Yadda ake neman Mu Encrypt? Bari Mu Encrypt SSL Free Certificate Principle & Installation Tutorial

Yadda ake nema don Mu Encrypt?

Bari Mu Rufe Ƙa'idar Takaddun Takaddun SSL & Koyarwar Shigarwa

Menene SSL? Chen Weiliang ya tattauna wannan a cikin labarinsa na baya, " Menene bambanci tsakanin HTTP da HTTPS? Cikakken bayani game da tsarin ɓoye bayanai na SSL ."

Baya ga gidajen yanar gizo na kasuwanci na e-commerce , waɗanda dole ne su sayi takaddun shaidar SSL na zamani da aka ɓoye, sabbin ƙwararrun kafofin watsa labarai waɗanda ke amfani da gidajen yanar gizo don tallata asusun hukuma na WeChat za su iya shigar da takaddun shaidar SSL kyauta da aka ɓoye. Wannan zai iya taimakawa tare da SEO da inganta matsayin kalmomin shiga na gidan yanar gizon a cikin injunan bincike.

Bari Mu Yi Encrypt yana da nasa tsarin aiki ( https://certbot.eff.org/ ). Masu amfani da Linux za su iya komawa ga wannan tsarin aiki kuma su bi wannan koyaswar.

Zazzage kayan aikin certbot-auto da farko, sannan gudanar da abubuwan dogaro da kayan aikin.

wget https://dl.eff.org/certbot-auto --no-check-certificate
chmod +x ./certbot-auto
./certbot-auto -n

Samar da takardar shaidar SSL

Na gaba, idan ka ɗauki sunan shafin yanar gizo na Chen Weiliang a matsayin misali, da fatan za a gyara shi bisa ga buƙatunka kuma ka gudanar da umarni mai zuwa ta hanyar SSH.

Tabbatar canza umarnin a:

1. Akwatin gidan waya
2. hanyar uwar garken
3. sunan yankin gidan yanar gizon

Jagora guda ɗaya na yanki ɗaya, samar da takaddun shaida:

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com

Littafin shugabanci guda daya-daya, yana samar da takaddun shaida: (watau sunayen yanki da yawa, kundin adireshi ɗaya, yi amfani da takaddun shaida iri ɗaya)

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com -d img.chenweiliang.com

Za a adana takardar shaidar SSL a cikin:/etc/letsencrypt/live/www.chenweiliang.com/ Ƙarƙashin abun ciki.

Sunayen yanki da yawa da kundayen adireshi, suna samar da takaddun shaida: (wato, sunayen yanki da yawa, kundayen adireshi da yawa, yi amfani da takaddun shaida iri ɗaya)

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com -d img.chenweiliang.com -w /home/eloha/public_html/site/etufo.org -d www.etufo.org -d img.etufo.org

Bayan an shigar da takardar shaidar Mu Encrypt ɗin cikin nasara, saƙon gaggawa mai zuwa zai bayyana a cikin SSH:

KARANTA SANTA:
– Taya murna!Takardar ku da chain an ajiye su a:
/etc/letsencrypt/live/www.chenweiliang.com/fullchain.pem
An adana fayil ɗin maɓallin ku a:
/etc/letsencrypt/live/www.chenweiliang.com/privkey.pem
Takardar ku za ta ƙare ranar 2018-02-26. Don samun sabon ko tweaked
sigar wannan takardar shaidar nan gaba, kawai gudanar da certbot-auto
Don sabunta *duk* takaddun takaddun ku ba tare da haɗin gwiwa ba, gudu
"certbot-auto sabuntawa"
- Idan kana son Certbot, don Allah a yi la'akari da goyon bayan aikinmu ta hanyar:
Ba da gudummawa ga ISRG / Bari Mu Yi Encrypt: https://letsencrypt.org/donate
Gudummawa ga EFF: https://eff.org/donate-le

Sabunta Certificate SSL

Sabunta takardar shaida kuma yana da matukar dacewa, amfani da crontab don sabuntawa ta atomatik. Ga wasu nau'ikan Debian waɗanda ba su da crontab da aka shigar, za ku iya shigar da shi da hannu da farko.

apt-get install cron

Ana shigar da waɗannan umarni don nginx da apache a cikin fayil ɗin /etc/crontab , ma'ana ana sabunta su duk bayan kwana 10, kuma lokacin inganci na kwanaki 90 ya isa.

Nginx crontab fayil, da fatan za a ƙara:

0 3 */10 * * /root/certbot-auto renew --renew-hook "/etc/init.d/nginx reload"

Apache crontab fayil, da fatan za a ƙara:

0 3 */10 * * /root/certbot-auto renew --renew-hook "service httpd restart"

Takaddun shaida SSL Tsarin Apache

Yanzu, muna buƙatar yin canje-canje ga tsarin Apache.

Tukwici:

• idan kuna amfaniCibiyar Kula da CWP, a cikin Ƙara sunan yankin rajista ta atomatik samar da takardar shaidar SSL, za ta daidaita takardar shaidar SSL ta Apache ta atomatik.
• Idan kun yi ƙarin matakai masu zuwa, kuskure na iya faruwa bayan sake kunna Apache.
• Idan akwai kuskure, share tsarin da kuka ƙara da hannu.

