Mokhoa oa ho etsa kopo ea Lets Encrypt

U ka etsa kopo ea Lets Encrypt joang?

Ha re Kenyelle Molao-motheo oa Setifikeiti sa SSL & Thupelo ea ho Kena

SSL ke eng? Chen Weiliang o buile ka sena sehloohong sa hae se fetileng, " Phapang ke efe pakeng tsa HTTP le HTTPS? Tlhaloso e qaqileng ea ts'ebetso ea encryption ea SSL ."

Ntle le diwebsaete tsa kgwebo ya inthanete , tse lokelang ho reka disetifikeiti tsa SSL tse patiloeng tse tswetseng pele, ditsebi tse ntjha tsa boraditaba tse sebedisang diwebsaete ho kgothaletsa diak'haonte tsa tsona tsa semmuso tsa WeChat di ka kenya disetifikeiti tsa SSL tse patiloeng mahala. Sena se ka thusa ka SEO le ho ntlafatsa maemo a mantswe a bohlokwa a webosaete dienjineng tsa ho batla.

Ha re Encrypt e na le mokhoa oa eona oa tšebetso ( https://certbot.eff.org/ ). Basebelisi ba Linux ba ka sheba mokhoa oo oa tšebetso 'me ba latela thupelo ena.

Khoasolla sesebelisoa sa certbot-auto pele, ebe u tsamaisa lipehelo tsa ho kenya sesebelisoa.

wget https://dl.eff.org/certbot-auto --no-check-certificate
chmod +x ./certbot-auto
./certbot-auto -n

Hlahisa setifikeiti sa SSL

Ka mor'a moo, ha u nka lebitso la domain la blog ea Chen Weiliang e le mohlala, ka kopo le fetole ho latela litlhoko tsa hau 'me u tsamaise taelo e latelang ka SSH.

Etsa bonnete ba hore u fetola taelo ho:

1. Lebokose la poso
2. tsela ea seva
3. lebitso la sebaka sa marang-rang

Single domain single directory, hlahisa setifikeiti:

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com

Bukana e le 'ngoe ea li-domain tse ngata, hlahisa setifikeiti: (ke hore, mabitso a mangata a marang-rang, buka e le' ngoe, sebelisa setifikeiti se le seng)

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com -d img.chenweiliang.com

Setifikeiti sa SSL se hlahisitsoeng se tla bolokoa ho:/etc/letsencrypt/live/www.chenweiliang.com/ Tlas'a litaba.

Mabitso a mangata a marang-rang le li-directory tse ngata, hlahisa setifikeiti: (ke hore, mabitso a mangata a marang-rang, li-directory tse ngata, sebelisa setifikeiti se le seng)

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /home/admin/web/chenweiliang.com/public_html -d www.chenweiliang.com -d img.chenweiliang.com -w /home/eloha/public_html/site/etufo.org -d www.etufo.org -d img.etufo.org

Kamora hore setifikeiti sa Let Encrypt se kenngoe ka katleho, molaetsa o latelang o tla hlaha ho SSH:

LIHOLO TSA Bohlokoa:
– Kea u lebohela Setifikeiti sa hao le chain li bolokiloe ho:
/etc/letsencrypt/live/www.chenweiliang.com/fullchain.pem
Faele ea hau ea senotlolo e bolokiloe ho:
/etc/letsencrypt/live/www.chenweiliang.com/privkey.pem
Setifikeiti sa hau se tla felloa ke nako ka 2018-02-26. Ho fumana e ncha kapa e fetotsoeng
mofuta oa setifikeiti sena nakong e tlang, tsamaisa feela certbot-auto
Ho nchafatsa litifikeiti tsa hau kaofela, matha
"certbot-auto renew"
- Haeba u rata Certbot, ka kopo nahana ka ho ts'ehetsa mosebetsi oa rona ka:
Ho fana ka monehelo ho ISRG / A re Encrypteng: https://letsencrypt.org/donate
Ho fana ka monehelo ho EFF: https://eff.org/donate-le

