1.環境・前提

環境と前提は以下の通りです。

1.1環境

サーバ：さくらインターネットVPS
OS：CentOS Linux release 7.9.2009 (Core)

1.2前提

・ドメイン取得、正引き設定済み
・Nginxをインストール済み、取得したドメインでドキュメントルートの設定済み

2.事前確認

SSL証明書を作成する前に、ドメインの正引きが出来ているかを確認します。

yumでhostコマンドをインストール

[hoge@hogehoge ~]$ yum -y install bind-utils

hostコマンドでIPアドレスの解決が正常に行われることを確認

[hoge@hogehoge ~]$ host www.hogehoge.com
www.hogehoge.com has address xxx.xxx.xxx.xxx

3.Let's Encryptでサーバー証明書の取得

3.1 epelレポジトリのインストール

Let's Encryptを利用するためのアプリケーションは”certbot”をインストールします。
certbotはCentOSのベースレポジトリには含まれていないので、epelレポジトリを利用できるようにします。

epelのインストール後

[hoge@hogehoge ~]$ yum list installed | grep epel
Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast
epel-release.noarch                    7-13                             @epel
libzstd.x86_64                         1.4.7-1.el7                      @epel
nginx.x86_64                           1:1.16.1-3.el7                   @epel
nginx-all-modules.noarch               1:1.16.1-3.el7                   @epel
nginx-filesystem.noarch                1:1.16.1-3.el7                   @epel
nginx-mod-http-image-filter.x86_64     1:1.16.1-3.el7                   @epel
nginx-mod-http-perl.x86_64             1:1.16.1-3.el7                   @epel
nginx-mod-http-xslt-filter.x86_64      1:1.16.1-3.el7                   @epel
nginx-mod-mail.x86_64                  1:1.16.1-3.el7                   @epel
nginx-mod-stream.x86_64                1:1.16.1-3.el7                   @epel
openssl11-libs.x86_64                  1:1.1.1g-2.el7                   @epel
snap-confine.x86_64                    2.49-1.el7                       @epel
snapd.x86_64                           2.49-1.el7                       @epel
snapd-selinux.noarch                   2.49-1.el7                       @epel
squashfuse.x86_64                      0.1.102-1.el7                    @epel
squashfuse-libs.x86_64                 0.1.102-1.el7                    @epel

レポジトリにepelが存在することを確認

[hoge@hogehoge ~]$ yum repolist
Loaded plugins: fastestmirror, langpacks
Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast
Loading mirror speeds from cached hostfile
 * base: ftp.iij.ad.jp
 * epel: d2lzkl7pfhq30w.cloudfront.net
 * extras: ftp.iij.ad.jp
 * updates: ftp.iij.ad.jp
repo id                                          repo name                                                                     status
!base/7/x86_64                                   CentOS-7 - Base                                                               10,072
!epel/x86_64                                     Extra Packages for Enterprise Linux 7 - x86_64                                13,545
!extras/7/x86_64                                 CentOS-7 - Extras                                                                453
!updates/7/x86_64                                CentOS-7 - Updates                                                             1,729
repolist: 25,799

3.2 certbotパッケージのインストール

certbotパッケージのが存在することを確認

[hoge@hogehoge ~]$  yum search certbot
Loaded plugins: fastestmirror, langpacks
Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast
Loading mirror speeds from cached hostfile
 * base: ftp.iij.ad.jp
 * epel: d2lzkl7pfhq30w.cloudfront.net
 * extras: ftp.iij.ad.jp
 * updates: ftp.iij.ad.jp
======================================================= N/S matched: certbot ========================================================
python2-certbot.noarch : Python 2 libraries used by certbot
python2-certbot-apache.noarch : The apache plugin for certbot
python2-certbot-dns-cloudflare.noarch : Cloudflare DNS Authenticator plugin for Certbot
python2-certbot-dns-cloudxns.noarch : CloudXNS DNS Authenticator plugin for Certbot
python2-certbot-dns-digitalocean.noarch : DigitalOcean DNS Authenticator plugin for Certbot
python2-certbot-dns-dnsimple.noarch : DNSimple DNS Authenticator plugin for Certbot
python2-certbot-dns-dnsmadeeasy.noarch : DNS Made Easy DNS Authenticator plugin for Certbot
python2-certbot-dns-gehirn.noarch : Gehirn Infrastructure Service DNS Authenticator plugin for Certbot
python2-certbot-dns-google.noarch : Google Cloud DNS Authenticator plugin for Certbot
python2-certbot-dns-linode.noarch : Linode DNS Authenticator plugin for Certbot
python2-certbot-dns-luadns.noarch : LuaDNS Authenticator plugin for Certbot
python2-certbot-dns-nsone.noarch : NS1 DNS Authenticator plugin for Certbot
python2-certbot-dns-ovh.noarch : OVH DNS Authenticator plugin for Certbot
python2-certbot-dns-rfc2136.noarch : RFC 2136 DNS Authenticator plugin for Certbot
python2-certbot-dns-route53.noarch : Route53 DNS Authenticator plugin for Certbot
python2-certbot-dns-sakuracloud.noarch : Sakura Cloud DNS Authenticator plugin for Certbot
python2-certbot-nginx.noarch : The nginx plugin for certbot
certbot.noarch : A free, automated certificate authority client

