無料SSLサーバー証明書 Let's Encrypt インストール

[root@centos ~]# yum -y install certbot python-certbot-apache
[root@centos ~]# certbot --version
certbot 1.11.0

[root@centos ~]# certbot certonly --webroot -w /var/www/html -d server-manual.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): postmaster@server-manual.com ←メールアドレスを入力してエンター
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y ←Yを入力してエンター(規約に同意)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N ←Nを入力してエンター(EFFにメールアドレスを登録しない)
Account registered.
Requesting a certificate for server-manual.com
Performing the following challenges:
http-01 challenge for server-manual.com
Using the webroot path /var/www/html for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/server-manual.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/server-manual.com/privkey.pem
   Your certificate will expire on 2021-05-21. To obtain a new or
   tweaked version of this certificate in the future, simply run
   certbot again. To non-interactively renew *all* of your
   certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

[root@centos ~]# vi /etc/httpd/conf.d/ssl.conf
#SSLCertificateFile /etc/pki/tls/certs/localhost.crt
↓
SSLCertificateFile /etc/letsencrypt/live/server-manual.com/cert.pem ←コメント解除&変更(公開鍵)

#SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
↓
SSLCertificateKeyFile /etc/letsencrypt/live/server-manual.com/privkey.pem ←コメント解除&変更(秘密鍵)

#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
↓
SSLCertificateChainFile /etc/letsencrypt/live/server-manual.com/chain.pem ←コメント解除&変更(中間証明書)

[root@centos ~]# vi /etc/cron.monthly/certbot
#!/bin/sh

/bin/certbot renew --post-hook "systemctl restart httpd"

[root@centos ~]# chmod +x /etc/cron.monthly/certbot

[root@centos ~]# vi /etc/cron.monthly/certbot
#!/bin/sh

/bin/certbot renew --post-hook "systemctl restart nginx"

[root@centos ~]# chmod +x /etc/cron.monthly/certbot

/etc/letsencrypt/live/server-manual.com/cert.pem ←サーバ証明書（公開鍵）
/etc/letsencrypt/live/server-manual.com/chain.pem ←中間証明書
/etc/letsencrypt/live/server-manual.com/fullchain.pem ←サーバ証明書と中間証明書が結合されたファイル
/etc/letsencrypt/live/server-manual.com/privkey.pem ←秘密鍵

[root@centos ~]# vi /etc/httpd/conf.d/virtual-le-ssl.conf
<VirtualHost *:443>
    ServerName server-manual.com:443
    ServerAlias www.server-manual.com
    DocumentRoot /var/www/html
    SSLCertificateFile /etc/letsencrypt/live/server-manual.com/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/server-manual.com/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/server-manual.com/chain.pem
    <Directory "/var/www/html">
        Options Includes ExecCGI FollowSymLinks
    </Directory>
</VirtualHost>

[root@centos ~]# systemctl restart httpd

[root@centos wordpress]# vi /var/www/html/.htaccess
↓下記を記入
RewriteEngine On

RewriteCond %{HTTP_HOST} ^www.server-manual.com$ [NC,OR]
RewriteCond %{HTTPS} off
RewriteRule .* https://server-manual.com%{REQUEST_URI} [R=301,L]