Nchafatso ea Setifikeiti sa SSL

Ntjhafatso ea setifikeiti le eona e bonolo haholo, ho sebelisoa crontab bakeng sa ntjhafatso ea othomathiki. Bakeng sa mefuta e meng ea Debian e se nang crontab e kentsoeng, u ka e kenya ka letsoho pele.

apt-get install cron

Litaelo tse latelang tsa nginx le apache li kenngoa faeleng ea /etc/crontab , ho bolelang hore li nchafatsoa matsatsi a mang le a mang a 10, 'me nako ea tumello ea matsatsi a 90 e lekane.

Nginx crontab, ka kopo eketsa:

0 3 */10 * * /root/certbot-auto renew --renew-hook "/etc/init.d/nginx reload"

Apache crontab faele, ka kopo eketsa:

0 3 */10 * * /root/certbot-auto renew --renew-hook "service httpd restart"

Setifikeiti sa SSL Tokiso ea Apache

Joale, re hloka ho etsa liphetoho ho tlhophiso ea Apache.

Malebela:

• haeba u sebelisaSehlopha sa Taolo sa CWP, ho Eketsa domain name hlahloba Ka ho iketsa setifikeiti sa SSL, se tla hlophisa setifikeiti sa SSL bakeng sa Apache ka bohona.
• Haeba u etsa tse ling tsa mehato e latelang, phoso e ka hlaha ka mor'a ho qala Apache hape.
• Haeba ho na le phoso, hlakola litlhophiso tseo u li kentseng ka letsoho.

Fetola faele ea httpd.conf ▼

/usr/local/apache/conf/httpd.conf

Fumana ▼

Listen 443

• (tlosa nomoro ea maikutlo e fetileng #)

kapa eketsa kou ea ho mamela 443 ▼

Listen 443

SSH lekola boema-kepe ba ho mamela ba Apache ▼

grep ^Listen /usr/local/apache/conf/httpd.conf

Fumana ▼

mod_ssl

• (tlosa nomoro ea maikutlo e fetileng #)

kapa eketsa ▼

LoadModule ssl_module modules/mod_ssl.so

Fumana ▼

httpd-ssl

• (tlosa nomoro ea maikutlo e fetileng #)

Ebe, SSH etsa taelo e latelang (hlokomela ho fetola tsela ho ea ho ea hau):

at >/usr/local/apache/conf/extra/httpd-ssl.conf<<EOF
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProxyCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLHonorCipherOrder on
SSLProtocol all -SSLv2 -SSLv3
SSLProxyProtocol all -SSLv2 -SSLv3
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:/usr/local/apache/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
SSLMutex "file:/usr/local/apache/logs/ssl_mutex"
EOF

E latelang, qetellong ea tlhophiso ea Apache bakeng sa webosaete eo u e entseng, tlas'a </VirtualHost>.

Kenya faele ea tlhophiso ea karolo ea SSL (hlokomela ho tlosa maikutlo, le ho fetola tsela ea hau):

<VirtualHost *:443>
DocumentRoot /home/admin/web/chenweiliang.com/public_html //网站目录
ServerName www.chenweiliang.com:443 //域名
ServerAdmin [email protected] //邮箱
ErrorLog "/var/log/www.chenweiliang.com-error_log" //错误日志
CustomLog "/var/log/www.chenweiliang.com-access_log" common //访问日志
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/www.chenweiliang.com/fullchain.pem //之前生成的证书
SSLCertificateKeyFile /etc/letsencrypt/live/www.chenweiliang.com/privkey.pem //之前生成的密钥
<Directory "/home/admin/web/chenweiliang.com/public_html"> //网站目录
SetOutputFilter DEFLATE
Options FollowSymLinks
AllowOverride All
suPHP_UserGroup eloha eloha //用户组（有些服务器配置需要，有些可能不需要，出错请删除此行）
Order allow,deny
Allow from all
DirectoryIndex index.html index.phps
</Directory>
</VirtualHost>