  Name and summary matches only, use "search all" for everything.

certbotパッケージをインストール

[root@hogehoge ~]# yum -y install certbot
Loaded plugins: fastestmirror, langpacks
Determining fastest mirrors
epel/x86_64/metalink                                                                                          | 9.9 kB  00:00:00
 * base: ftp.iij.ad.jp
 * epel: ftp.iij.ad.jp
 * extras: ftp.iij.ad.jp
 * updates: ftp.iij.ad.jp
base                                                                                                          | 3.6 kB  00:00:00
epel                                                                                                          | 4.7 kB  00:00:00
extras                                                                                                        | 2.9 kB  00:00:00
updates                                                                                                       | 2.9 kB  00:00:00
(1/5): epel/x86_64/group_gz                                                                                   |  96 kB  00:00:00
(2/5): epel/x86_64/updateinfo                                                                                 | 1.1 MB  00:00:00
(3/5): extras/7/x86_64/primary_db                                                                             | 247 kB  00:00:00
(4/5): epel/x86_64/primary_db                                                                                 | 7.0 MB  00:00:01
(5/5): updates/7/x86_64/primary_db                                                                            |  16 MB  00:00:02
Resolving Dependencies
--> Running transaction check
---> Package certbot.noarch 0:1.11.0-2.el7 will be installed
--> Processing Dependency: python2-certbot = 1.11.0-2.el7 for package: certbot-1.11.0-2.el7.noarch
--> Running transaction check
---> Package python2-certbot.noarch 0:1.11.0-2.el7 will be installed
--> Processing Dependency: python-parsedatetime >= 1.3 for package: python2-certbot-1.11.0-2.el7.noarch
--> Processing Dependency: python2-acme >= 1.8.0 for package: python2-certbot-1.11.0-2.el7.noarch
--> Processing Dependency: python2-configargparse >= 0.9.3 for package: python2-certbot-1.11.0-2.el7.noarch
--> Processing Dependency: python2-cryptography >= 1.2.3 for package: python2-certbot-1.11.0-2.el7.noarch
--> Processing Dependency: python2-distro >= 1.0.1 for package: python2-certbot-1.11.0-2.el7.noarch
--> Processing Dependency: python2-josepy >= 1.1.0 for package: python2-certbot-1.11.0-2.el7.noarch
--> Processing Dependency: python-setuptools for package: python2-certbot-1.11.0-2.el7.noarch
--> Processing Dependency: python-zope-component for package: python2-certbot-1.11.0-2.el7.noarch
--> Processing Dependency: python-zope-interface for package: python2-certbot-1.11.0-2.el7.noarch
--> Processing Dependency: python2-mock for package: python2-certbot-1.11.0-2.el7.noarch
--> Processing Dependency: python2-pyrfc3339 for package: python2-certbot-1.11.0-2.el7.noarch
--> Processing Dependency: pytz for package: python2-certbot-1.11.0-2.el7.noarch
--> Running transaction check
---> Package python-setuptools.noarch 0:0.9.8-7.el7 will be installed
--> Processing Dependency: python-backports-ssl_match_hostname for package: python-setuptools-0.9.8-7.el7.noarch
---> Package python-zope-component.noarch 1:4.1.0-5.el7 will be installed
--> Processing Dependency: python-zope-event for package: 1:python-zope-component-4.1.0-5.el7.noarch
---> Package python-zope-interface.x86_64 0:4.0.5-4.el7 will be installed
---> Package python2-acme.noarch 0:1.11.0-1.el7 will be installed
--> Processing Dependency: pyOpenSSL >= 0.13.1 for package: python2-acme-1.11.0-1.el7.noarch
--> Processing Dependency: python2-requests >= 2.6.0 for package: python2-acme-1.11.0-1.el7.noarch
--> Processing Dependency: python-ndg_httpsclient for package: python2-acme-1.11.0-1.el7.noarch
--> Processing Dependency: python-requests-toolbelt for package: python2-acme-1.11.0-1.el7.noarch
--> Processing Dependency: python2-pyasn1 for package: python2-acme-1.11.0-1.el7.noarch
--> Processing Dependency: python2-six for package: python2-acme-1.11.0-1.el7.noarch
---> Package python2-configargparse.noarch 0:0.11.0-2.el7 will be installed
---> Package python2-cryptography.x86_64 0:1.7.2-2.el7 will be installed
--> Processing Dependency: python-idna >= 2.0 for package: python2-cryptography-1.7.2-2.el7.x86_64
--> Processing Dependency: python-cffi >= 1.4.1 for package: python2-cryptography-1.7.2-2.el7.x86_64
--> Processing Dependency: python-ipaddress for package: python2-cryptography-1.7.2-2.el7.x86_64
--> Processing Dependency: python-enum34 for package: python2-cryptography-1.7.2-2.el7.x86_64
---> Package python2-distro.noarch 0:1.5.0-1.el7 will be installed
---> Package python2-josepy.noarch 0:1.3.0-2.el7 will be installed
---> Package python2-mock.noarch 0:1.0.1-10.el7 will be installed
---> Package python2-parsedatetime.noarch 0:2.4-6.el7 will be installed
--> Processing Dependency: python2-future for package: python2-parsedatetime-2.4-6.el7.noarch
---> Package python2-pyrfc3339.noarch 0:1.1-3.el7 will be installed
---> Package pytz.noarch 0:2016.10-2.el7 will be installed
--> Running transaction check
---> Package pyOpenSSL.x86_64 0:0.13.1-4.el7 will be installed
---> Package python-backports-ssl_match_hostname.noarch 0:3.5.0.1-1.el7 will be installed
--> Processing Dependency: python-backports for package: python-backports-ssl_match_hostname-3.5.0.1-1.el7.noarch
---> Package python-cffi.x86_64 0:1.6.0-5.el7 will be installed
--> Processing Dependency: python-pycparser for package: python-cffi-1.6.0-5.el7.x86_64
---> Package python-enum34.noarch 0:1.0.4-1.el7 will be installed
---> Package python-idna.noarch 0:2.4-1.el7 will be installed
---> Package python-ipaddress.noarch 0:1.0.16-2.el7 will be installed
---> Package python-ndg_httpsclient.noarch 0:0.3.2-1.el7 will be installed
---> Package python-requests.noarch 0:2.6.0-10.el7 will be installed
--> Processing Dependency: python-urllib3 >= 1.10.2-1 for package: python-requests-2.6.0-10.el7.noarch
---> Package python-requests-toolbelt.noarch 0:0.8.0-3.el7 will be installed
---> Package python-zope-event.noarch 0:4.0.3-2.el7 will be installed
---> Package python2-future.noarch 0:0.18.2-2.el7 will be installed
---> Package python2-pyasn1.noarch 0:0.1.9-7.el7 will be installed
---> Package python2-six.noarch 0:1.9.0-0.el7 will be installed
--> Running transaction check
---> Package python-backports.x86_64 0:1.0-8.el7 will be installed
---> Package python-pycparser.noarch 0:2.14-1.el7 will be installed
--> Processing Dependency: python-ply for package: python-pycparser-2.14-1.el7.noarch
---> Package python-urllib3.noarch 0:1.10.2-7.el7 will be installed
--> Running transaction check
---> Package python-ply.noarch 0:3.4-11.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

