let_s_encrypt
Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédenteProchaine révisionLes deux révisions suivantes | ||
| let_s_encrypt [2018/01/10 01:34] – simon | let_s_encrypt [2018/04/24 14:29] – [Clés plus longues] simon | ||
|---|---|---|---|
| Ligne 5: | Ligne 5: | ||
| J'ai configuré les certificats pour plusieurs noms de domaines et voici la procédure suivie, pour le domaine fictif " | J'ai configuré les certificats pour plusieurs noms de domaines et voici la procédure suivie, pour le domaine fictif " | ||
| - | J'ai utilisé l' | + | On commence par activer les backports (sous Stretch) afin de bénéficier de la version de [[certbot]] la plus récente. |
| <code bash> | <code bash> | ||
| - | # wget https://raw.githubusercontent.com/diafygi/ | + | # vim /etc/apt/sources.list |
| - | --2018-01-10 02: | + | |
| - | Resolving raw.githubusercontent.com | + | # Backports repository |
| - | Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.120.133|: | + | deb http://ftp.debian.org/debian stretch-backports main |
| - | HTTP request sent, awaiting response... 200 OK | + | |
| - | Length: 9179 (9.0K) [text/plain] | + | |
| - | Saving to: ‘/usr/ | + | |
| - | + | ||
| - | / | + | |
| - | + | ||
| - | 2018-01-10 02:30:22 (51.4 MB/s) - ‘/ | + | |
| </ | </ | ||
| - | On crée un dossier pour Let's Encrypt, avec les bons droits : | + | Dans mon cas, après installation sans les backports, certbot était en version 0.10 alors qu'avec les backports, on a la version 0.19.0. |
| - | <code bash> | + | |
| - | # mkdir / | + | |
| - | # chown root: | + | |
| - | # chmod 750 / | + | |
| - | </ | + | |
| - | On se déplace dans le dossier qu'on vient de créer : | ||
| <code bash> | <code bash> | ||
| - | # cd / | + | # apt-get -t stretch-backports install python-certbot-apache |
| </ | </ | ||
| - | Et on lance la génération d'une clé privée : | ||
| <code bash> | <code bash> | ||
| + | # certbot --version | ||
| + | certbot 0.19.0 | ||
| </ | </ | ||
| - | <code bash> | + | <WRAP center round alert 60%> |
| - | </code> | + | Sur une installation plus récente, j'ai du passer par [[pip]] pour installer certbot 0.21. L' |
| + | </WRAP> | ||
| - | <code bash> | ||
| - | </ | ||
| <code bash> | <code bash> | ||
| - | </code> | + | # certbot --apache |
| + | Saving debug log to /var/ | ||
| + | Plugins selected: Authenticator apache, Installer apache | ||
| - | <code bash> | + | Which names would you like to activate HTTPS for? |
| - | </code> | + | ------------------------------------------------------------------------------- |
| + | 1: plouf.com | ||
| + | 2: chat.plouf.com | ||
| + | 3: wiki.plouf.com | ||
| + | ------------------------------------------------------------------------------- | ||
| + | Select the appropriate numbers separated by commas and/or spaces, or leave input | ||
| + | blank to select all options shown (Enter ' | ||
| + | Obtaining a new certificate | ||
| + | Performing the following challenges: | ||
| + | tls-sni-01 challenge for caliban.be | ||
| + | Enabled Apache socache_shmcb module | ||
| + | Enabled Apache ssl module | ||
| + | Waiting for verification... | ||
| + | Cleaning up challenges | ||
| + | Created an SSL vhost at / | ||
| + | Enabled Apache socache_shmcb module | ||
| + | Enabled Apache ssl module | ||
| + | Deploying Certificate for caliban.be to VirtualHost / | ||
| + | Enabling available site: / | ||
| - | <code bash> | + | Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. |
| - | </code> | + | ------------------------------------------------------------------------------- |
| + | 1: No redirect - Make no further changes to the webserver configuration. | ||
| + | 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for | ||
| + | new sites, or if you're confident your site works on HTTPS. You can undo this | ||
| + | change by editing your web server' | ||
| + | ------------------------------------------------------------------------------- | ||
| + | Select the appropriate number [1-2] then [enter] (press ' | ||
| + | Redirecting vhost in / | ||
| - | <code bash> | + | ------------------------------------------------------------------------------- |
| - | </code> | + | Congratulations! You have successfully enabled https://plouf.com |
| - | <code bash> | + | You should test your configuration at: |
| - | </code> | + | https:// |
| + | ------------------------------------------------------------------------------- | ||
| - | <code bash> | + | IMPORTANT NOTES: |
| - | </code> | + | - Congratulations! Your certificate and chain have been saved at: |
| + | /etc/ | ||
| + | Your key file has been saved at: | ||
| + | / | ||
| + | Your cert will expire on 2018-04-10. To obtain a new or tweaked | ||
| + | | ||
| + | with the " | ||
| + | your certificates, | ||
| + | - If you like Certbot, please consider supporting our work by: | ||
| - | <code bash> | + | |
| + | | ||
| </ | </ | ||
| + | On peut tester un renouvellement des certificats avec la commande suivante : | ||
| <code bash> | <code bash> | ||
| + | # certbot renew --dry-run | ||
| </ | </ | ||
| - | <code bash> | + | Actuellement, |
| - | </ | + | |
| + | ==== Clés plus longues ==== | ||
| <code bash> | <code bash> | ||
| + | # certbot certonly -a webroot --rsa-key-size 4096 --webroot-path=/ | ||
| </ | </ | ||
| - | |||
| ===== Sources ===== | ===== Sources ===== | ||
| * [[https:// | * [[https:// | ||