Nruab Let’s Encrypt hauv Ubuntu nrog OpenLiteSpeed

Kev qhia txog Let’s Encrypt

Let’s Encrypt yog lub koom haum muab certificate (Certificate Authority – CA) uas ua haujlwm tsis siv neeg, qhib thiab pub dawb, khiav hauj lwm los ntawm Internet Security Research Group (ISRG). Tam sim no Let’s Encrypt certificate muaj hnub nyoog siv tau 90 hnub raws li qhov teeb tsa thawj zaug, yog li yuav tsum teeb tsa lub server kom rov txuas hnub nyoog tsis siv neeg, tsis yog tos kom certificate tas sij hawm (raws li letsencrypt.org).

Kab lus no qhia txog kev nruab TLS/SSL Let’s Encrypt certificate rau Ubuntu server uas khiav OpenLiteSpeed siv Certbot. Koj yuav muab certificate los ntawm txoj kev webroot, teeb tsa OpenLiteSpeed siv cov ntaub ntawv certificate, teeb tsa kom hloov HTTP mus rau HTTPS thiab tshuaj xyuas kev rov txuas hnub nyoog tsis siv neeg.

Yam yuav tsum muaj ua ntej

Ib lub Ubuntu server uas txhawb nqa thiab ib tus account uas muaj cai sudo.
Muaj OpenLiteSpeed nruab lawm thiab tab tom muab website kev pabcuam.
Lub domain thiab cov subdomain uas yuav thov certificate, xws li example.com thiab www.example.com, twb taw mus rau tus IP address ntawm lub server kom raug lawm.
Qhib TCP ports 80 thiab 443 hauv firewall lossis VPS tus neeg muab kev pabcuam lub security group. Let’s Encrypt yuav tsum nkag tau mus rau lub server kom txheeb xyuas tias koj tswj tau lub domain.
Paub meej txog lub website lub hauv paus nplaub tshev (document root), piv txwv /var/www/html/example.com.

Tam sim no OpenLiteSpeed kuj muaj ACME mechanism uas txuas nrog hauv system rau kev thov thiab rov txuas hnub nyoog certificate tsis siv neeg. Txawm li cas los xij, yog koj tab tom tswj certificate nrog Certbot lossis xav khaws koj cov txheej txheem tam sim no, tseem siv tau Certbot ib leeg (raws li docs.openlitespeed.org).

Nruab Certbot hauv Ubuntu

Txoj kev nruab uas Certbot pom zoo yog Snap. Yog lub server twb nruab Certbot los ntawm apt lossis ib qho certbot-auto, cia li tshem daim qub tawm kom tsis txhob hu yuam kev rau lwm qhov program thaum rov txuas hnub nyoog (raws li certbot.eff.org).

sudo apt-get remove certbot
sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot

Yog lub server tseem tsis tau muaj snapd, nruab thiab qhib Snap raws li cov lus qhia rau Ubuntu version uas koj tab tom siv, ua ntej khiav cov lus txib saum toj no.

Thov certificate siv txoj kev webroot

Yog OpenLiteSpeed tab tom khiav ntawm port 80, txoj kev webroot feem ntau haum dua standalone vim tsis tas yuav nres web server. Certbot yuav tsim cov ntaub ntawv txheeb xyuas hauv nplaub tshev .well-known/acme-challenge; Let’s Encrypt yuav nkag mus nyeem cov ntaub ntawv no ntawm HTTP kom txheeb xyuas lub domain.

sudo certbot certonly --webroot 
  -w /var/www/html/example.com 
  -d example.com 
  -d www.example.com

Hloov example.com thiab txoj kev -w ua raws koj cov ntaub ntawv tiag. Yog website muaj ntau lub domain tab sis siv document root sib txawv, ces ntxiv qhov kev xaiv -w ua ntej txhua pab domain uas tsim nyog.

Tsis txhob thaiv lossis hloov txoj kev /.well-known/acme-challenge/yuam kev. Kuaj kom paub tias document root nplaub tshev muaj cai nyeem tau, thiab xyuas kom OpenLiteSpeed tuaj yeem muab cov ntaub ntawv hauv nplaub tshev ntawd los ntawm port 80.
Lus ceeb toom tseem ceeb

Yog port 80 tsis tuaj yeem muab website kev pabcuam, koj siv tau txoj kev standalone, tab sis yuav tsum nres OpenLiteSpeed ua ntej kom Certbot siv port no ib ntus:

sudo systemctl stop lsws
sudo certbot certonly --standalone -d example.com -d www.example.com
sudo systemctl start lsws

Teeb tsa certificate hauv OpenLiteSpeed

Tom qab thov tiav, Certbot feem ntau khaws certificate rau hauv nplaub tshev /etc/letsencrypt/live/example.com/. Hauv OpenLiteSpeed WebAdmin Console, mus rau Listeners > HTTPS > SSL lossis mus rau ntu SSL ntawm virtual host, ces teeb tsa:

Private Key File: /etc/letsencrypt/live/example.com/privkey.pem
Certificate File: /etc/letsencrypt/live/example.com/fullchain.pem
Chained Certificate: Yes

Xyuas kom HTTPS listener mloog port 443 thiab virtual host tau txuas nrog lub domain raug. OpenLiteSpeed txhawb kev teeb tsa certificate rau theem listener lossis virtual host; kev teeb tsa rau theem virtual host yuav muaj qhov tseem ceeb dua (raws li docs.openlitespeed.org).

