a4\u30d7\u306fCNAME\u3001Name\u3001Point to\u306e\u60c5\u5831\u3092\u30c9\u30e1\u30a4\u30f3\u8a2d\u5b9a\u30b5\u30a4\u30c8\u306b\u767b\u9332\u3057\u307e\u3059\u3002\u3053\u306e\u6642\u3001NextStep\u306e\u30dc\u30bf\u30f3\u306f\u3001\u30c9\u30e1\u30a4\u30f3\u8a2d\u5b9a\u30b5\u30a4\u30c8\u3078\u306e\u767b\u9332\u304c\u7d42\u308f\u3063\u3066\u304b\u3089\u62bc\u3057\u307e\u3059\u3002
\n\"\"
\nMyDNS\u306e\u5834\u5408\u3001”Type”\u306fCNAME\u3092\u9078\u629e\u3001”Hostname”\u304cName\u3001”Content”\u304cPoint to\u306e\u90e8\u5206\u306b\u3042\u305f\u308a\u307e\u3059\u3002”Hostname”\u306e\u90e8\u5206\u306fName\u306e\u30c9\u30e1\u30a4\u30f3\u3088\u308a\u524d\u306e(\u5148\u982d\u304b\u3089”.”\u3088\u308a\u524d)\u3092\u8a18\u8f09\u3057\u307e\u3059\u3002”Content”\u306e\u90e8\u5206\u306fPoint to\u306e\u5024\u5168\u90e8\u3092\u8a18\u8f09\u3057\u307e\u3059\u3002
\n\"\"<\/p>\n

\u9032\u3081\u3066\u3044\u3063\u3066\u3001\u78ba\u8a8d\u304c\u53d6\u308c\u308c\u3070\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002
\n\"\"<\/p>\n

\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305fZIP\u30d5\u30a1\u30a4\u30eb\u306e\u4e2d\u8eab\u306f\u6b21\u306e3\u30d5\u30a1\u30a4\u30eb\u3068\u306a\u308a\u307e\u3059\u3002
\n\u30fbca_bundle.crt
\n\u30fbcertificate.crt
\n\u30fbprivate.key<\/p>\n

\u3053\u308c\u3089\u3092\/etc\/ssl\/\u306a\u3069\u306b\u4fdd\u5b58\u3057\u305f\u5f8c\u3001\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u306b\u4ee5\u524d\u306e\u8a2d\u5b9a\u306f\u30b3\u30e1\u30f3\u30c8\u30a2\u30a6\u30c8\u3057\u3066\u3001\u65b0\u3057\u3044\u8a2d\u5b9a\u3092\u8ffd\u52a0\u3057\u307e\u3059\u3002
\nvi \/etc\/httpd\/conf.d\/ssl.conf<\/p>\n

#   Server Certificate:\r\n# Point SSLCertificateFile at a PEM encoded certificate.  If\r\n# the certificate is encrypted, then you will be prompted for a\r\n# pass phrase.  Note that a kill -HUP will prompt again.  A new\r\n# certificate can be generated using the genkey(1) command.\r\n#SSLCertificateFile \/etc\/pki\/tls\/certs\/localhost.crt\r\n# Let's Encrypt #\r\n#SSLCertificateFile \/etc\/letsencrypt\/live\/hobby.mydns.jp\/cert.pem<\/span>\r\n# ZeroSSL #\r\nSSLCertificateFile \/etc\/ssl\/certificate.crt<\/span>\r\n\r\n#   Server Private Key:\r\n#   If the key is not combined with the certificate, use this\r\n#   directive to point at the key file.  Keep in mind that if\r\n#   you've both a RSA and a DSA private key you can configure\r\n#   both in parallel (to also allow the use of DSA ciphers, etc.)\r\n#SSLCertificateKeyFile \/etc\/pki\/tls\/private\/localhost.key\r\n# Let's Encrypt #\r\n#SSLCertificateKeyFile \/etc\/letsencrypt\/live\/hobby.mydns.jp\/privkey.pem<\/span>\r\n# ZeroSSL #<\/span>\r\nSSLCertificateKeyFile \/etc\/ssl\/private.key<\/span>\r\n\r\n#   Server Certificate Chain:\r\n#   Point SSLCertificateChainFile at a file containing the\r\n#   concatenation of PEM encoded CA certificates which form the\r\n#   certificate chain for the server certificate. Alternatively\r\n#   the referenced file can be the same as SSLCertificateFile\r\n#   when the CA certificates are directly appended to the server\r\n#   certificate for convinience.