ITに頼って生きていく

0. python2.7が動く仮想環境を起動

sudo scl enable python27 bash

1. 証明書の確認のための専用のパスを作成する

nginx.conf

#以下の2行を追加して、別ディレクトリで認証する。
location ^~ /.well-known/acme-challenge/ {
  root /var/www/html;
}

2. 証明書を作成する

certbot-auto certonly  --webroot -w  /var/www/html -d boomin.yokohama -d hogehoge

3. nginxの設定を修正し、SSL通信を受けられるようにする

nginx.conf

listen 443 ssl http2;
listen [::]:443 ssl http2;

ssl_certificate /hogehoge/fullchain.pem; # managed by Certbot
ssl_certificate_key /hogehoge/privkey.pem; # managed by Certbot
ssl_trusted_certificate /hogehoge/fullchain.pem; managed by Certbot

ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam  /etc/nginx/conf.d/dhparam.pem;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=15768000;

# TLS Session Tickets setting
ssl_session_tickets     on;
ssl_session_ticket_key  /etc/nginx/conf.d/sslsessionticket.key;
# Session Cache setting
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 2d;

# enable HSTS including subdomains
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

4. nginx再起動

nginx -s reload

5. 証明書の更新

certbot-auto renew --post-hook "nginx -s reload"