Txuag qhov teeb tsa, ces rov pib OpenLiteSpeed:

sudo systemctl restart lsws

Hloov HTTP mus rau HTTPS

Lo lus txib certbot certonly tsuas yog thov certificate xwb; nws tsis hloov OpenLiteSpeed qhov teeb tsa thiab tsis qhib kev hloov HTTP mus rau HTTPS rau koj. Koj yuav tsum teeb tsa qhov kev hloov ntawd hauv virtual host lossis rewrite file uas OpenLiteSpeed tab tom thauj khoom.

RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

Yog xav khaws lub domain qub uas tus neeg siv twb nkag los, siv server variable uas haum hauv koj qhov teeb tsa es tsis txhob muab example.comkhi cia. Tom qab hloov rewrite rule, rov pib lossis ua graceful restart rau OpenLiteSpeed kom qhov teeb tsa tshiab siv tau (raws li docs.openlitespeed.org).

Kuaj Let’s Encrypt txoj kev rov txuas daim ntawv pov thawj cia li

Certbot uas nruab los ntawm Snap muaj ib qho txheej txheem kuaj thiab rov txuas daim ntawv pov thawj cia li nrog. Lo lus txib renew yuav ua cov ntawv pov thawj uas yuav tag sijhawm sai sai thiab tuaj yeem khiav raws sijhawm yam tsis tas yuam kom rov txuas txhua zaus.

sudo certbot renew --dry-run

Yog qhov kev kuaj khiav tiav, ces kuaj Certbot lub timer:

systemctl list-timers --all | grep -i certbot
sudo snap services certbot

Certbot feem ntau siv systemd timer lossis lub sijhawm teem uas phim lub pob software uas tau nruab. Tsis tsim nyog hloov kho cov ntaub ntawv hauv /etc/letsencrypt/renewal/ ncaj qha yog tseem tsis tau thaub qab thiab kuaj nrog --dry-run.

Ntxiv OpenLiteSpeed dua tom qab rov txuas daim ntawv pov thawj

OpenLiteSpeed taw rau cov kev hauv daim nplaub tshev ruaj khov /etc/letsencrypt/live/. Tom qab Certbot muab daim ntawv pov thawj tshiab, feem ntau yuav tsum rov nqus lub server kom siv tau daim ntawv pov thawj tshiab. Koj tuaj yeem tsim deploy hook, uas tsuas khiav tom qab rov txuas tiav lawm:

sudo tee /etc/letsencrypt/renewal-hooks/deploy/reload-openlitespeed.sh > /dev/null <<'EOF'
#!/bin/sh
systemctl reload lsws
EOF
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-openlitespeed.sh

Yog lub kaw lus tsis txhawb reload rau koj qhov kev pabcuam, siv lo lus txib rov pib dua uas OpenLiteSpeed cov ntaub ntawv qhia:

sudo systemctl restart lsws

Deploy hook tsuas raug khiav tom qab daim ntawv pov thawj tau rov txuas tiag tiag lawm. Koj tuaj yeem kuaj hook nrog certbot renew --dry-run; yog xav kuaj hook cais hauv Certbot version uas txhawb qhov kev xaiv no, ntxiv --run-deploy-hooks (raws li eff-certbot.readthedocs.io).

Paub tseeb tias HTTPS ua haujlwm

Siv browser mus kuaj lub vev xaib ntawm https://example.com/. Koj kuj yuav tsum txheeb xyuas cov subdomain, kev hloov redirect thiab hnub uas daim ntawv pov thawj yuav tag sijhawm:

curl -I http://example.com
curl -I https://example.com
sudo certbot certificates

Qhov txiaj ntsig xav tau yog HTTP request raug redirect mus rau HTTPS, hos HTTPS request rov qab tau qhov lus teb ib txwm nrog daim ntawv pov thawj uas phim lub domain. Yog browser ceeb toom txog daim ntawv pov thawj, rov kuaj txoj kev fullchain.pem, privkey.pem, kev map ntawm virtual host thiab lub sijhawm uas rov nqus OpenLiteSpeed.

Koj twb ua tiav kev nruab Let’s Encrypt daim ntawv pov thawj rau Ubuntu nrog OpenLiteSpeed thiab teeb tsa txheej txheem rov txuas cia li lawm.

Nyeem ntxiv: Txhim kho kev ruaj ntseg thiab kev ua tau zoo nrog Ubuntu Server: Phau ntawv qhia kev teeb tsa