Teeb HTTPS rau Apache nrog Let’s Encrypt ntawm Ubuntu

Lus Qhia

Let’s Encrypt yog ib lub Certificate Authority (CA) pub dawb thiab siv tshuab ua haujlwm tsis siv neeg, uas muab daim ntawv pov thawj TLS los txheeb xyuas server thiab mã hóa kev sib txuas ntawm browser thiab web server. Certbot yog ACME client siv thov, nruab thiab txuas hnub nyoog daim ntawv pov thawj tsis siv neeg. Nrog Apache plugin, Certbot nrhiav tau VirtualHost uas tsim nyog, ntxiv TLS configuration thiab reload Apache tom qab nruab tiav (raws li ubuntu.com).

Hauv phau ntawv qhia no, koj yuav siv Certbot los thov daim ntawv pov thawj rau Apache ntawm Ubuntu 22.04 lossis Ubuntu 24.04, qhib HTTPS thiab kuaj qhov kev txuas hnub nyoog tsis siv neeg.

Kab lus no siv ib daim VirtualHost file cais rau lub website, tsis yog hloov Apache qhov default configuration. Txoj kev no ua rau txhua lub domain muaj nws tus kheej configuration thiab tswj tau yooj yim dua thaum server tab tom pab ntau lub website.

Yam yuav tsum muaj

Txhawm rau ua raws li phau ntawv qhia no, koj yuav tsum muaj:

Ib lub Ubuntu 22.04 lossis Ubuntu 24.04 server uas muaj ib tus neeg siv tsis yog root, muaj cai tswj hwm los ntawm sudo thiab firewall twb tau teeb tsa lawm. Koj tuaj yeem saib phau ntawv qhia teeb tsa Ubuntu server.
Ib lub domain uas twb sau npe lawm. Hauv kab lus no, tus qauv domain yog your_domain.
DNS ntawm lub domain yuav tsum taw mus rau server qhov public IP address. Yog xav siv ib daim ntawv pov thawj rau ob lub npe tib si, tsim:
- A record lossis AAAA record rau your_domain, nyob ntawm hom address uas server siv.
- A record lossis AAAA record rau www.your_domain, yog tias website siv lub npe no.
Apache twb tau nruab lawm thiab muaj VirtualHost rau lub domain, xws li /etc/apache2/sites-available/your_domain.conf. Saib ntxiv txoj kev nruab Apache ntawm Ubuntu.
TCP chaw nres nkoj 80 yuav tsum nkag tau los ntawm Internet thaum siv HTTP-01 verification; TCP port 443 yuav tsum qhib kom cov neeg siv nkag HTTPS tau (raws li ubuntu.com).

Kauj ruam 1 — Nruab Certbot

Ubuntu cov ntaub ntawv qhia tam sim no kom nruab Certbot los ntawm Snap Store. Txoj kev no ua rau Certbot hloov tshiab cais ntawm Ubuntu APT package release cycle.

Yog Snap tseem tsis tau nruab rau ntawm server, nruab snapd.

sudo apt update
sudo apt install snapd

Tom qab ntawd nruab Certbot:

sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot

Yog tias qhov command certbot nrhiav tsis tau tom qab nruab tiav, tsim ib qho link mus rau executable file:

sudo ln -s /snap/bin/certbot /usr/bin/certbot

Yog tias server twb muaj Certbot los ntawm APT lawm, kuaj cov package uas twb muaj ua ntej hloov mus rau Snap. Tsis txhob nruab Certbot ob version tib lub sijhawm yog koj tsis paub tseeb tias ob qho siv tib lub tshuab txuas hnub nyoog. Koj tuaj yeem saib cov package uas cuam tshuam nrog:

apt list --installed 2>/dev/null | grep -E 'certbot|python3-certbot'

Kuaj version uas twb nruab lawm:

certbot --version

Kauj ruam 2 — Kuaj Apache VirtualHost configuration

Kom thiaj li muab thiab nruab daim ntawv pov thawj tsis siv neeg, Certbot yuav tsum nrhiav tau VirtualHost raug hauv Apache configuration. Lub domain npe raug muab los ntawm cov lus qhia ServerName thiab ServerAlias. VirtualHost uas siv yuav tsum tau qhib hauv directory /etc/apache2/sites-enabled/block.

Qhib lub domain VirtualHost file:

sudo nano /etc/apache2/sites-available/your_domain.conf

Xyuas kom file muaj cov kab zoo ib yam li no:

<VirtualHost *:80>
    ServerName your_domain
    ServerAlias www.your_domain
    DocumentRoot /var/www/your_domain
</VirtualHost>

Yog tias website tseem tsis tau qhib, qhib VirtualHost thiab kuaj syntax:

sudo a2ensite your_domain.conf
sudo apache2ctl configtest

Qhov txiaj ntsig xav tau yog Syntax OK. Yog tsis muaj qhov yuam kev, reload Apache thiab saib daim ntawv teev VirtualHost:

sudo systemctl reload apache2
sudo apache2ctl -S

Kauj ruam 3 — Qhib HTTP thiab HTTPS hauv firewall

Yog siv UFW, tso cai rau SSH, HTTP thiab HTTPS. Tsis tsim nyog kaw chaw nres nkoj 80 ua ntej ua kom tiav qhov kev thov daim ntawv pov thawj, vim HTTP-01 verification txheeb xyuas kev tswj domain los ntawm xa HTTP request mus rau server dhau port no (raws li ubuntu.com).

sudo ufw status
sudo ufw allow OpenSSH
sudo ufw allow 'Apache Full'

Yog profile Apache Full tsis muaj, saib daim ntawv teev profile lossis qhib ob lub web port ncaj qha:

sudo ufw app list
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw status

Yog yav tas los koj tau tso cai rau profile uas siv HTTP nkaus xwb, koj tuaj yeem rho tawm txoj cai qub tom qab lees paub tias HTTPS txoj cai ua haujlwm:

sudo ufw delete allow 'Apache'

Dhau li UFW, kuaj VPS provider lub firewall, security group, router lossis load balancer yog muaj. Cov txheej network no kuj yuav tsum tso cai rau cov traffic nkag los ntawm port 80 thiab 443.

