Elastic Load Balancing(ELB)使用時は、Certificate Managerで作成したSSL証明書適用でOKだが、シングルインスタンスではNGなので、自前の証明書を適用。
<証明書取得>
certbot インストール
sudo pip install certbot
Zone APEX用証明書
sudo /usr/local/bin/certbot certonly \
--manual \
--preferred-challenges dns-01 \
--server https://acme-v02.api.letsencrypt.org/directory \
--domains example.com
SSLCertificateFile "/etc/letsencrypt/live/example.com/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/live/example.com/privkey.pem"
が生成。
Route 53 で _acme-challenge.example.com の TXTレコードに指示された値を設定し、有効化。
ワイルドカードサブドメイン用証明書
sudo /usr/local/bin/certbot certonly \
--manual \
--preferred-challenges dns-01 \
--server https://acme-v02.api.letsencrypt.org/directory \
--domains *.example.com
SSLCertificateFile "/etc/letsencrypt/live/example.com-0001/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/live/example.com-0001/privkey.pem"
が生成。
Route 53 で _acme-challenge.example.com の TXTレコードに指示された値を設定し、有効化。
<証明書設定>
/etc/httpd/conf.d/ssl.conf
以下の通り設定
LoadModule ssl_module modules/mod_ssl.so
Listen 443
NameVirtualHost *:443
<VirtualHost *:443>
ServerName example.com
DocumentRoot "/var/app/current/example/example.com"
SSLEngine on
SSLCertificateFile "/etc/letsencrypt/live/example.com-0001/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/live/example.com-0001/privkey.pem"
<Directory "/var/app/current/example/example.com">
AllowOverride All
Require all granted
</Directory>
</VirtualHost>
<VirtualHost *:443>
ServerName example.com
DocumentRoot "/var/app/current/example/sub.example.com"
SSLEngine on
SSLCertificateFile "/etc/letsencrypt/live/example.com/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/live/example.com/privkey.pem"
<Directory "/var/app/current/example/sub.example.com">
AllowOverride All
Require all granted
</Directory>
</VirtualHost>
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLSessionTickets Off
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
サーバ再起動後、SSL Sever Test にて確認。
installation error on amazon linux
https://github.com/certbot/certbot/issues/1680#issuecomment-358728515
CertbotでDNSによる認証(DNS-01)で無料のSSL/TLS証明書を取得する
http://blog.jicoman.info/2017/04/certbot_dns_01/
Let's Encryptのワイルドカード証明書を早速発行してもらう
https://narusejun.com/archives/23/
付録: Amazon Linux 2 での Let's Encrypt と Certbot の使用
https://docs.aws.amazon.com/ja_jp/AWSEC2/latest/UserGuide/SSL-on-an-instance.html
SSL Server Test
https://www.ssllabs.com/ssltest/