=====================================================================================================================================
 Package                                             Arch                   Version                       Repository            Size
=====================================================================================================================================
Installing:
 certbot                                             noarch                 1.11.0-2.el7                  epel                  47 k
Installing for dependencies:
 pyOpenSSL                                           x86_64                 0.13.1-4.el7                  base                 135 k
 python-backports                                    x86_64                 1.0-8.el7                     base                 5.8 k
 python-backports-ssl_match_hostname                 noarch                 3.5.0.1-1.el7                 base                  13 k
 python-cffi                                         x86_64                 1.6.0-5.el7                   base                 218 k
 python-enum34                                       noarch                 1.0.4-1.el7                   base                  52 k
 python-idna                                         noarch                 2.4-1.el7                     base                  94 k
 python-ipaddress                                    noarch                 1.0.16-2.el7                  base                  34 k
 python-ndg_httpsclient                              noarch                 0.3.2-1.el7                   epel                  43 k
 python-ply                                          noarch                 3.4-11.el7                    base                 123 k
 python-pycparser                                    noarch                 2.14-1.el7                    base                 104 k
 python-requests                                     noarch                 2.6.0-10.el7                  base                  95 k
 python-requests-toolbelt                            noarch                 0.8.0-3.el7                   epel                  78 k
 python-setuptools                                   noarch                 0.9.8-7.el7                   base                 397 k
 python-urllib3                                      noarch                 1.10.2-7.el7                  base                 103 k
 python-zope-component                               noarch                 1:4.1.0-5.el7                 epel                 228 k
 python-zope-event                                   noarch                 4.0.3-2.el7                   epel                  79 k
 python-zope-interface                               x86_64                 4.0.5-4.el7                   base                 138 k
 python2-acme                                        noarch                 1.11.0-1.el7                  epel                  83 k
 python2-certbot                                     noarch                 1.11.0-2.el7                  epel                 386 k
 python2-configargparse                              noarch                 0.11.0-2.el7                  epel                  31 k
 python2-cryptography                                x86_64                 1.7.2-2.el7                   base                 502 k
 python2-distro                                      noarch                 1.5.0-1.el7                   epel                  33 k
 python2-future                                      noarch                 0.18.2-2.el7                  epel                 806 k
 python2-josepy                                      noarch                 1.3.0-2.el7                   epel                  89 k
 python2-mock                                        noarch                 1.0.1-10.el7                  epel                  92 k
 python2-parsedatetime                               noarch                 2.4-6.el7                     epel                  78 k
 python2-pyasn1                                      noarch                 0.1.9-7.el7                   base                 100 k
 python2-pyrfc3339                                   noarch                 1.1-3.el7                     epel                  16 k
 python2-six                                         noarch                 1.9.0-0.el7                   epel                 2.9 k
 pytz                                                noarch                 2016.10-2.el7                 base                  46 k

