Ubuntu and Apache 搭建 Let's Encrypt SSL Https

为什么80%的码农都做不了架构师？>>>   

本文参考来着来自https://www.howtoing.com/install-free-lets-encrypt-ssl-certificate-for-apache-on-debian-and-ubuntu 感谢作者的分享

本事例环境介绍

1. ubuntu (Version  16.04.1 LTS)

   ubuntu@VM-0-7-ubuntu:~$ sudo lsb_release -a
   No LSB modules are available.
   Distributor ID:	Ubuntu
   Description:	Ubuntu 16.04.1 LTS
   Release:	16.04

2. apache

   ubuntu@VM-0-7-ubuntu:~$ apache2 -v
   Server version: Apache/2.4.18 (Ubuntu)
   Server built:   2018-06-07T19:43:03

3. git

   ubuntu@VM-0-7-ubuntu:~$ git --version
   git version 2.7.4

操作步骤 

•  Apache 开启 SSL模块

  ubuntu@VM-0-7-ubuntu:~$ sudo a2enmod ssl #开启ssl
  
  Considering dependency setenvif for ssl:
  Module setenvif already enabled
  Considering dependency mime for ssl:
  Module mime already enabled
  Considering dependency socache_shmcb for ssl:
  Enabling module socache_shmcb.
  Enabling module ssl.
  See /usr/share/doc/apache2/README.Debian.gz on how to configure SSL and create self-signed certificates.
  To activate the new configuration, you need to run:
    service apache2 restart
  
  ubuntu@VM-0-7-ubuntu:~$ sudo a2ensite default-ssl.conf
  Enabling site default-ssl.
  To activate the new configuration, you need to run:
    service apache2 reload
  
  ubuntu@VM-0-7-ubuntu:~$ sudo service apache2 restart #重启apache 

  这时候可以访问https://yourdomain.com(会提示不安全因为没有证书)
• 通过git下载 letsencrypt客户端

  ubuntu@VM-0-7-ubuntu:~$ cd /usr/local #指定文件放置路劲
  
  ubuntu@VM-0-7-ubuntu:/usr/local$ sudo git clone https://github.com/letsencrypt/letsencrypt #下载letsencrypt
  Cloning into 'letsencrypt'...
  remote: Enumerating objects: 45, done.
  remote: Counting objects: 100% (45/45), done.
  remote: Compressing objects: 100% (42/42), done.
  remote: Total 61779 (delta 17), reused 8 (delta 3), pack-reused 61734
  Receiving objects: 100% (61779/61779), 20.25 MiB | 7.59 MiB/s, done.
  Resolving deltas: 100% (44899/44899), done.
  Checking connectivity... done.

• Apache 生成 SSL证书
  这里www.freelancerman.cn为自己的域名作为例子这里请填写自己需要ssl的域名,域名这边需要能访问成功的页面

• ubuntu@VM-0-7-ubuntu:/usr/local$ cd letsencrypt
  
  ubuntu@VM-0-7-ubuntu:/usr/local/letsencrypt$ ls
  acme            certbot-auto                certbot-dns-dnsimple     certbot-dns-luadns   certbot-dns-sakuracloud  docker-compose.yml  examples                 LICENSE.txt                    pull_request_template.md          setup.py
  appveyor.yml    certbot-compatibility-test  certbot-dns-dnsmadeeasy  certbot-dns-nsone    certbot-nginx            Dockerfile          ISSUE_TEMPLATE.md        linter_plugin.py               pytest.ini                        tests
  AUTHORS.md      certbot-dns-cloudflare      certbot-dns-gehirn       certbot-dns-ovh      certbot-postfix          Dockerfile-dev      letsencrypt-auto         local-oldest-requirements.txt  README.rst                        tools
  certbot         certbot-dns-cloudxns        certbot-dns-google       certbot-dns-rfc2136  CHANGELOG.md             Dockerfile-old      letsencrypt-auto-source  MANIFEST.in                    readthedocs.org.requirements.txt  tox.cover.py
  certbot-apache  certbot-dns-digitalocean    certbot-dns-linode       certbot-dns-route53  CONTRIBUTING.md          docs                letshelp-certbot         mypy.ini                       setup.cfg                         tox.ini
  
  ubuntu@VM-0-7-ubuntu:/usr/local/letsencrypt$ sudo ./letsencrypt-auto --apache -d www.freelancerman.cn 
  ....
  Plugins selected: Authenticator apache, Installer apache
  Enter email address (used for urgent renewal and security notices) (Enter 'c' to
  cancel): [email protected] #输入邮箱,证书快到期后邮箱将收到提醒
  