\r\n#SSLCertificateChainFile \/etc\/pki\/tls\/certs\/server-chain.crt\r\n# Let's Encrypt #\r\n#SSLCertificateChainFile \/etc\/letsencrypt\/live\/hobby.mydns.jp\/chain.pem<\/span>\r\n\r\n#   Certificate Authority (CA):\r\n#   Set the CA certificate verification path where to find CA\r\n#   certificates for client authentication or alternatively one\r\n#   huge file containing all of them (file must be PEM encoded)\r\n#SSLCACertificateFile \/etc\/pki\/tls\/certs\/ca-bundle.crt\r\n# ZeroSSL #\r\nSSLCACertificateFile \/etc\/ssl\/ca_bundle.crt\r\n<\/span><\/pre>\n
\u8a2d\u5b9a\u5f8c\u3001httpd\u3092\u518d\u8d77\u52d5\u3057\u307e\u3059\u3002
\n%>systemctl restart httpd.service
\n\u3053\u3053\u307e\u3067\u304c\u3001\u624b\u52d5\u3067\u306e\u53d6\u5f97\u65b9\u6cd5\u3067\u3059\u304c\u3001\u3053\u308c\u3092\u81ea\u52d5\u5316\u3059\u308b\u3053\u3068\u306b\u3057\u307e\u3057\u305f\u3002<\/p>\n
\u3010\u81ea\u52d5\u5316\u3011
\n\u81ea\u52d5\u5316\u306b\u304a\u3044\u3066\u3001certbot\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u3063\u3066 \u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u3067SSL \u8a3c\u660e\u66f8\u3092\u767a\u884c\u3057\u3066\u3044\u307e\u3057\u305f\u304c\u3001certbot \u304c\u52d5\u304b\u306a\u304f\u306a\u3063\u3066\u30a8\u30e9\u30fc\u304c\u3069\u3046\u3057\u3066\u3082\u89e3\u6d88\u3067\u304d\u306a\u304f\u3066\u9014\u65b9\u306b\u66ae\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u9762\u5012\u3067\u3082\u524d\u8ff0\u306e\u3068\u304a\u308a\u3001ZeroSSL\u306eWEB\u30b5\u30a4\u30c8\u3067\u624b\u52d5\u3067\u66f4\u65b0\u3059\u308b\u3057\u304b\u306a\u3044\u306e\u304b\uff1f\u3068\u843d\u80c6\u3057\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u5225\u306e\u624b\u6bb5\u3092\u898b\u3064\u3051\u3066<\/a>\u3001LEGO\u3068\u3044\u3046\u3082\u306e\u3067\u5bfe\u5fdc\u3057\u3066\u307f\u3088\u3046\u3068\u601d\u3044\u307e\u3057\u305f\u3002
\n\"\"
\n\u3053\u306eLEGO\u306e\u30b5\u30a4\u30c8\u306b\u306fmydns\u306b\u95a2\u3059\u308b\u8a2d\u5b9a<\/a>\u3082\u8a18\u8f09\u3055\u308c\u3066\u3044\u305f\u306e\u3067\u3001\u7d44\u307f\u5408\u308f\u305b\u3066\u4f55\u3068\u304b\u306a\u3089\u306a\u3044\u3082\u306e\u304b\uff1f\u3068\u3044\u3046\u3053\u3068\u3067\u3084\u3063\u3066\u307f\u308b\u3053\u3068\u306b\u3057\u307e\u3057\u305f\u3002
\nLEGO\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306f\u3001\u30b5\u30a4\u30c8\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9<\/a>\u3057\u307e\u3059\u3002
\n\u300clego_v4.4.0_linux_386.tar.gz\u300d\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u89e3\u51cd\u5f8c\u3001\/usr\/local\/bin\/\u306blego\u306e\u5b9f\u884c\u30d5\u30a1\u30a4\u30eb\u3092\u7f6e\u304d\u307e\u3057\u305f\u3002<\/p>\n
cp -p \/Downloads\/lego_v4.4.0_linux_386\/lego \/usr\/local\/bin\/<\/p>\n
\u7d9a\u3044\u3066\u3001ZeroSSL\u306eAPI Key\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002
\n\"\"
