\u6700\u8fd1\u306f\u3053\u3093\u306a\u611f\u3058\u3067Let’s Encrypt\u306e\u8a3c\u660e\u66f8\u306e\u66f4\u65b0\u3092\u66f4\u65b0\u3057\u3066\u3044\u308b\u306e\u3067\u3059\u304c\u4eca\u56de\u5931\u6557\u3057\u307e\u3057\u305f\uff0e
\n\uff08DocumenteRoot\u3092FQDN\u306b\u3057\u3066\u3044\u308b\u524d\u63d0\uff09<\/p>\n
<\/span>$ sudo \/bin\/sh -c "\/usr\/bin\/find \/etc\/letsencrypt\/renewal\/*.conf -type f | \/usr\/bin\/xargs \/usr\/bin\/basename -s .conf | xargs -n1 -I{} \/usr\/bin\/letsencrypt renew --webroot -w \/var\/www\/{}\/ -d {}"<\/span>\r\n<\/pre>\n<\/div>\n\u3053\u3093\u306a\u3075\u3046\u306b\u6012\u3089\u308c\u307e\u3059\uff0e
\n(\u4ed5\u69d8\u304c\u5909\u308f\u3063\u305f?)<\/p>\n
\n<\/span>Saving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\r\nCurrently, the renew verb is capable of either renewing all installed certificates that are due to be renewed or renewing a single certificate specified by its name. If you would like to renew specific certificates by their domains, use the certonly command. The renew verb may provide other options for selecting certificates to renew in the future.\r\n<\/pre>\n<\/div>\n\u3068\u308a\u3042\u3048\u305a\u306fletsencrypt renew<\/code>\u3092letsencrypt certonly<\/code>\u306b\u3057\u305f\u3089\u901a\u308a\u307e\u3057\u305f\uff0e<\/p>\n\n<\/span>$ sudo \/bin\/sh -c "\/usr\/bin\/find \/etc\/letsencrypt\/renewal\/*.conf -type f | \/usr\/bin\/xargs \/usr\/bin\/basename -s .conf | xargs -n1 -I{} \/usr\/bin\/letsencrypt certonly --webroot -w \/var\/www\/{}\/ -d {}"<\/span>\r\n<\/pre>\n<\/div>\n\u3053\u308c\u3067\u66f4\u65b0\u3067\u304d\u305f\u3068\u601d\u3063\u305f\u30891\u3064\u306e\u30c9\u30e1\u30a4\u30f3\u3067\u5931\u6557\u3057\u3066\u3044\u307e\u3059\uff0e<\/p>\n
\n<\/span>Saving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\r\nCert is due for renewal, auto-renewing...\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\nhttp-01 challenge for files.matoken.org\r\nUsing the webroot path \/var\/www\/files.matoken.org for all unmatched domains.\r\nWaiting for verification...\r\nCleaning up challenges\r\nFailed authorization procedure. files.matoken.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http:\/\/files.matoken.org\/.well-known\/acme-challenge\/Be7Aiai4UH9CDqacTaEZOMH4SxSQbtFqxFcPXcCtJEs: "<!DOCTYPE HTML PUBLIC "-\/\/IETF\/\/DTD HTML 2.0\/\/EN"><\/span>\r\n<html><head><\/span>\r\n<title><\/span>404 Not Found<\/title><\/span> \r\n<\/head><body><\/span>\r\n<h1><\/span>Not Found<\/h1><\/span>\r\n<p<\/span>"<\/span>\r\n\r\nIMPORTANT<\/span> NOTES:<\/span>\r\n -<\/span> The<\/span> following<\/span> errors<\/span> were<\/span> reported<\/span> by<\/span> the<\/span> server:<\/span>\r\n\r\n Domain:<\/span> files.matoken.org<\/span> \r\n Type:<\/span> unauthorized<\/span>\r\n Detail:<\/span> Invalid<\/span> response<\/span> from<\/span>\r\n http:\/\/files.matoken.org\/.well-known\/acme-challenge\/Be7Aiai4UH9CDqacTaEZOMH4SxSQbtFqxFcPXcCtJEs:<\/span>\r\n "<!DOCTYPE<\/span> HTML<\/span> PUBLIC<\/span> "-\/\/IETF\/\/DTD<\/span> HTML<\/span> 2.0\/\/EN"<\/span>><\/span>\r\n <html><head><\/span>\r\n <title><\/span>404 Not Found<\/title><\/span>\r\n <\/head><body><\/span>\r\n <h1><\/span>Not Found<\/h1><\/span>\r\n <p<\/span>"<\/span>\r\n\r\n To<\/span> fix<\/span> these<\/span> errors,<\/span> please<\/span> make<\/span> sure<\/span> that<\/span> your<\/span> domain<\/span> name<\/span> was<\/span>\r\n entered<\/span> correctly<\/span> and<\/span> the<\/span> DNS<\/span> A<\/span> record(s)<\/span> for<\/span> that<\/span> domain<\/span>\r\n contain(s)<\/span> the<\/span> right<\/span> IP<\/span> address.<\/span>\r\n<\/pre>\n<\/div>\n\u30d5\u30a1\u30a4\u30eb\u3092DoumentRoot\u306b\u7f6e\u3044\u3066Let’s Encrypt\u304b\u3089\u30a2\u30af\u30bb\u30b9\u3055\u308c\u308b\u306e\u3067\u3059\u304c\u305d\u3053\u3067\u305d\u306e\u30d5\u30a1\u30a4\u30eb\u304c\u898b\u3064\u304b\u3089\u306a\u3044\u3068\u5931\u6557\u3057\u3066\u3044\u307e\u3059\uff0e\u3053\u306e\u30c9\u30e1\u30a4\u30f3\u306fhttp\u3092\u8a2d\u5b9a\u3057\u3066\u3044\u307e\u305b\u3093\u3067\u3057\u305f\uff0e
