{"id":5077,"date":"2020-09-07T21:02:47","date_gmt":"2020-09-07T12:02:47","guid":{"rendered":"https:\/\/kumapress.com\/?p=5077"},"modified":"2020-09-07T21:03:18","modified_gmt":"2020-09-07T12:03:18","slug":"%e3%83%9b%e3%83%bc%e3%83%a0%e3%83%9a%e3%83%bc%e3%82%b8%e3%82%92aws%e3%81%a7%e4%bd%9c%e3%82%8d%e3%81%86%ef%bc%9alightsail%e3%81%a7%e3%83%af%e3%83%bc%e3%83%89%e3%83%97%e3%83%ac%e3%82%b9%e3%81%a7ssl","status":"publish","type":"post","link":"https:\/\/kumapress.com\/?p=5077","title":{"rendered":"\u30db\u30fc\u30e0\u30da\u30fc\u30b8\u3092AWS\u3067\u4f5c\u308d\u3046\uff1aLightsail\u3067\u30ef\u30fc\u30c9\u30d7\u30ec\u30b9\u3067SSL\u5c0e\u5165"},"content":{"rendered":"\n

\u3055\u3066\u3001\u30db\u30fc\u30e0\u30da\u30fc\u30b8\u3092\u4f5c\u3063\u305f\u3089\u3001SSL\u8a3c\u660e\u66f8\u3092\u4f5c\u6210\u3001\u5c0e\u5165\u3057\u3066https\u5316\u3092\u3059\u308b\u3053\u3068\u306f\u3001\u4eca\u3067\u306f\u5f53\u305f\u308a\u524d\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/span><\/p>\n

SSL\u8a3c\u660e\u66f8\u3063\u3066\u5e74\u9593\u306e\u5229\u7528\u8cbb\u7528\u304c\u304b\u304b\u3063\u305f\u306e\u3068\u3001CSR\u4f5c\u3063\u305f\u308a\u7533\u8acb\u3057\u305f\u308a\u3067\u7d50\u69cb\u3081\u3093\u3069\u304f\u3055\u3044\u3093\u3067\u3059\u304c\u3001\u3044\u307e\u3067\u306f\u300cLet’s Encrypt\u300d\u306e\u304a\u304b\u3052\u3067\u305d\u306e\u3088\u3046\u306a\u3053\u3068\u3092\u3057\u306a\u304f\u3066\u3082SSL\u8a3c\u660e\u66f8\u304c\u7121\u6599\u3067\u4f5c\u6210\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002<\/span><\/p>\n

\u203b\u305f\u3060\u3057\u3001\uff13\u30f6\u6708\u3057\u304b\u6301\u3061\u307e\u305b\u3093\u306e\u3067\u3001\u5b9a\u671f\u7684\u306a\u518d\u4f5c\u6210\u304c\u5fc5\u8981\u3067\u306f\u3042\u308a\u307e\u3059\u3002<\/span><\/p>\n

\u4eca\u56de\u306f\u3001Amazon Lightsail \u3067\u30ef\u30fc\u30c9\u30d7\u30ec\u30b9\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u3092\u4f5c\u3063\u305f\u4e2d\u306bSSL\u3092\u5c0e\u5165\u3057\u3066\u307f\u307e\u3057\u305f\u3002<\/span><\/p>\n

\u307e\u3041\u3001\u30ef\u30fc\u30c9\u30d7\u30ec\u30b9\u304c\u306a\u3044\u74b0\u5883\u3067\u3082\u540c\u3058\u3067\u3059(^^;<\/span><\/p>\n

\u203bLightsail \u306e\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7\u306f\u3001\u3053\u3061\u3089\u3092\u53c2\u7167<\/a>\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/span><\/p>\n\n\n\n

Let’s Encrypt\u3067SSL\u8a3c\u660e\u66f8\u3092\u4f5c\u6210\u3057\u3066\u5c0e\u5165\u3059\u308b<\/h2>\n\n\n\n

\u30ef\u30fc\u30c9\u30d7\u30ec\u30b9\u3092\u666e\u901a\u306b\u5c0e\u5165\u3057\u305f\u3089\u3001Web\u30b5\u30fc\u30d0\u30fc\u306fApache\u304c\u5c0e\u5165\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/span><\/p>\n

