Ubuntu nrog OpenLiteSpeed: Teeb Let’s Encrypt SSL kom txuas hnub nyoog tsis siv neeg

Lus taw qhia: Let's Encrypt SSL

Let's Encrypt yog ib lub chaw tso cai daim ntawv pov thawj qhib uas siv tshuab ua haujlwm, muab daim ntawv pov thawj TLS/SSL pub dawb rau sawv daws. Pawg Internet Security Research Group (ISRG) yog tus muab qhov kev pabcuam no. Zaj lus qhia no qhia yuav ua li cas nruab daim ntawv pov thawj Let's Encrypt SSL rau ntawm Ubuntu 20.04 server uas siv OpenLiteSpeed (~Apache), los ntawm tus pab cuam nruab Certbot. Thaum ua tiav zaj lus qhia no, lub server yuav muaj daim ntawv pov thawj siv tau thiab yuav xa txhua qhov HTTP thov mus rau HTTPS.

Yam yuav tsum muaj ua ntej: Let's Encrypt SSL

Let's Encrypt SSL: Zaj lus qhia no xav tias koj twb tau teeb tsa Vultr Ubuntu server nrog OpenLiteSpeed lossis Apache lawm, muaj lub npe sau xa mus rau koj tus server tus IP address, thiab koj tau nkag los ua tus root.

Nruab Certbot: Let's Encrypt SSL

Nruab Let's Encrypt SSL: Txoj kev nruab Certbot uas pom zoo yog siv Snap.

1. Txheeb xyuas tias snapd hloov tshiab kawg lawm. $ sudo snap install core; sudo snap refresh core
2. Tshem tawm certbot-auto thiab txhua pob Certbot ntawm OS. $ sudo apt-get remove certbot
3. Nruab Certbot nrog Snap. $ sudo snap install --classic certbot
4. Txuas Certbot rau /usr/bin. $ sudo ln -s /snap/bin/certbot /usr/bin/certbot

Xaiv txoj kev koj xav khiav Certbot

Koj puas pom zoo kom muab koj lub vev xaib nres ib ntus?

Yog, kuv lub web server tsis tau khiav tam sim no ntawm lub tshuab no.

Nres koj lub web server, ces khiav lo lus txib no kom tau daim ntawv pov thawj. Certbot yuav qhib ib lub web server ib ntus ntawm koj lub tshuab.

$ sudo certbot certonly --standalone

Tsis yog, kuv yuav tsum cia kuv lub web server khiav mus ntxiv.

Yog tias koj muaj web server uas twb siv port 80 lawm thiab tsis xav nres nws thaum Certbot khiav, khiav lo lus txib no thiab ua raws li cov lus qhia hauv lub davhlau ya nyob twg.

$ sudo certbot certonly --webroot

Yog xav siv lub webroot plugin, koj lub server yuav tsum tau teeb tsa kom muab cov ntaub ntawv hauv cov directory zais rau cov neeg siv. Yog /.well-known raug web server configuration saib xyuas tshwj xeeb, tej zaum koj yuav tsum hloov kho configuration kom paub tseeb tias cov ntaub ntawv hauv /.well-known/acme-challenge raug web server muab rau cov neeg siv.

Lus ceeb toom tseem ceeb

Nruab koj daim ntawv pov thawj

Koj yuav tsum nruab koj daim ntawv pov thawj tshiab rau hauv cov ntaub ntawv configuration ntawm koj lub web server.

Ntsuam xyuas kev txuas hnub nyoog tsis siv neeg

Cov pob Certbot hauv koj lub system muaj cron job lossis systemd timer uas yuav txuas hnub nyoog koj cov ntawv pov thawj tsis siv neeg ua ntej lawv tas sijhawm. Koj tsis tas yuav khiav Certbot dua, tshwj tsis yog koj hloov koj qhov configuration. Koj tuaj yeem ntsuam xyuas kev txuas hnub nyoog tsis siv neeg ntawm koj cov ntawv pov thawj los ntawm kev khiav lo lus txib no:

$ sudo certbot renew --dry-run

Lo lus txib txuas hnub nyoog Certbot raug nruab rau hauv ib qho ntawm cov chaw hauv qab no:

/etc/crontab/ ;/etc/cron.*/* ;systemctl list-timers

Yog tias qhov kev sim txuas hnub nyoog tsis siv neeg ua tsis tiav, thov xyuas qhov kev thov txuas hnub nyoog tsis siv neeg ntawm /etc/letsencrypt/renewal/domain.com.conf kom pom tias puas tau teeb tsa raug lawm (xws li qhov piv txwv qhia hauv qab no).

renew_before_expiry = 30 days
version = 2.9.0
archive_dir = /etc/letsencrypt/archive/saibabc.com
cert = /etc/letsencrypt/live/saibabc.com/cert.pem
privkey = /etc/letsencrypt/live/saibabc.com/privkey.pem
chain = /etc/letsencrypt/live/saibabc.com/chain.pem
fullchain = /etc/letsencrypt/live/saibabc.com/fullchain.pem 
Options used in the renewal process 
[renewalparams]
account = 56bb8680ab21b3db38f6d756e69139be
authenticator = webroot
webroot_path = /var/www/html/saibabc.com
server = https://acme-v02.api.letsencrypt.org/directory
key_type = ecdsa
[[webroot_map]]
saibabc.com = /var/www/html/saibabc.com
www.saibabc.com = /var/www/html/saibabc.com

Paub tseeb tias Certbot ua haujlwm

Kom paub tseeb tias koj lub vev xaib tau teeb tsa raug, mus saib https://yourwebsite.com/ hauv koj lub browser thiab nrhiav lub cim xauv hauv qhov URL bar.