CentOS 7.xでLet’s Encrypt証明書をインストールする

2022年2月8日

環境
CentoS 7.9
nginx 1.10.2

操作方法
1.httpsサービスを許可します

# firewall-cmd --add-service=https --permanent
# firewall-cmd --reload
# firewall-cmd --list-all

2.443ポートを開放します

# firewall-cmd --zone=public --add-port=443/tcp --permanent
# firewall-cmd --reload
# firewall-cmd --list-all

3.certbotパッケージをインストールします

# yum -y install certbot
# yum list installed | grep certbot

4.nginxのサービスを停止します
# systemctl stop nginx.service

5.SSL証明書をインストールします

# certbot certonly --standalone -d sample.com -m test@gmail.com --agree-tos -n
略
IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/sample.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/sample.com/privkey.pem
   Your certificate will expire on 2022-05-09. To obtain a new or
   tweaked version of this certificate in the future, simply run
   certbot again. To non-interactively renew *all* of your
   certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

サーバー証明書ファイルを確認します

#  ls -l /etc/letsencrypt/live/sample.com
total 4
-rw-r--r-- 1 root root 692 Feb  8 19:05 README
lrwxrwxrwx 1 root root  33 Feb  8 19:05 cert.pem -> ../../archive/sample.com/cert1.pem
lrwxrwxrwx 1 root root  34 Feb  8 19:05 chain.pem -> ../../archive/sample.com/chain1.pem
lrwxrwxrwx 1 root root  38 Feb  8 19:05 fullchain.pem -> ../../archive/sample.com/fullchain1.pem
lrwxrwxrwx 1 root root  36 Feb  8 19:05 privkey.pem -> ../../archive/sample.com/privkey1.pem

6.dhparam用ファイルを作成します

# mkdir /etc/nginx/ssl
# openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
# ls -a /etc/nginx/ssl/
.  ..  dhparam.pem

7.配置ファイルを作成します。
# vi /etc/nginx/conf.d/sample.com.conf
以下の内容を編集します

server {
  listen 80;
  server_name sample.com sample.com;
  rewrite ^ https://$server_name$request_uri? permanent;
}
server {
  listen 443 ssl;
  server_name sample.com sample.com;
  
  access_log /var/log/nginx/sample.com-access.log main;
  error_log /var/log/nginx/sample.com-error.log;
  root /home/www/sample.com;
  ssl_certificate /etc/letsencrypt/live/sample.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/sample.com/privkey.pem;
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_session_tickets on;
  ssl_dhparam /etc/nginx/ssl/dhparam.pem;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers HIGH:!aNULL:!MD5;
 ssl_prefer_server_ciphers on;
location / {
   index index.php index.html index.htm;
}
location ~ \.php$ {
  fastcgi_pass 127.0.0.1:9000;
  fastcgi_index index.php;
  fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 include fastcgi_params;
 }
}

8.配置ファイルの確認
# nginx -t

9.nginx再起動
# systemctl start nginx.service