\u4f5c\u6210\u624b\u9806\u3068Web\u30b5\u30fc\u30d0\u30fc\u3078\u306e\u8a2d\u7f6e\u306f\u3001\u307b\u307c\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306e\u624b\u9806\u901a\u308a\u3067\u3001OK\u3067\u3059\u3002<\/span><\/p>\n

\u203b\u4eca\u56de\u4f7f\u7528\u3059\u308b\u30c9\u30e1\u30a4\u30f3\u3067\u3059\u304c\u3001”hidari-uchiwa.com”\u3067\u3059\u3002<\/span><\/p>\n

\u300cBitnami\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u7528\u306eLet’s Encrypt SSL\u8a3c\u660e\u66f8\u3092\u751f\u6210\u3057\u3066\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u300d<\/a><\/span><\/p>\n

\u30b9\u30c6\u30c3\u30d71\uff1a\u30ec\u30b4\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b<\/span><\/strong><\/p>\n

\u30ec\u30b4\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306a\u3093\u3067\u3059\u304c\u3001\u3059\u3067\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u304c\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/span><\/p>\n

\u3067\u3059\u306e\u3067\u3001\u5b9f\u65bd\u306f\u3057\u307e\u305b\u3093\u3067\u3057\u305f\u304c\u3001\u624b\u9806\u306e\u7d39\u4ecb\u3060\u3051\u3057\u3066\u304a\u304d\u307e\u3059\u3002<\/span><\/p>\n\n\n\n