Qetellong qala Apache ho eona:

service httpd restart

Apache e qobella HTTP hore e boele ho HTTPS

• Likopo tse ngata tsa marang-rang li ka sebetsa feela ka SSL.
• Re hloka ho etsa bonnete ba hore nako le nako ha re sebelisa SSL, sebaka sa marang-rang se tlameha ho fumanoa ka SSL.
• Haeba mosebelisi ofe kapa ofe a leka ho kena webosaeteng ka URL eo e seng ea SSL, o tlameha ho fetisetsoa webosaeteng ea SSL.
• Lebisa ho SSL URL o sebelisa mojule oa Apache mod_rewrite.
• Joalo ka ho sebelisa sephutheloana sa ho kenya LAMP ka konopo e le 'ngoe, ho kenya setifikeiti sa SSL ka boiketsetso le ho fetisetsoa ho HTTPS, ho fetisetsoa ho HTTPS.Tšebetsong, ha ho hlokahale hore u kenye mokhoa oa ho tsamaisa HTTPS.

Kenya molao oa ho tsamaisa hape

• Ho faele ea tlhophiso ea Apache, hlophisa moamoheli oa sebaka sa marang-rang 'me u kenye litlhophiso tse latelang.
• U ka boela ua eketsa litlhophiso tse tšoanang ho motso oa tokomane sebakeng sa hau sa marang-rang ho faele ea hau ea .htaccess.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Haeba u batla feela ho hlakisa URL e itseng eo u tla e fetisetsa ho HTTPS:

RewriteEngine On
RewriteRule ^message$ https://www.etufo.org/message [R=301,L]

• Haeba motho a leka ho kena molaetsa , leqephe le tla tlolela ho https, mme mosebelisi a ka fihlella URL feela ka SSL.

Qala hape Apache hore faele ea .htaccess e sebetse:

service httpd restart

Litlhokomelo

• Ka kopo fetola aterese ea lengolo-tsoibila e ka holimo ho aterese ea hau ea lengolo-tsoibila.
• Ka kopo hopola ho fetola lebitso la sebaka sa marang-rang se kaholimo ho lebitso la sebaka sa hau sa marang-rang.

Hlalosa bothata ba sebaka sa molao hape

Ha o beha melao ea ho fetisetsa melaetsa tlas'a melao ea pseudo-static, hangata o tla kopana le bothata ba hore HTTP e ke ke ea fetisetsa sebaka sohle ho HTTPS.

Qalong re kopitsitse khoutu e redirect ho .htaccess mme e tla hlaha maemong a latelang ▼

• [L] e bontša hore molao oa hona joale ke molao oa ho qetela, khaotsa ho hlahloba melao e latelang ea ho ngola hape.
• Kahoo ha u fumana leqephe la sengoloa se tsamaisitsoeng bocha, [L] e emisa molao o latelang, kahoo molao oa ho tsamaisa hape ha o sebetse.

Ha re kena leqepheng la lapeng la HTTP, re batla ho qala ho fetisetsa URL hape, re fete melao ea ho ngola bocha URL ho phethahatsa melao ea ho fetisetsa, e le hore sebaka sohle sa marang-rang se ka fetisetsoa ho tloha ho HTTP ho ea ho HTTPS.

U se ke ua beha melao ea HTTPS e fetisetsang morao ka tlase ho melao ea [L] ; e behe kaholimo ho melao ea [L].

Palo e atolositsoeng:

• Phapano ke efe lipakeng tsa http vs https? Tlhaloso e felletseng ea ts'ebetso ea encryption ea SSL
• Ke lokela ho etsa eng haeba ke fumana phoso 500 kamora ho kenya setifikeiti sa Let's Encrypt SSL phanele ea taolo ea CWP?
• Tlolela ka boiketsetso ho lebitso la boemo ba bobeli ntle le lebitso la sebaka sa boemo bo holimo la www: the root domain name 301 redirects www.