\n\u305d\u306e\u5f8c\u306b\u3001\u30d0\u30c3\u30c1\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3057\u307e\u3057\u305f\u3002\u30d0\u30c3\u30c1\u30d5\u30a1\u30a4\u30eb\u5185\u3067”jq”\u3068\u3044\u3046\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u3063\u3066\u51e6\u7406\u3057\u3066\u3044\u308b\u305f\u3081\u3001\u5148\u306bjq\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u304a\u304d\u307e\u3059\u3002<\/p>\n
yum install jq –enablerepo=epel<\/p>\n
\u30d0\u30c3\u30c1\u306e\u4f5c\u6210
\nvi \/etc\/ssl\/zerossl\/lego.sh<\/p>\n
------------------------------------------------------\r\n#!\/bin\/bash\r\n\r\nACCESS_KEY=ZeroSSL\u306eAPI Key\u3092\u8a2d\u5b9a<\/span>\r\nJSON=$(curl -s -X POST \"https:\/\/api.zerossl.com\/acme\/eab-credentials?access_key=$ACCESS_KEY\")\r\nEAB_KEY=$(echo \"$JSON\" | jq -r .eab_kid)\r\nEAB_HMAC_KEY=$(echo \"$JSON\" | jq -r .eab_hmac_key)\r\n\r\nMYDNSJP_MASTER_ID=mydns\u30ed\u30b0\u30a4\u30f3ID\u3092\u8a2d\u5b9a<\/span> \\\r\nMYDNSJP_PASSWORD=mydns\u306e\u30ed\u30b0\u30a4\u30f3\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u8a2d\u5b9a<\/span> \\\r\n\/usr\/local\/bin\/lego \\\r\n        --dns mydnsjp \\\r\n        --path \/etc\/ssl\/zerossl \\\r\n    --eab --kid \"$EAB_KEY\" --hmac \"$EAB_HMAC_KEY\" \\\r\n    --server \"https:\/\/acme.zerossl.com\/v2\/DV90\" \\\r\n    --email \"\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u8a2d\u5b9a<\/span>\" \\\r\n    --domains \"\u30c9\u30e1\u30a4\u30f3\u3092\u8a2d\u5b9a<\/span>\" \\\r\n    -a run\r\n------------------------------------------------------\r\n<\/pre>\n
\u3053\u306e\u30d0\u30c3\u30c1\u3092\u5b9a\u671f\u7684\u306b\u5b9f\u884c\u3059\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002\u6bce\u67081\u65e5\u306e5\u6642\u306b\u5b9f\u884c\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3057\u3066\u307f\u307e\u3059\u3002
\nvi \/etc\/crontab<\/p>\n
00 05 01 * * root \/etc\/ssl\/zerossl\/lego.sh 2>&1 | mail -s \"ZeroSSL update information\" \u901a\u77e5\u5148\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9<\/span> && systemctl restart httpd\r\n<\/pre>\n
\u53d6\u5f97\u3059\u308bSSL\u8a3c\u660e\u66f8\u540d\u304c\u5909\u308f\u308b\u306e\u3067\u3001\/etc\/httpd\/conf.d\/ssl.conf\u3092\u5909\u66f4\u3057\u307e\u3059\u3002
\nvi \/etc\/httpd\/conf.d\/ssl.conf<\/p>\n
------------------------------------------------------\r\n#   Server Certificate:\r\n# Point SSLCertificateFile at a PEM encoded certificate.  If\r\n# the certificate is encrypted, then you will be prompted for a\r\n# pass phrase.  Note that a kill -HUP will prompt again.  A new\r\n# certificate can be generated using the genkey(1) command.\r\n#SSLCertificateFile \/etc\/pki\/tls\/certs\/localhost.crt\r\n# ZeroSSL #\r\n#SSLCertificateFile \/etc\/ssl\/certificate.crt\r\n<\/span>SSLCertificateFile \/etc\/ssl\/zerossl\/certificates\/\u30c9\u30e1\u30a4\u30f3\u540d.crt\r\n<\/span>\r\n#   Server Private Key:\r\n#   If the key is not combined with the certificate, use this\r\n#   directive to point at the key file.  Keep in mind that if\r\n#   you've both a RSA and a DSA private key you can configure\r\n#   both in parallel (to also allow the use of DSA ciphers, etc.)