$ cd \/tmp\n$ curl -Ls https:\/\/api.github.com\/repos\/xenolf\/lego\/releases\/latest | grep browser_download_url | grep linux_amd64 | cut -d '\"' -f 4 | wget -i -\n$ tar xf lego_vX.Y.Z_linux_amd64.tar.gz\n\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u4f7f\u7528\u3059\u308b\n$ sudo mkdir -p \/opt\/bitnami\/letsencrypt\n$ sudo mv lego \/opt\/bitnami\/letsencrypt\/lego<\/pre><\/div>\n\n\n\n
\u30b9\u30c6\u30c3\u30d72\uff1a\u30c9\u30e1\u30a4\u30f3\u306eLet’s Encrypt\u8a3c\u660e\u66f8\u3092\u751f\u6210\u3059\u308b<\/span><\/strong><\/p>\n
\u30fb\u3059\u3079\u3066\u306eBitnami\u30b5\u30fc\u30d3\u30b9\u3092\u30aa\u30d5\u306b\u3057\u307e\u3059\u3002<\/span><\/p>\n
$ sudo \/opt\/bitnami\/ctlscript.sh stop<\/span><\/p>\n
bitname\u3084mysql\u304c\u505c\u6b62\u3057\u307e\u3059\u3002<\/span><\/p>\n
\u30fb\u8a3c\u660e\u66f8\u3092\u30ea\u30af\u30a8\u30b9\u30c8\u3057\u307e\u3059\u3002<\/span><\/p>\n\n\n\n
sudo \/opt\/bitnami\/letsencrypt\/lego --tls --email=\"info@kumakake.com\" --domains=\"hidari-uchiwa.com\" --domains=\"www.hidari-uchiwa.com\" --path=\"\/opt\/bitnami\/letsencrypt\" run\n\n08:47:36 No key found for account info@kumakake.com. Generating a P384 key.\n08:47:36 Saved key to \/opt\/bitnami\/letsencrypt\/accounts\/acme-v02.api.letsencrypt.org\/info@kumakake.com\/keys\/info@kumakake.com.key\n08:47:37 Please review the TOS at https:\/\/letsencrypt.org\/documents\/LE-SA-v1.2-November-15-2017.pdf\nDo you accept the TOS? Y\/n\nY\n\u203b\u5229\u7528\u898f\u7d04\u3078\u306e\u540c\u610f\u3067\u3059\u3002\n08:47:46 [INFO] acme: Registering account for info@kumakake.com\n!!!! HEADS UP !!!!\n\nYour account credentials have been saved in your Let's Encrypt\nconfiguration directory at \"\/opt\/bitnami\/letsencrypt\/accounts\".\n\nYou should make a secure backup of this folder now. This\nconfiguration directory will also contain certificates and\nprivate keys obtained from Let's Encrypt so making regular\nbackups of this folder is ideal.\n08:47:47 [INFO] [hidari-uchiwa.com, www.hidari-uchiwa.com] acme: Obtaining bundled SAN certificate\n08:47:49 [INFO] [hidari-uchiwa.com] AuthURL: https:\/\/acme-v02.api.letsencrypt.org\/acme\/authz-v3\/7045931068\n08:47:49 [INFO] [www.hidari-uchiwa.com] AuthURL: https:\/\/acme-v02.api.letsencrypt.org\/acme\/authz-v3\/7045931100\n08:47:49 [INFO] [hidari-uchiwa.com] acme: use tls-alpn-01 solver\n08:47:49 [INFO] [www.hidari-uchiwa.com] acme: use tls-alpn-01 solver\n08:47:49 [INFO] [hidari-uchiwa.com] acme: Trying to solve TLS-ALPN-01\n08:47:56 [INFO] [hidari-uchiwa.com] The server validated our request\n08:47:56 [INFO] [www.hidari-uchiwa.com] acme: Trying to solve TLS-ALPN-01\n08:48:03 [INFO] [www.hidari-uchiwa.com] The server validated our request\n08:48:03 [INFO] [hidari-uchiwa.com, www.hidari-uchiwa.com] acme: Validations succeeded; requesting certificates\n08:48:05 [INFO] [hidari-uchiwa.com] Server responded with a certificate.\n<\/pre><\/div>\n\n\n\n
\u3053\u306e\u7d50\u679c\u3068\u3057\u3066\u3001\u4e0b\u8a18\u306e\u3088\u3046\u306b\u5404\u30d5\u30a1\u30a4\u30eb\u304c\u4f5c\u6210\u3055\u308c\u307e\u3059\u3002<\/span><\/p>\n
$ sudo ls -al \/opt\/bitnami\/letsencrypt\/certificates\/<\/span>
-rw——- 1 root root 3364 Sep 7 08:48 hidari-uchiwa.com.crt<\/span>
-rw——- 1 root root 1648 Sep 7 08:48 hidari-uchiwa.com.issuer.crt<\/span>
-rw——- 1 root root 238 Sep 7 08:48 hidari-uchiwa.com.json<\/span>