Transaction Summary
=====================================================================================================================================
Install  1 Package (+30 Dependent packages)

Total download size: 4.1 M
Installed size: 19 M
Downloading packages:
(1/31): python-backports-1.0-8.el7.x86_64.rpm                                                                 | 5.8 kB  00:00:00
(2/31): python-backports-ssl_match_hostname-3.5.0.1-1.el7.noarch.rpm                                          |  13 kB  00:00:00
(3/31): certbot-1.11.0-2.el7.noarch.rpm                                                                       |  47 kB  00:00:00
(4/31): pyOpenSSL-0.13.1-4.el7.x86_64.rpm                                                                     | 135 kB  00:00:00
(5/31): python-enum34-1.0.4-1.el7.noarch.rpm                                                                  |  52 kB  00:00:00
(6/31): python-cffi-1.6.0-5.el7.x86_64.rpm                                                                    | 218 kB  00:00:00
(7/31): python-idna-2.4-1.el7.noarch.rpm                                                                      |  94 kB  00:00:00
(8/31): python-ipaddress-1.0.16-2.el7.noarch.rpm                                                              |  34 kB  00:00:00
(9/31): python-ply-3.4-11.el7.noarch.rpm                                                                      | 123 kB  00:00:00
(10/31): python-pycparser-2.14-1.el7.noarch.rpm                                                               | 104 kB  00:00:00
(11/31): python-requests-2.6.0-10.el7.noarch.rpm                                                              |  95 kB  00:00:00
(12/31): python-ndg_httpsclient-0.3.2-1.el7.noarch.rpm                                                        |  43 kB  00:00:00
(13/31): python-requests-toolbelt-0.8.0-3.el7.noarch.rpm                                                      |  78 kB  00:00:00
(14/31): python-zope-component-4.1.0-5.el7.noarch.rpm                                                         | 228 kB  00:00:00
(15/31): python-urllib3-1.10.2-7.el7.noarch.rpm                                                               | 103 kB  00:00:00
(16/31): python-zope-event-4.0.3-2.el7.noarch.rpm                                                             |  79 kB  00:00:00
(17/31): python-zope-interface-4.0.5-4.el7.x86_64.rpm                                                         | 138 kB  00:00:00
(18/31): python2-acme-1.11.0-1.el7.noarch.rpm                                                                 |  83 kB  00:00:00
(19/31): python-setuptools-0.9.8-7.el7.noarch.rpm                                                             | 397 kB  00:00:00
(20/31): python2-certbot-1.11.0-2.el7.noarch.rpm                                                              | 386 kB  00:00:00
(21/31): python2-configargparse-0.11.0-2.el7.noarch.rpm                                                       |  31 kB  00:00:00
(22/31): python2-distro-1.5.0-1.el7.noarch.rpm                                                                |  33 kB  00:00:00
(23/31): python2-future-0.18.2-2.el7.noarch.rpm                                                               | 806 kB  00:00:00
(24/31): python2-josepy-1.3.0-2.el7.noarch.rpm                                                                |  89 kB  00:00:00
(25/31): python2-cryptography-1.7.2-2.el7.x86_64.rpm                                                          | 502 kB  00:00:00
(26/31): python2-mock-1.0.1-10.el7.noarch.rpm                                                                 |  92 kB  00:00:00
(27/31): python2-parsedatetime-2.4-6.el7.noarch.rpm                                                           |  78 kB  00:00:00
(28/31): python2-pyrfc3339-1.1-3.el7.noarch.rpm                                                               |  16 kB  00:00:00
(29/31): python2-six-1.9.0-0.el7.noarch.rpm                                                                   | 2.9 kB  00:00:00
(30/31): python2-pyasn1-0.1.9-7.el7.noarch.rpm                                                                | 100 kB  00:00:00
(31/31): pytz-2016.10-2.el7.noarch.rpm                                                                        |  46 kB  00:00:00
-------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                3.4 MB/s | 4.1 MB  00:00:01
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : python2-pyasn1-0.1.9-7.el7.noarch                                                                                1/31
  Installing : pyOpenSSL-0.13.1-4.el7.x86_64                                                                                    2/31
  Installing : python-ipaddress-1.0.16-2.el7.noarch                                                                             3/31
  Installing : python2-pyrfc3339-1.1-3.el7.noarch                                                                               4/31
  Installing : python-zope-interface-4.0.5-4.el7.x86_64                                                                         5/31
  Installing : pytz-2016.10-2.el7.noarch                                                                                        6/31
  Installing : python2-six-1.9.0-0.el7.noarch                                                                                   7/31
  Installing : python2-future-0.18.2-2.el7.noarch                                                                               8/31
  Installing : python2-parsedatetime-2.4-6.el7.noarch                                                                           9/31
  Installing : python-zope-event-4.0.3-2.el7.noarch                                                                            10/31
  Installing : 1:python-zope-component-4.1.0-5.el7.noarch                                                                      11/31
  Installing : python2-mock-1.0.1-10.el7.noarch                                                                                12/31
  Installing : python-backports-1.0-8.el7.x86_64                                                                               13/31
  Installing : python-backports-ssl_match_hostname-3.5.0.1-1.el7.noarch                                                        14/31