Shirya fayil ɗin httpd.conf ▼

/usr/local/apache/conf/httpd.conf

Nemo ▼

Listen 443

• (cire lambar sharhin da ta gabata #)

ko ƙara tashar tashar sauraro 443 ▼

Listen 443

SSH duba tashar sauraron Apache ▼

grep ^Listen /usr/local/apache/conf/httpd.conf

Nemo ▼

mod_ssl

• (cire lambar sharhin da ta gabata #)

ko ƙara ▼

LoadModule ssl_module modules/mod_ssl.so

Nemo ▼

httpd-ssl

• (cire lambar sharhin da ta gabata #)

Sannan, SSH aiwatar da umarni mai zuwa (bayanin kula don canza hanyar zuwa naku):

at >/usr/local/apache/conf/extra/httpd-ssl.conf<<EOF
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProxyCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLHonorCipherOrder on
SSLProtocol all -SSLv2 -SSLv3
SSLProxyProtocol all -SSLv2 -SSLv3
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:/usr/local/apache/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
SSLMutex "file:/usr/local/apache/logs/ssl_mutex"
EOF

Na gaba, a ƙarshen tsarin Apache don gidan yanar gizon da kuka ƙirƙira, a ƙarƙashin </VirtualHost>.

Ƙara fayil ɗin sanyi na sashin SSL (bayanin kula don cire sharhi, kuma canza hanyar zuwa naku):

<VirtualHost *:443>
DocumentRoot /home/admin/web/chenweiliang.com/public_html //网站目录
ServerName www.chenweiliang.com:443 //域名
ServerAdmin [email protected] //邮箱
ErrorLog "/var/log/www.chenweiliang.com-error_log" //错误日志
CustomLog "/var/log/www.chenweiliang.com-access_log" common //访问日志
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/www.chenweiliang.com/fullchain.pem //之前生成的证书
SSLCertificateKeyFile /etc/letsencrypt/live/www.chenweiliang.com/privkey.pem //之前生成的密钥
<Directory "/home/admin/web/chenweiliang.com/public_html"> //网站目录
SetOutputFilter DEFLATE
Options FollowSymLinks
AllowOverride All
suPHP_UserGroup eloha eloha //用户组（有些服务器配置需要，有些可能不需要，出错请删除此行）
Order allow,deny
Allow from all
DirectoryIndex index.html index.phps
</Directory>
</VirtualHost>

A ƙarshe zata sake farawa Apache akansa:

service httpd restart

Apache tilasta HTTP turawa zuwa HTTPS

• Yawancin buƙatun yanar gizo koyaushe suna iya gudana tare da SSL kawai.
• Muna buƙatar tabbatar da cewa duk lokacin da muke amfani da SSL, dole ne a shiga gidan yanar gizon ta SSL.
• Idan kowane mai amfani yayi ƙoƙarin shiga gidan yanar gizon tare da URL maras SSL, dole ne a tura shi zuwa gidan yanar gizon SSL.
• Komawa zuwa SSL URL ta amfani da Apache mod_rewrite module.
• Idan kun yi amfani da kunshin shigarwa na dannawa ɗaya LAMP, ginanniyar shigarwa ta atomatik ta takardar shaidar SSL da turawa ta tilastawa zuwa HTTPS, turawa zuwa HTTPS.A cikin karfi, ba kwa buƙatar ƙara tura HTTPS.

Ƙara dokar turawa

• A cikin fayil ɗin sanyi na Apache, gyara mahaɗin gidan yanar gizon kuma ƙara saitunan masu zuwa.
• Hakanan zaka iya ƙara saitunan iri ɗaya zuwa tushen daftarin aiki akan gidan yanar gizon ku a cikin fayil ɗin .htaccess.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Idan kawai kuna son saka takamaiman URL don turawa zuwa HTTPS:

RewriteEngine On
RewriteRule ^message$ https://www.etufo.org/message [R=301,L]

• Idan wani yayi ƙoƙarin shiga saƙon , shafin zai yi tsalle zuwa https, kuma mai amfani zai iya samun damar URL kawai tare da SSL.

Sake kunna Apache don fayil ɗin .htaccess don aiwatarwa:

service httpd restart

Kariya

• Da fatan za a canza adireshin imel na sama zuwa adireshin imel ɗin ku.
• Da fatan za a tuna don canza sunan yankin gidan yanar gizon da ke sama zuwa sunan yankin gidan yanar gizon ku.

Ƙaddamar da ƙa'idar wuri matsala

Lokacin da kake sanya ƙa'idodin turawa a ƙarƙashin ƙa'idodin karya-tsaye, sau da yawa za ka gamu da matsalar cewa HTTP ba zai iya tura dukkan shafin zuwa HTTPS ba.

Da farko mun kwafi lambar turawa zuwa .htaccess kuma zai bayyana a cikin waɗannan lokuta ▼

• [L] yana nuna cewa ƙa'idar yanzu ita ce ka'ida ta ƙarshe, dakatar da nazarin waɗannan ƙa'idodin sake rubutawa.
• Don haka lokacin shiga shafin labarin da aka tura, [L] yana dakatar da waɗannan dokoki, don haka ƙa'idodin turawa ba sa aiki.

Lokacin da muke shiga shafin farko na HTTP, muna son mu haifar da hanyar tura URL, ta hanyar kaucewa dokokin sake rubuta URL don aiwatar da dokokin sake tura, ta yadda za a iya mayar da dukkan shafin daga HTTP zuwa HTTPS.

Kada a sanya dokokin tura HTTPS a ƙasa da dokokin [L] ; a sanya su sama da dokokin [L] . ▼

Karin karatu:

• Menene bambanci tsakanin http vs https? Cikakken bayani na tsarin ɓoye SSL
• Me zan yi idan na sami kuskure 500 bayan shigar da Mu Encrypt SSL takardar shaidar a cikin CWP iko panel?
• Tsalle ta atomatik zuwa sunan yanki na mataki na biyu ba tare da sunan yankin babban matakin www ba: tushen sunan yankin 301 yana turawa www.