-rw——- 1 root root 288 Sep 7 08:48 hidari-uchiwa.com.key<\/span><\/p>\n
\u30b9\u30c6\u30c3\u30d73\uff1aLet’s Encrypt\u8a3c\u660e\u66f8\u3092\u4f7f\u7528\u3059\u308b\u3088\u3046\u306bWeb\u30b5\u30fc\u30d0\u30fc\u3092\u69cb\u6210\u3059\u308b<\/span><\/strong><\/p>\n
\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306b\u306fApache\u3084nginx\u306e\u624b\u9806\u304c\u66f8\u304b\u308c\u3066\u3044\u308b\u306e\u3067\u3059\u304c\u3001\u4eca\u56de\u306f\u300c\u30a2\u30d7\u30ed\u30fc\u30c1B\u306eApache\u306e\u5834\u5408\uff08\u81ea\u5df1\u5b8c\u7d50\u578b\u306eBitnami\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\uff09\u300d\u3067\u884c\u3044\u307e\u3057\u305f\u3002<\/span><\/p>\n
\u300c\u30a2\u30d7\u30ed\u30fc\u30c1A\u306eApache\u306e\u5834\u5408\uff08\u30b7\u30b9\u30c6\u30e0\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u4f7f\u7528\u3057\u305fBitnami\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\uff09\u300d\u3063\u3066\u306e\u3082\u3042\u308b\u3093\u3067\u3059\u304c\u3001\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u69cb\u6210\u304c\u30d5\u30a3\u30c3\u30c8\u3057\u306a\u304b\u3063\u305f\u305f\u3081\u4e0d\u63a1\u7528\u3068\u3057\u3066\u3044\u307e\u3059\u3002<\/span><\/p>\n\n\n\n
$ sudo mv \/opt\/bitnami\/apache2\/conf\/server.crt \/opt\/bitnami\/apache2\/conf\/server.crt.old\n$ sudo mv \/opt\/bitnami\/apache2\/conf\/server.key \/opt\/bitnami\/apache2\/conf\/server.key.old\n$ sudo mv \/opt\/bitnami\/apache2\/conf\/server.csr \/opt\/bitnami\/apache2\/conf\/server.csr.old\n$ sudo ln -sf \/opt\/bitnami\/letsencrypt\/certificates\/hidari-uchiwa.com.key \/opt\/bitnami\/apache2\/conf\/server.key\n$ sudo ln -sf \/opt\/bitnami\/letsencrypt\/certificates\/hidari-uchiwa.com.crt \/opt\/bitnami\/apache2\/conf\/server.crt\n$ sudo chown root:root \/opt\/bitnami\/apache2\/conf\/server*\n$ sudo chmod 600 \/opt\/bitnami\/apache2\/conf\/server*<\/pre><\/div>\n\n\n\n
\u30fb\u3059\u3079\u3066\u306eBitnami\u30b5\u30fc\u30d3\u30b9\u3092\u518d\u8d77\u52d5\u3057\u307e\u3059\u3002<\/span><\/p>\n
$ sudo \/opt\/bitnami\/ctlscript.sh start<\/span><\/p>\n
\u3053\u306e\u6bb5\u968e\u3067\u3001https\u3067\u8868\u793a\u3057\u3066\u307f\u3066\u3001Chrome\u306e\u30c7\u30d9\u30ed\u30c3\u30d1\u30fc\u30c4\u30fc\u30eb\u3067SSL\u8a3c\u660e\u66f8\u304c\u52d5\u4f5c\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002<\/span><\/p>\n
\"\"<\/p>\n\n\n\n
\u30ef\u30fc\u30c9\u30d7\u30ec\u30b9\u3067SSL\u304c\u4f7f\u3048\u308b\u3088\u3046\u306b\u3059\u308b<\/h2>\n\n\n\n
SSL\u306e\u5c0e\u5165\u81ea\u4f53\u306f\u3067\u304d\u305f\u3093\u3067\u3001\u3044\u3088\u3044\u3088\u30ef\u30fc\u30c9\u30d7\u30ec\u30b9\u3067SSL\u304c\u4f7f\u3048\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/span><\/p>\n
\u79c1\u306f\u3001\u30d7\u30e9\u30b0\u30a4\u30f3\u306e\u300cReally Simple SSL\u300d\u3092\u5229\u7528\u3057\u3066\u3044\u308b\u306e\u3067\u3001\u305d\u308c\u3092\u4f7f\u7528\u3057\u305f\u624b\u9806\u3092\u8a18\u8f09\u3057\u307e\u3059\u3002<\/span><\/p>\n
\u30b9\u30c6\u30c3\u30d7\uff11\uff1a\u300cReally Simple SSL\u300d\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059\u3002<\/span><\/strong><\/p>\n
\u666e\u901a\u306b\u30d7\u30e9\u30b0\u30a4\u30f3\u304b\u3089\u8ffd\u52a0\u3057\u3066\u304f\u3060\u3055\u3044(^^)<\/span><\/p>\n
\u30b9\u30c6\u30c3\u30d7\uff12\uff1a\u300cReally Simple SSL\u300d\u3092\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7\u3057\u307e\u3059\u3002<\/span><\/strong><\/p>\n