  Installing : python-setuptools-0.9.8-7.el7.noarch                                                                            15/31
  Installing : python-ndg_httpsclient-0.3.2-1.el7.noarch                                                                       16/31
  Installing : python-urllib3-1.10.2-7.el7.noarch                                                                              17/31
  Installing : python-requests-2.6.0-10.el7.noarch                                                                             18/31
  Installing : python-requests-toolbelt-0.8.0-3.el7.noarch                                                                     19/31
  Installing : python-ply-3.4-11.el7.noarch                                                                                    20/31
  Installing : python-pycparser-2.14-1.el7.noarch                                                                              21/31
  Installing : python-cffi-1.6.0-5.el7.x86_64                                                                                  22/31
  Installing : python2-distro-1.5.0-1.el7.noarch                                                                               23/31
  Installing : python2-configargparse-0.11.0-2.el7.noarch                                                                      24/31
  Installing : python-enum34-1.0.4-1.el7.noarch                                                                                25/31
  Installing : python-idna-2.4-1.el7.noarch                                                                                    26/31
  Installing : python2-cryptography-1.7.2-2.el7.x86_64                                                                         27/31
  Installing : python2-josepy-1.3.0-2.el7.noarch                                                                               28/31
  Installing : python2-acme-1.11.0-1.el7.noarch                                                                                29/31
  Installing : python2-certbot-1.11.0-2.el7.noarch                                                                             30/31
  Installing : certbot-1.11.0-2.el7.noarch                                                                                     31/31
  Verifying  : python-idna-2.4-1.el7.noarch                                                                                     1/31
  Verifying  : python-backports-ssl_match_hostname-3.5.0.1-1.el7.noarch                                                         2/31
  Verifying  : python2-six-1.9.0-0.el7.noarch                                                                                   3/31
  Verifying  : pytz-2016.10-2.el7.noarch                                                                                        4/31
  Verifying  : python-ndg_httpsclient-0.3.2-1.el7.noarch                                                                        5/31
  Verifying  : python-enum34-1.0.4-1.el7.noarch                                                                                 6/31
  Verifying  : 1:python-zope-component-4.1.0-5.el7.noarch                                                                       7/31
  Verifying  : python-setuptools-0.9.8-7.el7.noarch                                                                             8/31
  Verifying  : python-ipaddress-1.0.16-2.el7.noarch                                                                             9/31
  Verifying  : python-requests-toolbelt-0.8.0-3.el7.noarch                                                                     10/31
  Verifying  : python2-configargparse-0.11.0-2.el7.noarch                                                                      11/31
  Verifying  : certbot-1.11.0-2.el7.noarch                                                                                     12/31
  Verifying  : python-zope-interface-4.0.5-4.el7.x86_64                                                                        13/31
  Verifying  : python2-distro-1.5.0-1.el7.noarch                                                                               14/31
  Verifying  : python2-josepy-1.3.0-2.el7.noarch                                                                               15/31
  Verifying  : python-ply-3.4-11.el7.noarch                                                                                    16/31
  Verifying  : python-urllib3-1.10.2-7.el7.noarch                                                                              17/31
  Verifying  : python-backports-1.0-8.el7.x86_64                                                                               18/31
  Verifying  : python2-acme-1.11.0-1.el7.noarch                                                                                19/31
  Verifying  : python2-certbot-1.11.0-2.el7.noarch                                                                             20/31
  Verifying  : pyOpenSSL-0.13.1-4.el7.x86_64                                                                                   21/31
  Verifying  : python-cffi-1.6.0-5.el7.x86_64                                                                                  22/31
  Verifying  : python2-mock-1.0.1-10.el7.noarch                                                                                23/31
  Verifying  : python-pycparser-2.14-1.el7.noarch                                                                              24/31
  Verifying  : python-requests-2.6.0-10.el7.noarch                                                                             25/31
  Verifying  : python-zope-event-4.0.3-2.el7.noarch                                                                            26/31
  Verifying  : python2-pyrfc3339-1.1-3.el7.noarch                                                                              27/31
  Verifying  : python2-pyasn1-0.1.9-7.el7.noarch                                                                               28/31
  Verifying  : python2-future-0.18.2-2.el7.noarch                                                                              29/31
  Verifying  : python2-parsedatetime-2.4-6.el7.noarch                                                                          30/31
  Verifying  : python2-cryptography-1.7.2-2.el7.x86_64                                                                         31/31

