Yuav teeb SSL Let’s Encrypt rau Apache ntawm Ubuntu 22.04/24.04 li cas

Lus Qhia

Let’s Encrypt yog ib lub Certificate Authority (CA) pub dawb uas muab daim ntawv pov thawj TLS los mã hóa kev txuas ntawm browser thiab web server. Certbot yog ib qho ACME client uas siv los thov, nruab thiab rov txuas hnub nyoog daim ntawv pov thawj. Nrog Apache plugin, Certbot tuaj yeem nrhiav VirtualHost uas haum, ntxiv TLS configuration thiab rov thauj Apache tom qab nruab tiav (raws li Ubuntu Server Cov Ntaub Ntawv Qhia).

Hauv phau ntawv qhia no, koj yuav siv Certbot los muab daim ntawv pov thawj pub dawb rau Apache ntawm Ubuntu 22.04 lossis Ubuntu 24.04, teeb tsa HTTPS thiab kuaj qhov kev txuas hnub nyoog tsis siv neeg.

Kab lus no siv ib daim VirtualHost cais rau lub website es tsis hloov Apache qhov default configuration. Txoj no pab kom txhua domain muaj nws tus kheej configuration thiab tseem khaws tau default configuration ua txoj kev npajสำรอง.

Yam yuav tsum muaj

Txhawm rau ua raws li phau ntawv qhia no, koj yuav tsum muaj:

Ib lub Ubuntu 22.04 lossis Ubuntu 24.04 server uas muaj ib tus neeg siv tsis yog root, muaj cai tswj hwm los ntawm sudo thiab firewall twb tau teeb tsa lawm. Koj tuaj yeem saib phau ntawv qhia teeb tsa Ubuntu server.
Ib lub domain uas twb sau npe lawm. Hauv kab lus no, tus qauv domain yog your_domain.
DNS records uas taw mus rau server qhov public IP address:
- A record rau your_domain.
- A record rau www.your_domain.
Apache twb tau nruab lawm thiab muaj VirtualHost rau lub domain, xws li /etc/apache2/sites-available/your_domain.conf. Saib ntxiv txoj kev nruab Apache ntawm Ubuntu.
TCP chaw nres nkoj 80 yuav tsum nkag tau los ntawm Internet thaum HTTP-01 tab tom txheeb xyuas; chaw nres nkoj 443 yuav tsum qhib kom cov neeg siv nkag HTTPS tau (raws li Ubuntu Server Cov Ntaub Ntawv Qhia).

Kauj ruam 1 — Nruab Certbot

Certbot tuaj yeem nruab tau los ntawm ntau qhov chaw. Rau Ubuntu tiam tshiab, Ubuntu cov ntaub ntawv qhia pom zoo kom nruab Certbot los ntawm Snap kom tau txais version uas hloov kho ywj pheej ntawm APT pob lub voj voog.

Yog Snap tseem tsis tau nruab rau ntawm server, nruab snapd.

sudo apt update
sudo apt install snapd

Tom qab ntawd nruab Certbot thiab tsim qhov txuas rau lo lus txib hauv /usr/bin.

sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Yog server twb muaj Certbot uas nruab los ntawm APT lawm, xav txog kev tshem version qub ua ntej hloov mus rau Snap kom tsis txhob muaj teeb meem ntawm commands thiab txoj kev txuas hnub nyoog:

sudo apt remove certbot python3-certbot-apache

Kuaj version uas twb nruab lawm:

certbot --version

Kauj ruam 2 — Kuaj Apache VirtualHost configuration

Kom thiaj li muab thiab nruab daim ntawv pov thawj tsis siv neeg, Certbot yuav tsum nrhiav tau VirtualHost raug hauv Apache configuration. Lub domain npe raug muab los ntawm cov lus qhia ServerName thiab ServerAlias hauv VirtualHostblock.

Qhib lub domain VirtualHost file:

sudo nano /etc/apache2/sites-available/your_domain.conf

Xyuas kom file muaj cov kab zoo ib yam li no:

/etc/apache2/sites-available/your_domain.conf

...
ServerName your_domain
ServerAlias www.your_domain
...

Yog nyuam qhuav hloov configuration, kuaj syntax:

sudo apache2ctl configtest

Qhov txiaj ntsig xav tau yog Syntax OK. Yog tsis muaj qhov yuam kev, rov thauj Apache:

sudo systemctl reload apache2

Kuaj tias VirtualHost tau qhib lawm thiab Apache tab tom mloog cov chaw nres nkoj uas xav tau:

sudo a2ensite your_domain.conf
sudo apache2ctl -S

Kauj ruam 3 — Qhib HTTP thiab HTTPS hauv firewall

Yog siv UFW, tso cai rau SSH, HTTP thiab HTTPS. Tsis tsim nyog kaw chaw nres nkoj 80 ua ntej ua tiav kev muab daim ntawv pov thawj, vim Let’s Encrypt txoj HTTP-01 method yuav tsum nkag tau rau server los ntawm qhov chaw nres nkoj no. UFW yog Ubuntu qhov firewall cuab yeej mặc định (raws li Ubuntu Server Cov Ntaub Ntawv Qhia).

