參考網站：
Debian / Ubuntu 安裝 Let’s Encrypt 到 Apache – Linux 技術手札
1. 安裝 Apache Web Server
# apt-get install apache2
2. 啟用 SSL 模組並重新啟動 Apache Web Server
# a2enmod ssl
Considering dependency setenvif for ssl:
Module setenvif already enabled
Considering dependency mime for ssl:
Module mime already enabled
Considering dependency socache_shmcb for ssl:
Enabling module socache_shmcb.
Enabling module ssl.
See /usr/share/doc/apache2/README.Debian.gz on how to configure SSL and create self-signed certificates.
To activate the new configuration, you need to run:
service apache2 restart
# a2ensite default-ssl.conf
Enabling site default-ssl.
To activate the new configuration, you need to run:
service apache2 reload
# /etc/init.d/apache2 restart
or
# systemctl restart apache2.service[@more@]3. 安裝 git 套件
# apt-get install git
4. 下載 Let’s Encrypt 的目錄
# cd /usr/local
# git clone https://github.com/letsencrypt/letsencrypt
Cloning into ‘letsencrypt’…
remote: Counting objects: 43808, done.
remote: Compressing objects: 100% (76/76), done.
remote: Total 43808 (delta 40), reused 0 (delta 0), pack-reused 43732
Receiving objects: 100% (43808/43808), 12.74 MiB | 2.16 MiB/s, done.
Resolving deltas: 100% (31283/31283), done.
Checking connectivity… done.
5. 產生憑證
# ./letsencrypt-auto –apache -d test.ilc.edu.tw -d www.test.ilc.edu.tw
Enter email address (used for urgent renewal and security notices) (Enter ‘c’ to
cancel):
——————————————————————————-
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf. You must agree
in order to register with the ACME server at
https://acme-v01.api.letsencrypt.org/directory
——————————————————————————-
(A)gree/(C)ancel: A
——————————————————————————-
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let’s Encrypt project and the non-profit
organization that develops Certbot? We’d like to send you email about EFF and
our work to encrypt the web, protect its users and defend digital rights.
——————————————————————————-
(Y)es/(N)o: Y
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for test.ilc.edu.tw
tls-sni-01 challenge for www.test.ilc.edu.tw
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. nxi.tces.ilc.edu.tw (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Failed to connect to 192.168.1.1:443 for TLS-SNI-01 challenge
IMPORTANT NOTES:
– If you lose your account credentials, you can recover through
e-mails sent to t850008@gmail.com.
– The following errors were reported by the server:
Domain: www.test.ilc.edu.tw
Type: connection
Detail: Failed to connect to 192.168.1.1:443 for TLS-SNI-01
challenge
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you’re using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
– Your account credentials have been saved in your Certbot
configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Certbot so
making regular backups of this folder is ideal.