Installed:
  certbot.noarch 0:1.11.0-2.el7

Dependency Installed:
  pyOpenSSL.x86_64 0:0.13.1-4.el7                                         python-backports.x86_64 0:1.0-8.el7
  python-backports-ssl_match_hostname.noarch 0:3.5.0.1-1.el7              python-cffi.x86_64 0:1.6.0-5.el7
  python-enum34.noarch 0:1.0.4-1.el7                                      python-idna.noarch 0:2.4-1.el7
  python-ipaddress.noarch 0:1.0.16-2.el7                                  python-ndg_httpsclient.noarch 0:0.3.2-1.el7
  python-ply.noarch 0:3.4-11.el7                                          python-pycparser.noarch 0:2.14-1.el7
  python-requests.noarch 0:2.6.0-10.el7                                   python-requests-toolbelt.noarch 0:0.8.0-3.el7
  python-setuptools.noarch 0:0.9.8-7.el7                                  python-urllib3.noarch 0:1.10.2-7.el7
  python-zope-component.noarch 1:4.1.0-5.el7                              python-zope-event.noarch 0:4.0.3-2.el7
  python-zope-interface.x86_64 0:4.0.5-4.el7                              python2-acme.noarch 0:1.11.0-1.el7
  python2-certbot.noarch 0:1.11.0-2.el7                                   python2-configargparse.noarch 0:0.11.0-2.el7
  python2-cryptography.x86_64 0:1.7.2-2.el7                               python2-distro.noarch 0:1.5.0-1.el7
  python2-future.noarch 0:0.18.2-2.el7                                    python2-josepy.noarch 0:1.3.0-2.el7
  python2-mock.noarch 0:1.0.1-10.el7                                      python2-parsedatetime.noarch 0:2.4-6.el7
  python2-pyasn1.noarch 0:0.1.9-7.el7                                     python2-pyrfc3339.noarch 0:1.1-3.el7
  python2-six.noarch 0:1.9.0-0.el7                                        pytz.noarch 0:2016.10-2.el7

Complete!
[root@hogehoge ~]#

certbotがインストールされていることを確認

[root@hogehoge ~]# yum list installed  | grep certbot
certbot.noarch                           1.11.0-2.el7                   @epel
python2-certbot.noarch                   1.11.0-2.el7                   @epel

certbotがインストールされているパスを確認

[root@hogehoge ~]# which certbot
/bin/certbot

/binのCertbotファイル

[root@hogehoge ~]# ls -la /bin/ | grep certbot
lrwxrwxrwx    1 root root          18 Jun 30 14:14 certbot -> /usr/bin/certbot-2
-rwxr-xr-x    1 root root         305 Oct  8  2021 certbot-2
lrwxrwxrwx    1 root root          16 Jun 30 14:14 letsencrypt -> /usr/bin/certbot

3.3 SSL証明書の作成

証明書作成コマンドを実行

[root@hogehoge ~]# certbot certonly --webroot -w /home/www/www.hogehoge.com/ -d /home/www/www.hogehoge.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): romio_y_jurietta@hotmail.com
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.
Requesting a certificate for /home/www/www.hogehoge.com
An unexpected error occurred:
The server will not issue certificates for the identifier :: Error creating new order :: Cannot issue for "/home/www/www.hogehoge.com": Domain name contains an invalid character
Please see the logfiles in /var/log/letsencrypt for more details.

エラーが出る

Error: urn:ietf:params:acme:error:rejectedIdentifier :: The server will not issue certificates for the identifier :: Error creating n
ew order :: Cannot issue for "/home/www/www.hogehoge.com": Domain name contains an invalid character
2022-06-30 14:17:52,742:ERROR:certbot._internal.log:An unexpected error occurred:
2022-06-30 14:17:52,742:ERROR:certbot._internal.log:The server will not issue certificates for the identifier :: Error creating new o
rder :: Cannot issue for "/home/www/www.hogehoge.com": Domain name contains an invalid character

ドメイン指定の箇所がディレクトリになっていたのでもう一度実施→成功

[root@hogehoge www.hogehoge.com]# certbot certonly --webroot -w /home/www/www.hogehoge.com/ -d www.hogehoge.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Requesting a certificate for www.hogehoge.com
Performing the following challenges:
http-01 challenge for www.hogehoge.com
Using the webroot path /home/www/www.hogehoge.com for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/www.hogehoge.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/www.hogehoge.com/privkey.pem
   Your certificate will expire on 2022-09-28. To obtain a new or
   tweaked version of this certificate in the future, simply run
   certbot again. To non-interactively renew *all* of your
   certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

