Otu esi etinye akwụkwọ maka Let's Encrypt? Ka anyị ezobe ụkpụrụ Asambodo efu na nkuzi nwụnye SSL

Otu esi etinye akwụkwọ maka Let's Encrypt?

Ka anyị zoo ụkpụrụ Asambodo SSL na nkuzi nwụnye

Gịnị bụ SSL? Chen Weiliang kọwara nke a n'isiokwu ya gara aga, " Gịnị bụ ihe dị iche n'etiti HTTP na HTTPS? Nkọwa zuru ezu nke usoro nzuzo SSL ."

E wezụga weebụsaịtị e-commerce , nke ga-azụrịrị asambodo SSL ezoro ezo dị elu, ndị ọkachamara mgbasa ozi ọhụrụ ndị na-eji weebụsaịtị iji kwalite akaụntụ gọọmentị WeChat ha nwere ike itinye asambodo SSL ezoro ezo n'efu. Nke a nwere ike inyere aka na SEO ma melite ọkwa okwu dị na weebụsaịtị ahụ na injin ọchụchọ.

Ka anyị Encrypt nwee usoro ọrụ nke ya ( https://certbot.eff.org/ ). Ndị ọrụ Linux nwere ike ileba anya na usoro ọrụ ahụ ma soro nkuzi a.

Buru ụzọ budata ngwa certbot-auto, wee megharịa akụrụngwa dabere na nrụnye nke ngwaọrụ.

wget https://dl.eff.org/certbot-auto --no-check-certificate
chmod +x ./certbot-auto
./certbot-auto -n

Mepụta asambodo SSL

Na-esote, were aha ngalaba blọgụ Chen Weiliang dịka ihe atụ, biko gbanwee ya dịka mkpa gị si dị wee gbaa iwu a site na SSH.

Biko hụ na ị gbanwee iwu a:

1. Akwụkwọ ozi
2. Ụzọ nkesa
3. aha ngalaba weebụsaịtị

Otu akwụkwọ ndekọ aha ngalaba, mepụta asambodo:

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com

Akwụkwọ ndekọ aha ọtụtụ ngalaba, mepụta asambodo: (ya bụ ọtụtụ aha ngalaba, otu akwụkwọ ndekọ aha, jiri otu asambodo)

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com -d img.chenweiliang.com

A ga-echekwa asambodo SSL emepụtara na:/etc/letsencrypt/live/www.chenweiliang.com/ N'okpuru ọdịnaya.

Otutu ngalaba aha na otutu akwụkwọ ndekọ aha, mepụta asambodo: (ya bụ, otutu ngalaba aha, otutu akwụkwọ ndekọ aha, jiri otu akwụkwọ)

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com -d img.chenweiliang.com -w /home/eloha/public_html/site/etufo.org -d www.etufo.org -d img.etufo.org

Mgbe ị wụnyechara akwụkwọ ikike ka anyị Encrypt nke ọma, ozi ngwa ngwa SSH ga-apụta:

MARA EGO:
– Ekele! Asambodo gị na chain echekwabara na:
/etc/letsencrypt/live/www.chenweiliang.com/fullchain.pem
Edokwala faịlụ igodo gị na:
/etc/letsencrypt/live/www.chenweiliang.com/privkey.pem
Asambodo gị ga-ekubi ume na 2018-02-26. Iji nweta nke ọhụrụ ma ọ bụ tweaked
Ụdị asambodo a n'ọdịnihu, mee naanị certbot-auto
ọzọ. Iji na-abụghị interactively megharia * niile* nke gị asambodo, ọsọ
"certbot-auto renewing"
- Ọ bụrụ na-amasị Certbot, biko tụlee ịkwado ọrụ anyị site na:
Inye onyinye na ISRG / Ka anyị zoo: https://letsencrypt.org/donate
Inye onyinye nye EFF: https://eff.org/donate-le

SSL akwụkwọ ọhụrụ

Mmelite asambodo dịkwa mma nke ukwuu, site na iji crontab maka imeghari akpaka. Maka ụfọdụ ụdị Debian nke enweghị crontab arụnyere, ị nwere ike itinye ya n'aka gị na mbụ.

apt-get install cron

A na-etinye iwu ndị a maka nginx na apache na faịlụ /etc/crontab , nke pụtara na a na-emegharị ha kwa ụbọchị iri, oge nkwado ụbọchị 90 ezuola.

