Kepiye cara nglamar Ayo Encrypt? Ayo Enkripsi Prinsip Sertifikat Gratis SSL & Tutorial Instalasi

Kepiye cara nglamar Let's Encrypt?

Ayo Enkripsi Prinsip Sertifikat SSL & Tutorial Instalasi

Apa SSL?Chen WeiliangIng artikel sadurunge "Apa prabédan antarane http vs https? Panjelasan rinci babagan proses enkripsi SSL” kasebut ing.

loro sakaE-commerceSitus web kasebut kudu tuku sertifikat SSL sing dienkripsi lan nggunakake situs web kasebut minangka WeChatPromosi akun umumsakamedia anyarWong, yen sampeyan pengin nginstal sertifikat SSL, sampeyan bisa nginstal sertifikat SSL sing dienkripsi kanthi gratis.SEOIku mbiyantu lan bisa nambah peringkat tembung kunci situs web ing mesin telusur.

Ayo Encrypt dhewe wis nulis sakumpulan pangolahan (https://certbot.eff.org/), nggunakakeLinuxkanca, sampeyan bisa tindakake tutorial iki nalika referring kanggo proses.

Ngundhuh alat certbot-auto dhisik, banjur jalanake dependensi instalasi alat kasebut.

wget https://dl.eff.org/certbot-auto --no-check-certificate
chmod +x ./certbot-auto
./certbot-auto -n

Nggawe sertifikat SSL

Sabanjure, karoChen WeiliangNjupuk jeneng domain blog minangka conto, mangga ngowahi miturut kabutuhan sampeyan dhewe. SSH nganggo printah ing ngisor iki.

Priksa manawa kanggo ngowahi printah ing:

1. Kothak layang
2. path server
3. jeneng domain situs web

Direktori tunggal domain tunggal, ngasilake sertifikat:

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com

Direktori tunggal multi-domain, ngasilake sertifikat: (yaiku, pirang-pirang jeneng domain, direktori siji, gunakake sertifikat sing padha)

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com -d img.chenweiliang.com

Sertifikat SSL sing digawe bakal disimpen ing:/etc/letsencrypt/live/www.chenweiliang.com/ Ing ngisor isi.

Multiple jeneng domain lan macem-macem direktori, ngasilake sertifikat: (yaiku, macem-macem jeneng domain, macem-macem direktori, nggunakake sertifikat sing padha)

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com -d img.chenweiliang.com -w /home/eloha/public_html/site/etufo.org -d www.etufo.org -d img.etufo.org

Sawise sertifikat Ayo Encrypt kasil diinstal, pesen pituduh ing ngisor iki bakal katon ing SSH:

Cathetan IMPORTANT:
– Sugeng! Sertifikat lan chain wis disimpen ing:
/etc/letsencrypt/live/www.chenweiliang.com/fullchain.pem
File kunci sampeyan wis disimpen ing:
/etc/letsencrypt/live/www.chenweiliang.com/privkey.pem
Sertifikasi sampeyan bakal kadaluwarsa ing 2018-02-26. Kanggo entuk sing anyar utawa tweaked
versi sertifikat iki ing mangsa ngarep, mung mbukak certbot-auto
maneh. Kanggo non-interaktif gawe anyar * kabeh * sertifikat, mbukak
"certbot-auto renew"
- Yen seneng karo Certbot, coba dukung karya kanthi:
Sumbangan menyang ISRG / Ayo Encrypt: https://letsencrypt.org/donate
Nyumbang kanggo EFF: https://eff.org/donate-le

Pembaruan Sertifikat SSL

Nganyari sertifikat uga trep banget, nggunakakecrontabNganyari otomatis.Sawetara Debian ora nginstal crontab, sampeyan bisa nginstal kanthi manual dhisik.

apt-get install cron

Printah ing ngisor iki ana ing nginx lan apache / lsp / crontab Printah sing dilebokake ing file kasebut tegese nganyari saben 10 dina, lan wektu validitas 90 dina cukup.

Nginx crontab file, tambahake:

0 3 */10 * * /root/certbot-auto renew --renew-hook "/etc/init.d/nginx reload"

File crontab Apache, tambahake:

0 3 */10 * * /root/certbot-auto renew --renew-hook "service httpd restart"

Konfigurasi Apache sertifikat SSL

Saiki, kita kudu ngowahi konfigurasi Apache.

Tips:

• yen sampeyan nggunakakePanel Kontrol CWP, ing Tambah jeneng domain mriksa Nggawe sertifikat SSL kanthi otomatis, bakal kanthi otomatis ngatur sertifikat SSL kanggo Apache.
• Yen sampeyan nindakake luwih saka langkah-langkah ing ngisor iki, kesalahan bisa kedadeyan sawise miwiti maneh Apache.
• Yen ana kesalahan, busak konfigurasi sing ditambahake kanthi manual.