作成された証明書を確認

[root@hogehoge www.hogehoge.com]# cd /etc/letsencrypt/live/www.hogehoge.com
[root@hogehoge www.hogehoge.com]# ls -la
total 12
drwxr-xr-x 2 root root 4096 Jun 30 16:55 .
drwx------ 3 root root 4096 Jun 30 16:55 ..
lrwxrwxrwx 1 root root   45 Jun 30 16:55 cert.pem -> ../../archive/www.hogehoge.com/cert1.pem
lrwxrwxrwx 1 root root   46 Jun 30 16:55 chain.pem -> ../../archive/www.hogehoge.com/chain1.pem
lrwxrwxrwx 1 root root   50 Jun 30 16:55 fullchain.pem -> 　../../archive/www.hogehoge.com/fullchain1.pem　/nginxで利用
lrwxrwxrwx 1 root root   48 Jun 30 16:55 privkey.pem -> ../../archive/www.hogehoge.com/privkey1.pem　/nginxで利用
-rw-r--r-- 1 root root  692 Jun 30 16:55 README
[root@hogehoge www.hogehoge.com]# more README
This directory contains your keys and certificates.

`privkey.pem`  : the private key for your certificate.
`fullchain.pem`: the certificate file used in most server software.
`chain.pem`    : used for OCSP stapling in Nginx >=1.3.7.
`cert.pem`     : will break many server configurations, and should not be used
                 without reading further documentation (see link below).

WARNING: DO NOT MOVE OR RENAME THESE FILES!
         Certbot expects these files to remain in this location in order
         to function properly!

We recommend not moving these files. For more information, see the Certbot
User Guide at https://certbot.eff.org/docs/using.html#where-are-my-certificates.

4 nginxの設定

4.1 nginxでSSLを設定をするときに必要なdhparam用ファイルの作成

ディレクトリ作成

[root@hogehoge nginx]# mkdir /etc/nginx/ssl
[root@hogehoge nginx]# ls
conf.d     fastcgi.conf          fastcgi_params          koi-utf  mime.types          nginx.conf          nginx.conf.org  scgi_params.default  sites-enabled  uwsgi_params          win-utf
default.d  fastcgi.conf.default  fastcgi_params.default  koi-win  mime.types.default  nginx.conf.default  scgi_params     sites-available      ssl            uwsgi_params.default

opensslコマンドでファイルを作成

[root@hogehoge nginx]# openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
.....................................+...................................................................................................................................................................................+...........................................................+....................+.........................................+.............................................................................................................................................................................................................+................................................................................................................................................................+...........................+....................................................................+.....................................................................................+.....................................................................+........................................................................................................................................................................................................................+.......................................................................................................................................................................................................................................................................+...................................................................................................................................................................................................+.....+......................+.....+..............................................................................................................................................................................................................................................................................................................................................................................................................................+...................................+........................................................................+...........................................................................................................+.....................................................................................................................................................++*++*

4.2 nginxのconfファイル設定

confファイル設定

[root@hogehoge sites-enabled]# pwd
/etc/nginx
[root@hogehoge nginx]# ls -la
total 100
-rw-r--r--   1 root root 2925 Feb 13  2021 nginx.conf
[root@hogehoge nginx]# vi nginx.conf
# Settings for a TLS enabled server.
#
    server {
        listen       443 ssl;
#        listen       [::]:443 ssl http2 default_server;
        server_name  hogehoge.com www.hogehoge.com;
#        root         /usr/share/nginx/html;
#
#        ssl_certificate "/etc/pki/nginx/server.crt";
#        ssl_certificate_key "/etc/pki/nginx/server.key";
        ssl_certificate /etc/letsencrypt/live/www.hogehoge.com/fullchain.pem;  /サーバ証明書を指定
        ssl_certificate_key /etc/letsencrypt/live/www.hogehoge.com/privkey.pem;  /keyを指定
        ssl_session_cache shared:SSL:50m;
        ssl_session_timeout  1d;
        ssl_session_tickets on;
        ssl_dhparam /etc/nginx/ssl/dhparam.pem;   /dhparamファイルを指定
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
#
#        # Load configuration files for the default server block.
#        include /etc/nginx/default.d/*.conf;
#
location = /vmess/  {
            proxy_redirect off;
            proxy_pass http://127.0.0.1:16823;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $http_host;
        }
#        location / {
#        }
#
#        error_page 404 /404.html;
#        location = /404.html {
#        }
#
#        error_page 500 502 503 504 /50x.html;
#        location = /50x.html {
#        }
    }

}

nginxの事前状態確認

[root@hogehoge nginx]# systemctl status nginx.service
● nginx.service - The nginx HTTP and reverse proxy server
   Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2021-03-22 17:25:28 CST; 1 years 3 months ago
 Main PID: 18626 (nginx)
   CGroup: /system.slice/nginx.service
           tq18626 nginx: master process /usr/sbin/nginx
           mq18627 nginx: worker process

Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.

nginxの再起動

[root@hogehoge nginx]# systemctl restart nginx.service

nginxの事後状態確認

[root@hogehoge nginx]# systemctl status nginx.service
● nginx.service - The nginx HTTP and reverse proxy server
   Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2022-06-30 17:36:50 CST; 3s ago
  Process: 4828 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCESS)
  Process: 4826 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
  Process: 4825 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited, status=0/SUCCESS)
 Main PID: 4831 (nginx)
   CGroup: /system.slice/nginx.service
           tq4831 nginx: master process /usr/sbin/nginx
           mq4832 nginx: worker process

Jun 30 17:36:50 hogehoge systemd[1]: Starting The nginx HTTP and reverse proxy server...
Jun 30 17:36:50 hogehoge nginx[4826]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
Jun 30 17:36:50 hogehoge nginx[4826]: nginx: configuration file /etc/nginx/nginx.conf test is successful
Jun 30 17:36:50 hogehoge systemd[1]: Failed to parse PID from file /run/nginx.pid: Invalid argument
Jun 30 17:36:50 hogehoge systemd[1]: Started The nginx HTTP and reverse proxy server.

リッスンポートの確認

[root@hogehoge nginx]# netstat -antp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      4831/nginx: master
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      799/sshd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1036/master
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      4831/nginx: master
tcp        0      0 133.125.50.166:22       119.252.143.6:42784     ESTABLISHED 4913/sshd: [accepte
tcp        0      0 133.125.50.166:22       103.85.179.82:62800     ESTABLISHED 32390/sshd: hiroshi
tcp        0      0 133.125.50.166:22       43.226.239.162:47380    ESTABLISHED 32456/sshd: hiroshi
tcp        0     36 133.125.50.166:22       103.85.179.82:55504     ESTABLISHED 1732/sshd: hoge
tcp6       0      0 :::80                   :::*                    LISTEN      4831/nginx: master
tcp6       0      0 :::16823                :::*                    LISTEN      5126/v2ray

5.SSL証明書の自動更新設定

Let's Encryptは有効期限が90日間と決まっています。90日が過ぎると有効期限が切れてサーバー証明書が無効である警告がブラウザに表示されてしまいます。これでは意味がないので、自動で有効期限を更新する設定を追加します。

5.1 証明書が更新可能な状態になっているかを確認

確認コマンド

[root@hogehoge nginx]# certbot renew --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/www.hogehoge.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not due for renewal, but simulating renewal for dry run
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-staging-v02.api.letsencrypt.org
Account registered.
Simulating renewal of an existing certificate for www.hogehoge.com
Performing the following challenges:
http-01 challenge for www.hogehoge.com
Using the webroot path /home/www/www.hogehoge.com for all unmatched domains.
Waiting for verification...
Cleaning up challenges

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/www.hogehoge.com/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all simulated renewals succeeded:
  /etc/letsencrypt/live/www.hogehoge.com/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

5.2 crontabで自動更新設定

毎日1:00と3:00に更新コマンドを実行する場合の記載です。（2回実行するように記載しているのは、1回目が失敗した場合のため）
※”--deploy-hook”オプションはサーバー証明書の更新が行われた場合のみ実行するコマンド

crontab設定

[root@hogehoge nginx]# crontab -e
00 1 * * * certbot renew -q --deploy-hook "systemctl restart nginx"
00 3 * * * certbot renew -q --deploy-hook "systemctl restart nginx"

crontab設定確認

[root@hogehoge nginx]# crontab -l
00 1 * * * certbot renew -q --deploy-hook "systemctl restart nginx"
00 3 * * * certbot renew -q --deploy-hook "systemctl restart nginx"

cron動作ログ確認

[root@hogehoge log]# pwd
/var/log
[root@hogehoge log]# more cron
Jul  3 05:27:01 hogehoge run-parts(/etc/cron.daily)[12278]: finished man-db.cron
Jul  3 05:27:01 hogehoge run-parts(/etc/cron.daily)[12254]: starting mlocate
Jul  3 05:27:02 hogehoge run-parts(/etc/cron.daily)[12289]: finished mlocate
Jul  3 05:27:02 hogehoge anacron[2160]: Job `cron.daily' terminated
Jul  3 05:30:01 hogehoge CROND[12454]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Jul  3 05:40:01 hogehoge CROND[13005]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Jul  3 05:47:01 hogehoge anacron[2160]: Job `cron.weekly' started
Jul  3 05:47:01 hogehoge anacron[2160]: Job `cron.weekly' terminated
Jul  3 05:47:01 hogehoge anacron[2160]: Normal exit (2 jobs run)
Jul  3 05:50:01 hogehoge CROND[13568]: (root) CMD (/usr/lib64/sa/sa1 1 1)