Nginx crontab faịlụ, biko tinye:

0 3 */10 * * /root/certbot-auto renew --renew-hook "/etc/init.d/nginx reload"

Faịlụ crontab Apache, biko tinye:

0 3 */10 * * /root/certbot-auto renew --renew-hook "service httpd restart"

Nhazi Apache Asambodo SSL

Ugbu a, anyị kwesịrị ịgbanwe nhazi Apache.

Ndụmọdụ:

• Ọ bụrụ na ị na-ejiOgwe njikwa CWP, lelee na-emepụta akwụkwọ SSL na-akpaghị aka mgbe ị na-agbakwụnye aha ngalaba, a ga-ahazi Apache akwụkwọ SSL na-akpaghị aka.
• Ọ bụrụ na ịmee ọtụtụ usoro ndị a, njehie nwere ike ime ka ịmalitegharịa Apache.
• Ọ bụrụ na ihe na-aga nke ọma, hichapụ nhazi nke ị jiri aka tinye.

Dezie faịlụ httpd.conf ▼

/usr/local/apache/conf/httpd.conf

Chọta ▼

Listen 443

• (Wepu nọmba nkọwapụta gara aga #)

Ma ọ bụ tinye ọdụ ụgbọ mmiri 443 ▼

Listen 443

SSH lelee ọdụ ụgbọ mmiri Apache ▼

grep ^Listen /usr/local/apache/conf/httpd.conf

Chọta ▼

mod_ssl

• (Wepu nọmba nkọwapụta gara aga #)

ma ọ bụ tinye ▼

LoadModule ssl_module modules/mod_ssl.so

Chọta ▼

httpd-ssl

• (Wepu nọmba nkọwapụta gara aga #)

Mgbe ahụ, SSH mebie iwu a (rịba ama ka ị gbanwee ụzọ nke gị):

at >/usr/local/apache/conf/extra/httpd-ssl.conf<<EOF
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProxyCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLHonorCipherOrder on
SSLProtocol all -SSLv2 -SSLv3
SSLProxyProtocol all -SSLv2 -SSLv3
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:/usr/local/apache/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
SSLMutex "file:/usr/local/apache/logs/ssl_mutex"
EOF

Na-esote, na njedebe nke nhazi Apache maka weebụsaịtị ị mepụtara, n'okpuru </VirtualHost>.

Tinye faịlụ nhazi SSL (dee ka ewepụ ihe ndị ahụ wee gbanwee ụzọ nke gị):

<VirtualHost *:443>
DocumentRoot /home/admin/web/chenweiliang.com/public_html //网站目录
ServerName www.chenweiliang.com:443 //域名
ServerAdmin [email protected] //邮箱
ErrorLog "/var/log/www.chenweiliang.com-error_log" //错误日志
CustomLog "/var/log/www.chenweiliang.com-access_log" common //访问日志
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/www.chenweiliang.com/fullchain.pem //之前生成的证书
SSLCertificateKeyFile /etc/letsencrypt/live/www.chenweiliang.com/privkey.pem //之前生成的密钥
<Directory "/home/admin/web/chenweiliang.com/public_html"> //网站目录
SetOutputFilter DEFLATE
Options FollowSymLinks
AllowOverride All
suPHP_UserGroup eloha eloha //用户组（有些服务器配置需要，有些可能不需要，出错请删除此行）
Order allow,deny
Allow from all
DirectoryIndex index.html index.phps
</Directory>
</VirtualHost>