Kauj ruam 4 — Muab thiab teeb tsa daim ntawv pov thawj TLS

Siv Certbot nrog Apache plugin thiab teev kom txhij txhua cov domain uas yuav tsum tau tiv thaiv:

sudo certbot --apache -d your_domain -d www.your_domain

Certbot yuav thov email address los xa cov lus ceeb toom, thov kom koj lees txais cov service terms thiab nug seb puas xav redirect HTTP mus rau HTTPS. Rau lub website pej xeem, redirect HTTP tag nrho mus rau HTTPS feem ntau yog qhov kev xaiv tsim nyog, tsuav application tsis tas yuav khaws HTTP cais.

Txhua qhov option -d yuav ntxiv ib lub domain rau hauv daim ntawv pov thawj ua Subject Alternative Name (SAN). Yog li, sau tag nrho cov domain uas yuav siv rau hauv tib command ntawd.

Tom qab ua tiav, cov ntaub ntawv daim ntawv pov thawj feem ntau nyob ntawm:

/etc/letsencrypt/live/your_domain/fullchain.pem
/etc/letsencrypt/live/your_domain/privkey.pem

fullchain.pem muaj daim ntawv pov thawj server nrog rau cov saw daim ntawv pov thawj nruab nrab; privkey.pem yog private key. Tsis txhob faib private key lossis muab cai nyeem rau cov neeg siv uas tsis tsim nyog. Certbot feem ntau siv cov path hauv directory live los teeb tsa service.

Certbot yuav tsim lossis hloov Apache HTTPS configuration, ces reload service. Qhib ob qho tib si https://your_domain thiab https://www.your_domain los lees paub tias domain, daim ntawv pov thawj thiab redirect raug.

Koj siv tau SSL Labs Server Test los kuaj daim ntawv pov thawj thiab TLS qhov teeb tsa los ntawm ib qho kev pabcuam sab nraud.

Kauj ruam 5 — Kuaj Certbot qhov kev rov txuas hnub nyoog tsis siv neeg

Let’s Encrypt daim ntawv pov thawj raws li default profile tseem siv tau 90 hnub. Let’s Encrypt tab tom nthuav tawm cov profile uas siv tau luv dua: profile tlsserver yuav muab daim ntawv pov thawj 45 hnub tau txij li 13 Tsib Hlis 2026, hos default profile classic xav tias yuav hloov mus rau 64 hnub rau 10 Ob Hlis 2027 thiab 45 hnub rau 16 Ob Hlis 2028. Feem coob ntawm cov neeg siv uas txuas hnub nyoog tsis siv neeg tsis tas hloov tam sim no, tab sis yuav tsum xyuas kom lub sijhawm txuas hnub nyoog tsis vam khom ib lub sijhawm ruaj khov uas ntev dhau (raws li letsencrypt.org).

Certbot uas teeb tsa los ntawm Snap teeb tsa systemd timer kom sim rov txuas hnub nyoog ob zaug hauv ib hnub. Kuaj timer nrog lo lus txib:

sudo systemctl status snap.certbot.renew.timer

Sim khiav txoj kev rov txuas hnub nyoog yam tsis hloov daim ntawv pov thawj uas tab tom siv:

sudo certbot renew --dry-run

Yog qhov txiaj ntsig qhia tias qhov simulated renewal ua tiav, qhov basic configuration twb npaj txhij lawm. Thaum daim ntawv pov thawj yuav txog sijhawm tas, Certbot yuav txuas hnub nyoog nws tus kheej; rau daim ntawv pov thawj nruab los ntawm Apache plugin, Apache yuav reload tom qab txuas hnub nyoog tiav (raws li ubuntu.com).

Yog website siv reverse proxy, load balancer lossis private network firewall, kuaj seb puas nkag tau los ntawm Internet thiab saib log thaum command --dry-run ua tsis tiav. Rau domain uas tsis tuaj yeem pab HTTP-01 dhau port 80 lossis thaum xav tau wildcard certificate xws li *.example.com, koj tuaj yeem siv DNS-01 method thiab DNS plugin uas tsim nyog.

Xaus lus

Koj twb teeb tsa Certbot, kuaj Apache VirtualHost, qhib cov chaw nres nkoj web uas tsim nyog, muab daim ntawv pov thawj TLS Let’s Encrypt thiab txheeb xyuas txoj kev rov txuas hnub nyoog tsis siv neeg lawm. Tom qab qhib HTTPS, kuaj ob qho domain tseem ceeb thiab domain www, taug qab renewal log thiab daws txhua qhov kev ceeb toom kom ntxov kom tsis txhob cia daim ntawv pov thawj tas sijhawm.