SSL/TLSを使えるようにする

mod_sslモジュールをインストールする

$ sudo yum install mod_ssl

ファイアウォールの設定

httpsにアクセスするためには、https通信443番ポートの接続許可をファイアウォールに追加しなくてはならない。

ファイアウォールの確認

services:に「https」が追加されているか確認する。

$ firewall-cmd --list-all

services: dhcpv6-client http https ssh

追加されていない場合

$ sudo firewall-cmd --permanent --add-service=https

success

firewalldを再起動する

ファイアウォールへの追加・削除を行ったら必ず再起動して設定を反映させる。

$ sudo firewall-cmd --reload

success

無料SSL証明書

無料SSL証明書のLet’s Encryptをインストールする。

インストールする

$ sudo yum install certbot python2-certbot-apache

証明書の作成

certbotコマンドを実行してHTTPS接続をしたいドメインのSSL証明書を作成する。

$ sudo certbot --apache -d domain-name.com

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Enter email address (used for urgent renewal and security notices) (Enter ‘c’ to cancel): ■←(EMAILアドレスを入力。Let’s Encryptからのお知らせを受け取るアドレス)■



Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org



  ——————————————————————————-

Please read the Terms of Service at

https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf. You must agree

in order to register with the ACME server at

https://acme-v01.api.letsencrypt.org/directory

  ——————————————————————————-

(A)gree/(C)ancel: ■←A(規約に同意する)■



  ——————————————————————————-

Would you be willing to share your email address with the Electronic Frontier

Foundation, a founding partner of the Let’s Encrypt project and the non-profit

organization that develops Certbot? We’d like to send you email about EFF and

our work to encrypt the web, protect its users and defend digital rights.

  ——————————————————————————-

(Y)es/(N)o: ■←Y (Let’s EncryptパートナーにEmailを公開。したくない場合はN)■



Starting new HTTPS connection (1): supporters.eff.org

Obtaining a new certificate

Performing the following challenges:

tls-sni-01 challenge for xxxxxxx.com



We were unable to find a vhost with a ServerName or Address of example.com.

Which virtual host would you like to choose?

(note: conf files with multiple vhosts are not yet supported)

  ——————————————————————————-

1: ssl.conf                       |                       | HTTPS | Enabled

  ——————————————————————————-

Press 1 [enter] to confirm the selection (press ‘c’ to cancel): ■←1(ssl.confを選択する)■

Deploying Certificate for example.com to VirtualHost /etc/httpd/conf.d/ssl.conf



Please choose whether HTTPS access is required or optional.

  ——————————————————————————-

1: Easy – Allow both HTTP and HTTPS access to these sites

(1：簡単 – これらのサイトへのHTTPアクセスとHTTPSアクセスの両方を許可する)

2: Secure – Make all requests redirect to secure HTTPS access

(2：安全 – すべての要求を安全なHTTPSアクセスにリダイレクトする)

  ——————————————————————————-

Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): ■←1 or 2■

Created redirect file: le-redirect-example.com.conf

Rollback checkpoint is empty (no changes made?)



  ——————————————————————————-

Congratulations! You have successfully enabled https://example.com



You should test your configuration at:

https://www.ssllabs.com/ssltest/analyze.html?d=example.com

  ——————————————————————————-



IMPORTANT NOTES:

– Congratulations! Your certificate and chain have been saved at

  /etc/letsencrypt/live/example.com/fullchain.pem. Your cert will

  expire on 2017-09-18. To obtain a new or tweaked version of this

  certificate in the future, simply run certbot again with the

  “certonly” option. To non-interactively renew *all* of your

  certificates, run “certbot renew”

– Your account credentials have been saved in your Certbot

  configuration directory at /etc/letsencrypt. You should make a

  secure backup of this folder now. This configuration directory will

  also contain certificates and private keys obtained by Certbot so

  making regular backups of this folder is ideal.

– If you like Certbot, please consider supporting our work by:



  Donating to ISRG / Let’s Encrypt:   https://letsencrypt.org/donate

  Donating to EFF:                    https://eff.org/donate-le

  ―――――――――――――――――――――――