\r\n#SSLCertificateKeyFile \/etc\/pki\/tls\/private\/localhost.key\r\n# ZeroSSL #\r\n#SSLCertificateKeyFile \/etc\/ssl\/private.key\r\n<\/span>SSLCertificateKeyFile \/etc\/ssl\/zerossl\/certificates\/\u30c9\u30e1\u30a4\u30f3\u540d.key\r\n<\/span>\r\n#   Server Certificate Chain:\r\n#   Point SSLCertificateChainFile at a file containing the\r\n#   concatenation of PEM encoded CA certificates which form the\r\n#   certificate chain for the server certificate. Alternatively\r\n#   the referenced file can be the same as SSLCertificateFile\r\n#   when the CA certificates are directly appended to the server\r\n#   certificate for convinience.\r\n#SSLCertificateChainFile \/etc\/pki\/tls\/certs\/server-chain.crt\r\n# Let's Encrypt #\r\n#SSLCertificateChainFile \/etc\/letsencrypt\/live\/hobby.mydns.jp\/chain.pem<\/span>\r\n# ZeroSSL #\r\n#SSLCACertificateFile \/etc\/ssl\/ca_bundle.crt\r\n<\/span>SSLCACertificateFile \/etc\/ssl\/zerossl\/certificates\/\u30c9\u30e1\u30a4\u30f3\u540d.issuer.crt<\/span>\r\n\r\n#   Certificate Authority (CA):\r\n#   Set the CA certificate verification path where to find CA\r\n#   certificates for client authentication or alternatively one\r\n#   huge file containing all of them (file must be PEM encoded)\r\n#SSLCACertificateFile \/etc\/pki\/tls\/certs\/ca-bundle.crt\r\n# ZeroSSL #\r\n#SSLCACertificateFile \/etc\/ssl\/ca_bundle.crt\r\n<\/span>SSLCACertificateFile \/etc\/ssl\/zerossl\/certificates\/\u30c9\u30e1\u30a4\u30f3\u540d.issuer.crt\r\n<\/span><\/del>------------------------------------------------------\r\n<\/pre>\n
\u3010\u88dc\u8db3\u3011
\n%> httpd -v
\nServer version: Apache\/2.4.6 (CentOS)<\/p>\n
SSLCertificateChainFile \u3068 SSLCACertificateFile \u306e\u9055\u3044
\n\u30fbSSLCertificateChainFile\u30c7\u30a3\u30ec\u30af\u30c6\u30a3\u30d6\uff1a\u30b5\u30fc\u30d0\u30fc\u8a3c\u660e\u66f8\u306b\u304a\u3051\u308b\u4e2d\u9593\u8a3c\u660e\u66f8\u306e\u30d1\u30b9\u3092\u8a2d\u5b9a
\n\u30fbSSLCACertificateFile\u30c7\u30a3\u30ec\u30af\u30c6\u30a3\u30d6\uff1a\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u8a3c\u660e\u66f8\u306b\u304a\u3051\u308b\u4e2d\u9593\u8a3c\u660e\u66f8\u306e\u30d1\u30b9\u3092\u6307\u5b9a
\n\u203bApache2.4.8\u4ee5\u964d\u306fSSLCertificateChainFile\u30c7\u30a3\u30ec\u30af\u30c6\u30a3\u30d6\u306f\u306a\u3044\u3002<\/p>\n
privkey.pem\uff1a\u79d8\u5bc6\u9375
\ncert.pem\uff1a\u8a3c\u660e\u66f8
\nchain.pem\uff1a\u4e2d\u9593\u8a3c\u660e\u66f8
\nfullchain.pem\uff1a\u8a3c\u660e\u66f8\u3068\u4e2d\u9593\u8a3c\u660e\u66f8\u3092\u9023\u7d50\u3057\u305f\u30d5\u30a1\u30a4\u30eb
\n\u2191\u300c%> cat cert.pem chain.pem > fullchain.pem\u300d<\/p>\n
\u2193\u4eca\u56de\u306e\u81ea\u52d5\u5316\u3067\u751f\u6210\u3055\u308c\u308b\u30d5\u30a1\u30a4\u30eb\u306f3\u3064\u3057\u304b\u306a\u3044\u3002\u767a\u884c\u3055\u308c\u305f\u8a3c\u660e\u66f8\u306b\u306fCA\u8a3c\u660e\u66f8\u3082\u542b\u307e\u308c\u3066\u3044\u308b\u3002
\n$domain.crt\uff1a\u30b5\u30fc\u30d0\u30fc\u8a3c\u660e\u66f8\u3067\u3059\uff08CA\u8a3c\u660e\u66f8\u3092\u542b\u3080;fullchain.pem\u3068\u540c\u7b49\uff09