sudo ufw status
sudo ufw allow OpenSSH
sudo ufw allow 'Apache Full'

Kuaj daim ntawv teev application profiles yog profile Apache Full tsis muaj:

sudo ufw app list

Koj kuj tuaj yeem qhib ob lub web ports ncaj qha:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Kuajสถานะ dua:

sudo ufw status

Yog yav dhau los tau tso cai rau profile uas tsuas yog siv HTTP, koj tuaj yeem rho txoj cai qub tom qab lees paub Apache Full kev ua:

sudo ufw delete allow 'Apache'

Kauj ruam 4 — Muab thiab teeb tsa daim ntawv pov thawj TLS

Siv Certbot nrog Apache plugin thiab teev kom txhij txhua cov domain uas yuav tsum tau tiv thaiv:

sudo certbot --apache -d your_domain -d www.your_domain

Certbot yuav thov koj tus email chaw nyob kom xa lus ceeb toom txog kev ruaj ntseg thiab ceeb toom txog kev rov txuas hnub nyoog, thiab tseem yuav thov kom koj lees txais cov nqe lus siv. Sau ib qho email chaw nyob uas tseem siv tau thiab teb cov lus nug sib tham raws li qhov xav tau.

Certbot feem ntau yuav nug tias koj puas xav hloov tag nrho HTTP mus rau HTTPS. Rau ib lub vev xaib pej xeem, xaiv qhov kev hloov mus feem ntau yog qhov tsim nyog, tsuav yog daim ntawv thov tsis tas yuav khaws HTTP cais.

Tom qab ua tiav, cov ntaub ntawv daim ntawv pov thawj feem ntau nyob ntawm:

/etc/letsencrypt/live/your_domain/fullchain.pem
/etc/letsencrypt/live/your_domain/privkey.pem

fullchain.pem muaj daim ntawv pov thawj server nrog rau cov saw daim ntawv pov thawj nruab nrab; privkey.pem yog tus yuam sij ntiag tug. Tsis txhob faib lossis muab cai nyeem tus yuam sij ntiag tug rau cov neeg siv uas tsis tsim nyog (raws li Ubuntu Server cov ntaub ntawv qhia).

Certbot kuj yuav tsim lossis hloov kho Apache qhov teeb tsa HTTPS, feem ntau muaj tus txuas ntxiv -le-ssl.conf, ces rov thauj qhov kev pabcuam. Qhib lub vev xaib nrog https:// kom paub tseeb tias qhov browser tau txais daim ntawv pov thawj uas siv tau.

Koj siv tau SSL Labs Server Test los kuaj daim ntawv pov thawj thiab TLS qhov teeb tsa los ntawm ib qho kev pabcuam sab nraud.

Kauj ruam 5 — Kuaj Certbot qhov kev rov txuas hnub nyoog tsis siv neeg

Let’s Encrypt daim ntawv pov thawj tam sim no siv tau 90 hnub thiab tsim los kom rov txuas hnub nyoog tsis siv neeg tsis tu ncua (raws li Ubuntu Server cov ntaub ntawv qhia). Tsis tsim nyog tos kom ze rau hnub tas sijhawm mam li rov txuas hnub nyoog ntawm tes.

Certbot uas teeb tsa los ntawm Snap teeb tsa systemd timer kom sim rov txuas hnub nyoog ob zaug hauv ib hnub. Kuaj timer nrog lo lus txib:

sudo systemctl status snap.certbot.renew.timer

Yog timer tseem tsis tau khiav, koj qhib thiab pib nws tau:

sudo systemctl enable --now snap.certbot.renew.timer

Sim khiav txoj kev rov txuas hnub nyoog yam tsis hloov daim ntawv pov thawj uas tab tom siv:

sudo certbot renew --dry-run

Yog qhov tshwm sim qhia tias cov kev rov txuas hnub nyoog sim tau ua tiav, ces qhov teeb tsa twb npaj txhij lawm. Thaum tsim nyog, Certbot yuav rov txuas hnub nyoog daim ntawv pov thawj thiab Apache plugin yuav rov thauj Apache tom qab rov txuas hnub nyoog tiav. Yog lub vev xaib nyob tom qab firewall hauv network, load balancer lossis tus muab kev pabcuam cloud, xyuas kom cov chaw nres nkoj 80 thiab 443 kuj raug tso cai hauv txheej network ntawd.

Xaus lus

Koj twb teeb tsa Certbot, kuaj Apache VirtualHost, qhib cov chaw nres nkoj web uas tsim nyog, muab daim ntawv pov thawj TLS Let’s Encrypt thiab txheeb xyuas txoj kev rov txuas hnub nyoog tsis siv neeg lawm. Tom qab qhib HTTPS, kuaj ob qho domain tseem ceeb thiab domain www, thiab tib lub sijhawm saib xyuas Let’s Encrypt cov email ceeb toom kom daws tau cov teeb meem rov txuas hnub nyoog ntxov.

Yuav tiv thaiv Apache li casด้วย Let’s Encrypt ntawm Ubuntu