sudo certbot --nginx -d example.com -d www.example.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel):
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for example.com
Waiting for verification...
Challenge failed for domain example.com
http-01 challenge for example.com
Cleaning up challenges
Some challenges have failed.
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: example.com
Type: connection
Detail: 공인아이피: Fetching
http://example.com/.well-known/acme-challenge/f8kAgZFm0jvoMhu3mbtN5F7IS7B7xcXupFP1XN7C-NU:
Timeout during connect (likely firewall problem)
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you're using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
- Your account credentials have been saved in your Certbot
configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Certbot so
making regular backups of this folder is ideal.
저는 집에 있는 컴픀터에 SSL인증 중이라서 ^^ 오류가 나네요 T.T 제가 보안 때문에 몇가지 검사를 위해서 서버에 접속을 했는데 접속이 안된답니다. ^^
그래서 저는 IP타임 공유기의 설정을 변경해서 다시 아래 명령어를 수행 했습니다.
sudo systemctl restart nginx
talkit@ubuntu:~$ sudo certbot --nginx -d example.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for example.com
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/example.com
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled/example.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://example.com
You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=example.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/example.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/example.com/privkey.pem
Your cert will expire on 2023-04-01. To obtain a new or tweaked
version of this certificate in the future, simply run certbot again
with the "certonly" option. To non-interactively renew *all* of
your certificates, run "certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
위와 같이 성공 했습니다.
오 ^^
오 저 앞에 Not secure가 없어졌습니다. ^^
이번 글은 여기까지 하고, 다음글에서는 Let's Encrypt의 갱신 자동화에 대해서 글을 또하나 적어보고, 또한 도메인 구매와 도메인 설정(DNS)에 관해서 알아보겠습니다.
# Default server configuration
#
server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
}
일단 SSL이라든지 여러가지 설정이 주석으로 정의 되어 있습니다만, 주석부분은 대부분 지워 버리면 실제로 위와 같은 결과만 나옵니다. ^^
default 서버는 80번 포트에서 대기 중이구요. /var/www/html 폴더에 html 파일이 있습니다.
그리고 시작 파일은 index.html, index.htm, index.nginx-debian.html 이 시작 파일 입니다.
default를 없애고, example를 만들어 보도록 하겠습니다. 저는 앞으로 여기서 mattermost를 만들어야겠지요 ^^ 아닌가 mattermost는 나중에 ^^
sudo mkdir /var/www/example
example 디렉토리를 웹 홈에 만들구요.
sudo vi /var/www/example/index.html
index.html 파일을 생성 합니다.
리눅스/Linux vi/vim NIX에서 가장 유명한 텍스트 편집기 - 글쓰기. One of the best text editor on NIX fields. - Writing https://talkit.tistory.com/699
위 글을 보시면 vi로 글쓰는 방법이 나와 있습니다. ^^
<html>
<body>
NGINX 테스트 웹페이지에 오신 것을 환영합니다.
<body>
</html>
위 코드를 index.html에 붙여 넣으십시오. 저장하고 나오시면 됩니다.
:wq 안 잃어버리셨죠 ^^
sudo vi /etc/nginx/sites-available/example.com
example.com 블락을 만들기위해서 파일을 하나 만들겠습니다.
server {
listen 80;
root /var/www/example;
index index.html;
server_name 127.0.0.1;
}
sudo systemctl status nginx
● nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2023-01-01 00:30:21 PST; 10s ago
Docs: man:nginx(8)
Process: 3211 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
Process: 3212 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
Main PID: 3213 (nginx)
Tasks: 17 (limit: 19071)
Memory: 13.6M
CGroup: /system.slice/nginx.service
├─3213 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
├─3214 nginx: worker process
├─3215 nginx: worker process
├─3216 nginx: worker process
├─3217 nginx: worker process
├─3218 nginx: worker process
├─3219 nginx: worker process
├─3220 nginx: worker process
├─3221 nginx: worker process
├─3222 nginx: worker process
├─3223 nginx: worker process
├─3224 nginx: worker process
├─3225 nginx: worker process
├─3226 nginx: worker process
├─3227 nginx: worker process
├─3228 nginx: worker process
└─3229 nginx: worker process
Jan 01 00:30:21 ubuntu systemd[1]: Starting A high performance web server and a reverse proxy server...
Jan 01 00:30:21 ubuntu systemd[1]: Started A high performance web server and a reverse proxy server.
재시작 했으면 상태도 한번 확인해주시고 ^^
브라우져에서 확인을 하면
저같은 경우는 위와 같이 나옵니다. ^^
잘 만들어서 잘 구동이 되고 있네요 ^^
오늘은 여기까지 하겠습니다. 제 목표는 저기 Not secure 없애는 거여서 다음글 또는 그 다음 글에서 아마 가능 할 것으로 생각 됩니다. ^^