\n$domain.key\uff1a\u30b5\u30fc\u30d0\u30fc\u8a3c\u660e\u66f8\u306e\u79d8\u5bc6\u9375\uff08= privkey.pem\uff09
\n$domain.issuer.crt\uff1aCA\u8a3c\u660e\u66f8\u306e\u307f
\n$domain.json\uff1a\u3044\u304f\u3064\u304b\u306e\u30e1\u30bf\u60c5\u5831\u304c\u542b\u307e\u308c\u308b<\/p>\n
\u25c7\u30d0\u30fc\u30b8\u30e7\u30f32.4.7\u4ee5\u524d\u306e\u5834\u5408
\nhttpd.conf<\/p>\n
SSLEngine on
\nSSLCertificateFile \/etc\/letsencrypt\/live\/example.com\/cert.pem\u3000\u2190$domain.crt
\nSSLCertificateKeyFile \/etc\/letsencrypt\/live\/example.com\/privkey.pem\u3000\u2190$domain.key
\nSSLCertificateChainFile \/etc\/letsencrypt\/live\/example.com\/chain.pem\u3000\u2190$domain.issuer.crt<\/p>\n
\u25c7\u30d0\u30fc\u30b8\u30e7\u30f32.4.8\u4ee5\u964d\u306e\u5834\u5408
\nhttpd.conf<\/p>\n
SSLEngine on
\nSSLCertificateFile \/etc\/letsencrypt\/live\/example.com\/fullchain.pem\u3000\u2190$domain.crt
\nSSLCertificateKeyFile \/etc\/letsencrypt\/live\/example.com\/privkey.pem\u3000\u2190$domain.key<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4ee5\u524d\u3001SSL\u8a3c\u660e\u66f8\u3092\u53d6\u5f97\u3057\u307e\u3057\u305f\u304c\u3001\u5148\u6708\u304b\u3089\u66f4\u65b0\u304c\u3067\u304d\u305a\u3001\u30a8\u30e9\u30fc\u3092\u8d77\u3053\u3059\u3088\u3046\u306b\u306a\u3063\u3066\u3057\u307e\u3044\u307e\u3057\u305f\u3002\u305d\u308c\u306b\u3088\u3063\u3066\u3001\u672c\u30b5\u30fc\u30d0\u30fc\u3078\u306ehttps\u3067\u306e\u30a2\u30af\u30bb\u30b9\u304c\u3067\u304d\u306a\u304f\u306a\u3063\u3066\u3057\u307e\u3044\u307e\u3057\u305f\u3002 \u3053\u308c\u307e\u3067\u7121\u6599\u306e\u8a3c\u660e\u66f8\u767a\u884c\u3092Let\u2019s E […]<\/p>\n","protected":false},"author":2,"featured_media":4843,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14],"tags":[],"class_list":["post-4834","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-unix"],"_links":{"self":[{"href":"https:\/\/hobby.mydns.jp\/teruki.wp\/wp-json\/wp\/v2\/posts\/4834","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hobby.mydns.jp\/teruki.wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hobby.mydns.jp\/teruki.wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hobby.mydns.jp\/teruki.wp\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hobby.mydns.jp\/teruki.wp\/wp-json\/wp\/v2\/comments?post=4834"}],"version-history":[{"count":9,"href":"https:\/\/hobby.mydns.jp\/teruki.wp\/wp-json\/wp\/v2\/posts\/4834\/revisions"}],"predecessor-version":[{"id":4845,"href":"https:\/\/hobby.mydns.jp\/teruki.wp\/wp-json\/wp\/v2\/posts\/4834\/revisions\/4845"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hobby.mydns.jp\/teruki.wp\/wp-json\/wp\/v2\/media\/4843"}],"wp:attachment":[{"href":"https:\/\/hobby.mydns.jp\/teruki.wp\/wp-json\/wp\/v2\/media?parent=4834"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hobby.mydns.jp\/teruki.wp\/wp-json\/wp\/v2\/categories?post=4834"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hobby.mydns.jp\/teruki.wp\/wp-json\/wp\/v2\/tags?post=4834"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}