Ịtọlite HTTPS na Let's Encrypt SSL Certificate Maka Nginx na RHEL/CentOS 7/6

6. Mgbe etinyere usoro nchịkọta na ịdabere na igwe gị, Ka anyị Encrypt ga-akpali gị ịbanye na akaụntụ gị nke a ga-eji maka mgbake isi furu efu ma ọ bụ ọkwa ọkwa ngwa ngwa.

7. Ọzọ ị ga-ekwenye na usoro ikike site na ịpị igodo Tinye.

8. N'ikpeazụ, ọ bụrụ na ihe niile na-aga dị ka o kwesịrị, a ga-egosi ozi ekele ozi na gị bash ọnụ. Ozi a ga-egosipụtakwa mgbe asambodo ga-ekubi ume.

Kwụpụ 4: Wụnye Ka anyị Encrypt SSL Asambodo na Nginx

9. Ugbu a ị nwere Asambodo SSL/TLS n'efu, ọ bụ oge itinye ya na sava weebụ Nginx ka ngalaba gị wee jiri ya.

Tinye ihe mgbochi na-esonụ na Nginx.conf:

ssl_dhparam /etc/nginx/ssl/dhparams.pem;
ssl_session_timeout 30m;
ssl_session_cache shared:SSL:10m;
ssl_buffer_size 8k;
add_header Strict-Transport-Security max-age=31536000;

15. Malitegharịa ekwentị Nginx ọrụ ka itinye mgbanwe ma nwalee gị SSL akwụkwọ site na-ekpochapụ gara aga nsonaazụ cache si njikọ a kpọtụrụ aha n'elu.

# systemctl restart nginx
# service nginx restart

Kwụpụ 5: Megharịa Nginx n'efu na akpaaka na-ahapụ asambodo SSL zoro ezo

16. Ka anyị Encrypt CA wepụta asambodo SSL/TLS n'efu maka ụbọchị 90. Enwere ike iji aka megharịa asambodo ma tinye n'ọrụ tupu njedebe site na iji webroot ngwa mgbakwunye, na-akwụsịghị sava weebụ gị, site na ịnye iwu ndị a:

# ./letsencrypt-auto certonly -a webroot --agree-tos --renew-by-default --webroot-path=/usr/share/nginx/html/ -d yourdomain.tld -d www.yourdomain.tld
# systemctl reload nginx

Mgbe ị na-eme iwu a dị n'elu, jide n'aka na ị ga-edochi webroot-ụzọ ka ọ dabara na mgbọrọgwụ akwụkwọ sava weebụ gị, nke nkwupụta mgbọrọgwụ Nginx kwuru.

17. Iji akpaaka megharia akwụkwọ tupu ya ekubie ume mepụta nke a bash script si github erikaheidi na/usr/local/bin/ndekọ na tinye n'okpuru ọdịnaya (edemede ọ bụ ubé gbanwetụrụ na-egosipụta Nginx ntọala).

# vi /usr/local/bin/cert-renew

Tinye ahịrị ndị a na faịlụ cert-emegharia.

#!/bin/bash

webpath='/usr/share/nginx/html/'
domain=$1
le_path='/opt/letsencrypt'
le_conf='/etc/letsencrypt'
exp_limit=30;

get_domain_list(){
        certdomain=$1
        config_file="$le_conf/renewal/$certdomain.conf"

        if [ ! -f $config_file ] ; then
                echo "[ERROR] The config file for the certificate $certdomain was not found."
                exit 1;
        fi

        domains=$(grep --only-matching --perl-regex "(?<=domains \= ).*" "${config_file}")
        last_char=$(echo "${domains}" | awk '{print substr($0,length,1)}')

        if [ "${last_char}" = "," ]; then
                domains=$(echo "${domains}" |awk '{print substr($0, 1, length-1)}')
        fi

        echo $domains;
}

if [ -z "$domain" ] ; then
        echo "[ERROR] you must provide the domain name for the certificate renewal."
        exit 1;
fi

cert_file="/etc/letsencrypt/live/$domain/fullchain.pem"

if [ ! -f $cert_file ]; then
        echo "[ERROR] certificate file not found for domain $domain."
        exit 1;
fi

exp=$(date -d "`openssl x509 -in $cert_file -text -noout|grep "Not After"|cut -c 25-`" +%s)
datenow=$(date -d "now" +%s)
days_exp=$(echo \( $exp - $datenow \) / 86400 |bc)

echo "Checking expiration date for $domain..."

if [ "$days_exp" -gt "$exp_limit" ] ; then
        echo "The certificate is up to date, no need for renewal ($days_exp days left)."
        exit 0;
else
        echo "The certificate for $domain is about to expire soon. Starting renewal request..."
        domain_list=$( get_domain_list $domain )
"$le_path"/letsencrypt-auto certonly -a webroot --agree-tos --renew-by-default --webroot-path=”$webpath” --domains "${domain_list}"
        echo "Reloading Nginx..."
sudo systemctl reload nginx
        echo "Renewal process finished for domain $domain"
        exit 0;
fi

18. Dochie mgbanwe $webpath site na mmalite nke edemede ka ọ dabara na mgbọrọgwụ akwụkwọ Nginx gị. Gbaa mbọ hụ na enwere ike ime ihe ederede na arụnyere ihe mgbako bc na sistemụ gị site na ịnye iwu ndị a.

# chmod +x /usr/local/bin/cert-renew
# yum install bc

Ị nwere ike nwalee edemede megide ngalaba gị site n'inye iwu a:

# /usr/local/bin/cert-renew yourdomain.tld

19. N'ikpeazụ, na-agba ọsọ na akwụkwọ ọhụrụ usoro na-akpaghị aka, tinye ọhụrụ cron ọrụ igbu script kwa izu ka imelite akwụkwọ n'ime 30 ụbọchị tupu ngafe ụbọchị.

# crontab -e

Tinye ahịrị na-esonụ na ala nke faịlụ ahụ.

@weekly  /usr/local/bin/cert-renew your_domain.tld >> /var/log/your_domain.tld-renew.log 2>&1

Ọ gwụla! Ugbu a ihe nkesa Nginx nwere ike ibuga ọdịnaya webụ echekwara na SSL/TLS ka anyị zoo akwụkwọ na webụsaịtị gị n'efu.