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Please read the Terms of Service at
  https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
  agree in order to register with the ACME server at
  https://acme-v02.api.letsencrypt.org/directory
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  (A)gree/(C)ancel: A  #同意
  
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Would you be willing to share your email address with the Electronic Frontier
  Foundation, a founding partner of the Let's Encrypt project and the non-profit
  organization that develops Certbot? We'd like to send you email about our work
  encrypting the web, EFF news, campaigns, and ways to support digital freedom.
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  (Y)es/(N)o: Y  #yes

  查看域名 在SSL 访问下 证书状态 访问地址: https://www.ssllabs.com/ssltest/analyze.html?d=www.freelancerman.cn
  
• 本环境下遇到的Error: 查看官方解释

  Traceback (most recent call last):
    File "/usr/lib/python3/dist-packages/virtualenv.py", line 2363, in 
      main()
    File "/usr/lib/python3/dist-packages/virtualenv.py", line 719, in main
      symlink=options.symlink)
    File "/usr/lib/python3/dist-packages/virtualenv.py", line 988, in create_environment
      download=download,
    File "/usr/lib/python3/dist-packages/virtualenv.py", line 918, in install_wheel
      call_subprocess(cmd, show_stdout=False, extra_env=env, stdin=SCRIPT)
    File "/usr/lib/python3/dist-packages/virtualenv.py", line 812, in call_subprocess
      % (cmd_desc, proc.returncode))
  OSError: Command /opt/eff.org/certbot/venv/bin/python2.7 - setuptools pkg_resources pip wheel failed with error code 2

  需要升级pip版本,但是ubuntu 16.04升级pip不了,这边我们使用wget方式升级 pip

  ubuntu@VM-0-7-ubuntu:~$ sudo apt-get update
  
  ubuntu@VM-0-7-ubuntu:~$ sudo apt-get upgrade
  
  ubuntu@VM-0-7-ubuntu:~$ wget https://bootstrap.pypa.io/get-pip.py
  
  ubuntu@VM-0-7-ubuntu:~$ sudo python3 get-pip.py
  
  ubuntu@VM-0-7-ubuntu:~$ sudo pip -V
  pip 18.1 from /usr/local/lib/python3.5/dist-packages/pip (python 3.5) #升级成功
  
  ubuntu@VM-0-7-ubuntu:~$ sudo apt-get purge python-virtualenv python3-virtualenv virtualenv #删除2.7
  
  ubuntu@VM-0-7-ubuntu:~$ sudo pip install virtualenv
  
  ubuntu@VM-0-7-ubuntu:/usr/local/letsencrypt$ sudo pip -V
  pip 18.1 from /usr/local/lib/python3.5/dist-packages/pip (python 3.5)

   

• 自动续订加密证书
  证书的有效期为90天,在此之前须更新证书,这里通过切换到root调用/etc/crontab 每月的1.1号对证书自动更新并日志输出

  ubuntu@VM-0-7-ubuntu:/etc$ sudo su
  
  root@VM-0-7-ubuntu:/etc# vim crontab
  
  # /etc/crontab: system-wide crontab
  # Unlike any other crontab you don't have to run the `crontab'
  # command to install the new version when you edit this file
  # and files in /etc/cron.d. These files also have username fields,
  # that none of the other crontabs do.
  
  ......
  0  1    1 */2 * root    cd  /usr/local/letsencrypt && ./letsencrypt-auto certonly --apache --renew-by-default --apache -d www.freelancerman.cn >> /var/log/domain.tld-renew.log 2>&1  #为设置计划时间更新证书
  

  
  
   

转载于:https://my.oschina.net/oslph/blog/3002146