\n\u3066\u3053\u3068\u3067apache\u3067Rewrite\u306e\u8a2d\u5b9a\u3092\u3057\u3066\u3042\u3052\u308b\u3068<\/p>\n
\n<\/span>RewriteEngine On\r\nRewriteRule ^ https:\/\/%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]\r\n<\/pre>\n<\/div>\n\u901a\u308a\u307e\u3057\u305f\uff0e<\/p>\n
\n<\/span>$ sudo \/usr\/bin\/letsencrypt certonly --webroot -w \/var\/www\/files.matoken.org\/ -d files.mato\r\nken.org\r\nSaving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\r\nCert is due for<\/span> renewal, auto-renewing...\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\nhttp-01 challenge for<\/span> files.matoken.org\r\nUsing the webroot path \/var\/www\/files.matoken.org for<\/span> all unmatched domains.\r\nWaiting for<\/span> verification...\r\nCleaning up challenges\r\nGenerating key (<\/span>2048<\/span> bits)<\/span>: \/etc\/letsencrypt\/keys\/0003_key-certbot.pem\r\nCreating CSR: \/etc\/letsencrypt\/csr\/0003_csr-certbot.pem\r\n\r\nIMPORTANT NOTES:\r\n - Congratulations! Your certificate and chain have been saved at\r\n \/etc\/letsencrypt\/live\/files.matoken.org\/fullchain.pem. Your cert\r\n will expire on 2018<\/span>-05-31. To obtain a new or tweaked version of\r\n this certificate in the future, simply run certbot again. To\r\n non-interactively renew *all* of your certificates, run "certbot<\/span>\r\n renew"<\/span>\r\n - If you like Certbot, please consider supporting our work by:\r\n\r\n Donating to ISRG \/ Let'<\/span>s Encrypt: https:\/\/letsencrypt.org\/donate\r\n Donating to EFF: https:\/\/eff.org\/donate-le\r\n<\/pre>\n<\/div>\ncertbot\u306eversion\u304c\u304b\u306a\u308a\u53e4\u3044\u3067\u3059\u306d\u2026\u2026\uff0e<\/p>\n
\n<\/span>$ dpkg -l|<\/span>grep -i certbot\r\nii certbot 0<\/span>.10.2-1 all automatically configure HTTPS using Let'<\/span>s Encrypt\r\nii python-certbot 0<\/span>.10.2-1 all main library for<\/span> certbot\r\n<\/pre>\n<\/div>\n\u3066\u3053\u3068\u3067backport\u306e\u3082\u306e\u306b\u5165\u308c\u66ff\u3048\uff0e<\/p>\n
\n<\/span>$ sudo apt remove certbot\r\n$ sudo apt install python-certbot-apache -t stretch-backports\r\n$ apt show certbot\r\nPackage: certbot\r\nVersion: 0<\/span>.21.1-1~bpo9+1\r\nPriority: optional\r\nSection: web\r\nSource: python-certbot\r\nMaintainer: Debian Let's Encrypt <letsencrypt-devel@lists.alioth.debian.org><\/span>\r\nInstalled-Size: 53.2 kB<\/span>\r\nProvides: letsencrypt<\/span>\r\nDepends: python3-certbot (= 0.21.1-1~bpo9+1), python3:any<\/span>\r\nSuggests: python3-certbot-apache, python3-certbot-nginx, python-certbot-doc<\/span>\r\nBreaks: letsencrypt (<= 0.6.0)<\/span>\r\nReplaces: letsencrypt<\/span>\r\nHomepage: https:\/\/certbot.eff.org\/<\/span>\r\nDownload-Size: 20.4 kB<\/span>\r\nAPT-Manual-Installed: no<\/span>\r\nAPT-Sources: http:\/\/ftp.jp.debian.org\/debian stretch-backports\/main amd64 Packages<\/span>\r\nDescription: automatically configure HTTPS using Let'<\/span>s Encrypt\r\n The objective of Certbot, Let's Encrypt, and the ACME (Automated<\/span>\r\n Certificate Management Environment) protocol is to make it possible<\/span>\r\n to set up an HTTPS server and have it automatically obtain a<\/span>\r\n browser-trusted certificate, without any human intervention. This is<\/span>\r\n accomplished by running a certificate management agent on the web<\/span>\r\n server.<\/span>\r\n .<\/span>\r\n This agent is used to:<\/span>\r\n .<\/span>\r\n - Automatically prove to the Let'<\/span>s Encrypt CA that you control the website\r\n - Obtain a browser-trusted certificate and set<\/span> it up on your web server\r\n - Keep track of when your certificate is going to expire, and renew it\r\n - Help you revoke the certificate if<\/span> that ever becomes necessary.\r\n .\r\n This package contains the main application, including the standalone\r\n and the manual authenticators.\r\n\r\nN: There is 1<\/span> additional record. Please use the '-a'<\/span> switch to see it\r\n<\/pre>\n<\/div>\n\u3066\u3053\u3068\u3067client\u304c\u53e4\u304b\u3063\u305f\u306e\u3067\u3042\u307e\u308a\u53c2\u8003\u306b\u306a\u3089\u7121\u3055\u305d\u3046\u306a\u30e1\u30e2\u3067\u3057\u305f\uff0e<\/p>\n
\n\n