N'ikpeazụ, malitegharịa Apache:

service httpd restart

Apache Force HTTP redirect HTTPS

• Ọtụtụ arịrịọ webụ nwere ike na-agba naanị iji SSL.
• Anyị kwesịrị ijide n'aka na oge ọ bụla anyị na-eji SSL, anyị ga-enwerịrị ike ịnweta weebụsaịtị site na SSL.
• Ọ bụrụ na onye ọrụ ọ bụla nwara iji URL na-abụghị SSL wee nweta webụsaịtị, a ga-ebugharị ya na webụsaịtị SSL.
• Jiri modul Apache mod_rewrite ka ibugharịa gaa na URL SSL.
• Ọ bụrụ na ị na-eji LAMP iji wụnye ngwugwu ahụ n'otu ọpịpị, ọ wulitere asambodo SSL na akpaaka yana ntugharị na HTTPS na ntụgharị na HTTPS.Na Mmanye, ọ dịghị mkpa ịgbakwunye HTTPS redirection.

Tinye iwu redirect

• N'ime faịlụ nhazi Apache, dezie onye nnabata webụsaịtị wee tinye ntọala ndị a.
• Ịnwekwara ike ịgbakwunye otu ntọala ahụ na mgbọrọgwụ akwụkwọ dị na weebụsaịtị gị na faịlụ .htaccess.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Ọ bụrụ naanị na ị chọrọ ịkọwa ụfọdụ URL iji bugharịa na HTTPS:

RewriteEngine On
RewriteRule ^message$ https://www.etufo.org/message [R=301,L]

• Ọ bụrụ na mmadụ nwaa ịbanye ozi , ibe ahụ ga-awụlikwa elu na https, ndị ọrụ nwere ike ịnweta URL naanị site na iji SSL.

Malitegharịa Apache iji mee ka faịlụ .htaccess nwee mmetụta:

service httpd restart

Cakpachara anya

• Biko gbanwee adreesị ozi-e dị n'elu ka ọ bụrụ adreesị ozi-e nke gị.
• Biko cheta ịgbanwe n'elu website ngalaba aha gị website ngalaba aha.

Esemokwu iwu redirect

Mgbe ị na-etinye iwu ntụgharị n'okpuru iwu pseudo-static, ị ga-ezutekarị nsogbu na HTTP enweghị ike ibugharị saịtị ahụ dum gaa na HTTPS.

Na mbụ, anyị depụtaghachiri koodu redirect n'ime .htaccess na ọ ga-apụta n'ọnọdụ ndị a ▼

• [L] na-egosi na iwu dị ugbu a bụ iwu ikpeazụ, kwụsị nyocha iwu ndị a na-edegharị.
• Yabụ mgbe ị na-abanye na ibe akụkọ ebugharị, [L] kwụsịrị iwu ndị a, yabụ iwu ntụgharị anaghị arụ ọrụ.

Mgbe anyị na-abanye na ibe mbụ HTTP, anyị chọrọ ịkpalite ntụgharị URL, na-agafe iwu nhazi URL iji mezuo iwu nhazi, ka e wee nwee ike ibugharị saịtị ahụ dum site na HTTP gaa na HTTPS.

Etinyela iwu ntụgharị HTTPS n'okpuru iwu [L] ; tinye ha n'elu iwu [L] . ▼

Ịgbatịkwu oge:

• Kedu ihe dị iche n'etiti http vs https? Nkọwa zuru ezu nke usoro nzuzo SSL
• Kedu ihe m ga - eme ma ọ bụrụ na enwetara m njehie 500 mgbe ị wụnyechara akwụkwọ ikike Ka anyị Encrypt SSL na ogwe njikwa CWP?
• Na-amali elu na ngalaba aha ọkwa nke abụọ na-akpaghị aka na-enweghị aha ngalaba ngalaba nke elu-elu: mgbọrọgwụ ngalaba aha 301 redirects www.