また例によって、Let’s Encryptからメールが来ていた。
Hello,
Your certificate (or certificates) for the names listed below will expire in 19 days (on 29 Nov 21 19:51 +0000). Please make sure to renew your certificate before then, or visitors to your web site will encounter errors.
さて、前回（3ヶ月前）に更新ができなかった時に、仕様変更でDNSにwwwつきドメインをAレコードに追加して解決したはずだったんだが……?
Plaintext
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Cert is due for renewal, auto-renewing...
Renewing an existing certificate for www.ice-military.com and www.www.ice-military.com
Performing the following challenges:
http-01 challenge for www.ice-military.com
http-01 challenge for www.www.ice-military.com
Using the webroot path /home/kusanagi/wordpress/DocumentRoot for all unmatched domains.
Waiting for verification...
Challenge failed for domain www.www.ice-military.com
Challenge failed for domain www.ice-military.com
http-01 challenge for www.www.ice-military.com
http-01 challenge for www.ice-military.com
Cleaning up challenges
Some challenges have failed.
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: www.www.ice-military.com
Type: connection
Detail: Fetching
https://www.ice-military.com/.well-known/acme-challenge/UJxTXD-TWalqSCwDJPh6vhSHMRoTK4g4sdg9-ZdC_tY:
Timeout during connect (likely firewall problem)
Domain: www.ice-military.com
Type: connection
Detail: Fetching
https://www.ice-military.com/.well-known/acme-challenge/ElMvdlb2KpA4SNEy-lUvIqI3JKsCWyJiePiDq2yrJuQ:
Timeout during connect (likely firewall problem)
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you're using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
今回もまた手っ取り早く再構築を考えたが、これではいつまで経っても埒が明かないを思い、さらにいろいろ調べてみることにしました。
そこで見つけたのがcertbotのサイト。
Certbot
Get your site on https://
certbot.eff.org
このページの手順通りに作業を進めてみることにしました。
Install snapdYou’ll need to install snapd and make sure you follow any instructions to enable classic snap support.（snapdのインストールと、クラシックスナップサポートを有効にする。）
snapdのインストールと、クラシックスナップサポートを有効にする
snapdのインストール
Bash
yum install snapd
読み込んだプラグイン:fastestmirror
Loading mirror speeds from cached hostfile
* base: ftp.tsukuba.wide.ad.jp
* epel: ftp.jaist.ac.jp
* extras: ftp.tsukuba.wide.ad.jp
* updates: ftp.tsukuba.wide.ad.jp
依存性の解決をしています
---> トランザクションの確認を実行しています。
---> パッケージ snapd.x86_64 0:2.53.2-1.el7 を インストール
---> 依存性解決を終了しました。
依存性を解決しました
========================================================================================================================================
Package アーキテクチャー バージョン リポジトリー 容量
========================================================================================================================================
インストール中:
snapd x86_64 2.53.2-1.el7 epel 16 M
トランザクションの要約
========================================================================================================================================
インストール 1 パッケージ
総ダウンロード容量: 16 M
インストール容量: 47 M
Is this ok [y/d/N]: y
Downloading packages:
snapd-2.53.2-1.el7.x86_64.rpm | 16 MB 00:00:02
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
インストール中 : snapd-2.53.2-1.el7.x86_64 1/1
検証中 : snapd-2.53.2-1.el7.x86_64 1/1
インストール:
snapd.x86_64 0:2.53.2-1.el7
完了しました!クラシックスナップサポートを有効にする
Bash
systemctl enable --now snapd.socket
Created symlink from /etc/systemd/system/sockets.target.wants/snapd.socket to /usr/lib/systemd/system/snapd.socket.スナップサポートを有効にするため、シンボリックを作成する。
Bash
ln -s /var/lib/snapd/snap /snapsnapdが最新バージョンであることを確認する
Bash
snap install core
core 16-2.52.1 from Canonical? installed
sudo snap refresh core
snap "core" has no updates availablecertbot-autoを削除する
Bash
yum remove certbotCertbotをインストールする
Bash
snap install --classic certbot
certbot 1.21.0 from Certbot Project (certbot-eff?) installed
snap install --classic certbotコマンドライン上でCertbotコマンドが実行できることを確認する
Bash
ln -s /snap/bin/certbot /usr/bin/certbotCertbotの実行方法を選択し、証明書を取得する
Bash
certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: www.ice-military.com
2: www.www.ice-military.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Certificate not yet due for renewal
You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.
(ref: /etc/letsencrypt/renewal/www.ice-military.com.conf)
What would you like to do?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Attempt to reinstall this existing certificate
2: Renew & replace the certificate (may be subject to CA rate limits)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Renewing an existing certificate for www.ice-military.com and www.www.ice-military.com
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/www.ice-military.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/www.ice-military.com/privkey.pem
This certificate expires on 2022-02-28.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
Deploying certificate
Successfully deployed certificate for www.ice-military.com to /etc/nginx/conf.d/wordpress_ssl.conf
Successfully deployed certificate for www.www.ice-military.com to /etc/nginx/conf.d/wordpress_ssl.conf
Your existing certificate has been successfully renewed, and the new certificate has been installed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -自動更新をテストする
Bash
certbot renew --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/www.ice-military.com-0001.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Simulating renewal of an existing certificate for www.ice-military.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/www.ice-military.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Simulating renewal of an existing certificate for www.ice-military.com and www.www.ice-military.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all simulated renewals succeeded:
/etc/letsencrypt/live/www.ice-military.com-0001/fullchain.pem (success)
/etc/letsencrypt/live/www.ice-military.com/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -今回はこの手順により無事に証明書を更新する事ができました。
コメント