\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u5b8c\u4e86\u5f8c\u3001\u30c0\u30c3\u30b7\u30e5\u30dc\u30fc\u30c9\u3067\u300cwp-config.php\u304c\u66f8\u304d\u63db\u3048\u3089\u308c\u307e\u305b\u3093\uff01\u300d\u3063\u3066\u30a8\u30e9\u30fc\u304c\u3002\u3002\u3002<\/span><\/p>\n
\u4ed5\u65b9\u306a\u3044\u3093\u3067\u6a29\u9650\u3092\u4e0b\u8a18\u306e\u3088\u3046\u306b\u5909\u66f4\u3057\u307e\u3057\u305f\u3002<\/span><\/p>\n
$ ls -al \/opt\/bitnami\/apps\/wordpress\/htdocs\/wp-config.php<\/span>
-rw-r—– 1 bitnami daemon 4268 Sep 6 15:56 \/opt\/bitnami\/apps\/wordpress\/htdocs\/wp-config.php<\/span>
$ chmod 666 \/opt\/bitnami\/apps\/wordpress\/htdocs\/wp-config.php<\/span>
$ ls -al \/opt\/bitnami\/apps\/wordpress\/htdocs\/wp-config.php<\/span>
-rw-rw-rw- 1 bitnami daemon 4268 Sep 6 15:56 \/opt\/bitnami\/apps\/wordpress\/htdocs\/wp-config.php<\/span><\/p>\n
\u3053\u308c\u3067\u3001\u30c0\u30c3\u30b7\u30e5\u30dc\u30fc\u30c9\u3092\u518d\u8868\u793a\u3059\u308b\u3068\u3001<\/span><\/p>\n
\"\"<\/p>\n
\u3068\u8868\u793a\u3057\u3066\u304f\u308c\u305f\u306e\u3067[\u306f\u3044\u3001SSL\u3092\u6709\u52b9\u5316\u3057\u307e\u3059\u3002]\u3092\u30af\u30ea\u30c3\u30af\u3057\u3066SSL\u3092\u6709\u52b9\u3068\u3057\u307e\u3057\u305f\u3002<\/span><\/p>\n
\"\"<\/p>\n
\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u3001\u3053\u306e\u3088\u3046\u306a\u72b6\u614b\u3002\u3002\u3002<\/span><\/p>\n
\u3053\u308c\u3067\u30ef\u30fc\u30c9\u30d7\u30ec\u30b9\u3078\u306eSSL\u5c0e\u5165\u306fOK\u3067\u3059(^^)<\/span><\/p>\n\n\n\n
SSL\u8a3c\u660e\u66f8\u3092\u66f4\u65b0\u3057\u307e\u3059\u3002<\/h2>\n\n\n\n
Let’s Encrypt \u306eSSL\u8a3c\u660e\u66f8\u306f\uff19\uff10\u65e5\u3057\u304b\u6709\u52b9\u671f\u9650\u304c\u6709\u308a\u307e\u305b\u3093\u3002<\/span><\/p>\n
\u624b\u52d5\u3067\u66f4\u65b0\u3059\u308b\u3068\u3057\u305f\u3089\u3001\u671f\u9650\u304c\u5207\u308c\u308b\u524d\u306b\u66f4\u65b0\u3092\u3057\u307e\u3059\u3002<\/span><\/p>\n\n\n\n
$ sudo \/opt\/bitnami\/ctlscript.sh stop\n$ sudo \/opt\/bitnami\/letsencrypt\/lego --tls --email=\"info@kumakake.com\" --domains=\"hidari-uchiwa.com\" --path=\"\/opt\/bitnami\/letsencrypt\" renew --days 90\n$ sudo \/opt\/bitnami\/ctlscript.sh start<\/pre><\/div>\n\n\n\n
\u305f\u3060\u3001\u5fd8\u308c\u306a\u3044\u3088\u3046\u306b\u66f4\u65b0\u3059\u308b\u306e\u306f\u5927\u5909\u3067\u3059\u304b\u3089\u3001\u81ea\u52d5\u66f4\u65b0\u3059\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/span><\/p>\n
\uff11\uff09\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002( \/opt\/bitnami\/letsencrypt\/scripts\/renew-certificate.sh )<\/span><\/p>\n\n\n\n
#!\/bin\/bash\n\nsudo \/opt\/bitnami\/ctlscript.sh stop apache\nsudo \/opt\/bitnami\/letsencrypt\/lego --tls --email=\"info@kumakake.com\" --domains=\"hidari-uchiwa.com\" --path=\"\/opt\/bitnami\/letsencrypt\" renew --days 90\nsudo \/opt\/bitnami\/ctlscript.sh start apache<\/pre><\/div>\n\n\n\n
\uff12\uff09\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u53ef\u80fd\u3068\u3057\u307e\u3059\u3002<\/span><\/p>\n
$ sudo chmod +x \/opt\/bitnami\/letsencrypt\/scripts\/renew-certificate.sh<\/span><\/p>\n
$ sudo crontab -e<\/span><\/p>\n
0 0 1 * * \/opt\/bitnami\/letsencrypt\/scripts\/renew-certificate.sh 2> \/dev\/null<\/span><\/p>\n
\u6bce\u6708\uff11\u65e5\uff10\u6642\u306b\u66f4\u65b0\u304c\u8d70\u308a\u307e\u3059\u3002<\/span><\/p>\n