Sunting file httpd.conf ▼

/usr/local/apache/conf/httpd.conf

Golek ▼

Listen 443

• (mbusak nomer komentar sadurunge #)

utawa tambahake port ngrungokake 443 ▼

Listen 443

SSH mriksa port ngrungokake Apache ▼

grep ^Listen /usr/local/apache/conf/httpd.conf

Golek ▼

mod_ssl

• (mbusak nomer komentar sadurunge #)

utawa nambah ▼

LoadModule ssl_module modules/mod_ssl.so

Golek ▼

httpd-ssl

• (mbusak nomer komentar sadurunge #)

Banjur, SSH nglakokake printah ing ngisor iki (cathetan kanggo ngganti path menyang sampeyan dhewe):

at >/usr/local/apache/conf/extra/httpd-ssl.conf<<EOF
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProxyCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLHonorCipherOrder on
SSLProtocol all -SSLv2 -SSLv3
SSLProxyProtocol all -SSLv2 -SSLv3
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:/usr/local/apache/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
SSLMutex "file:/usr/local/apache/logs/ssl_mutex"
EOF

Sabanjure, ing pungkasan konfigurasi Apache kanggo situs web sing digaweing ngisor.

Tambah file konfigurasi saka bagean SSL (cathetan kanggo mbusak komentar, lan ngganti path kanggo sampeyan dhewe):

<VirtualHost *:443>
DocumentRoot /home/admin/web/chenweiliang.com/public_html //网站目录
ServerName www.chenweiliang.com:443 //域名
ServerAdmin [email protected] //邮箱
ErrorLog "/var/log/www.chenweiliang.com-error_log" //错误日志
CustomLog "/var/log/www.chenweiliang.com-access_log" common //访问日志
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/www.chenweiliang.com/fullchain.pem //之前生成的证书
SSLCertificateKeyFile /etc/letsencrypt/live/www.chenweiliang.com/privkey.pem //之前生成的密钥
<Directory "/home/admin/web/chenweiliang.com/public_html"> //网站目录
SetOutputFilter DEFLATE
Options FollowSymLinks
AllowOverride All
suPHP_UserGroup eloha eloha //用户组（有些服务器配置需要，有些可能不需要，出错请删除此行）
Order allow,deny
Allow from all
DirectoryIndex index.html index.phps
</Directory>
</VirtualHost>

Pungkasan, miwiti maneh Apache:

service httpd restart

Apache meksa HTTP pangalihan menyang HTTPS

• Akeh panjalukan web mung bisa mlaku nganggo SSL.
• Kita kudu nggawe manawa saben nggunakake SSL, situs web kudu diakses liwat SSL.
• Yen pangguna nyoba ngakses situs web kanthi URL non-SSL, dheweke kudu dialihake menyang situs web SSL.
• Pangalihan menyang URL SSL nggunakake modul Apache mod_rewrite.
• Kayata nggunakake paket instalasi LAMP siji-klik, instalasi otomatis sertifikat SSL lan pangalihan paksa menyang HTTPS, pangalihan menyang HTTPSIng pasukan, sampeyan ora perlu nambah pangalihan HTTPS.

Tambah aturan pangalihan

• Ing file konfigurasi Apache, owahi host virtual situs web lan tambahake setelan ing ngisor iki.
• Sampeyan uga bisa nambah setelan sing padha menyang root dokumen ing situs web sampeyan ing file .htaccess.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Yen sampeyan mung pengin nemtokake URL tartamtu kanggo pangalihan menyang HTTPS:

RewriteEngine On
RewriteRule ^message$ https://www.etufo.org/message [R=301,L]

• Yen wong nyoba ngakses pesen , kaca bakal mlumpat menyang https, lan pangguna mung bisa ngakses URL nganggo SSL.

Wiwiti maneh Apache supaya file .htaccess ditrapake:

service httpd restart

Pancegahan

• Ganti alamat email ing ndhuwur dadi alamat email sampeyan.
• Elinga ngganti jeneng domain situs web ing ndhuwur dadi jeneng domain situs web sampeyan.

Masalah lokasi aturan pangalihan

Ing aturan pseudo-statis, nalika nempatake aturan lompat pangalihan, sampeyan biasane nemoni http ora bisa pangalihan menyang https Masalahe.

Kaping pisanan kita nyalin kode pangalihan menyang .htaccess lan bakal katon ing kasus ing ngisor iki ▼

• [L] nuduhake yen aturan saiki minangka aturan pungkasan, mungkasi nganalisa aturan nulis ulang ing ngisor iki.
• Dadi nalika ngakses kaca artikel sing dialihake, [L] mungkasi aturan ing ngisor iki, supaya aturan pangalihan ora bisa digunakake.

Nalika ngunjungi homepage http, kita pengin micu pangalihan URL, skip aturan pseudo-statis kanggo nglakokake aturan lompat pangalihan, supaya bisa digayuhSitus-wide http pangalihan menyang https .

Aja sijine aturan pangalihan https [L] Ing ngisor aturan, sijine [L] ndhuwur aturan ▼

Wacan lengkap:

• Apa prabédan antarane http vs https? Panjelasan rinci babagan proses enkripsi SSL
• Apa sing kudu ditindakake yen entuk kesalahan 500 sawise nginstal sertifikat SSL Ayo Encrypt ing panel kontrol CWP?
• Langsung menyang jeneng domain tingkat kapindho tanpa jeneng domain tingkat ndhuwur www: jeneng domain root 301 pangalihan www