カテゴリー: wordpress

$ cd /usr/local/src
$ sudo git clone https://github.com/certbot/certbot
$ cd certbot

$ sudo ./certbot-auto --help

$ sudo ./certbot-auto certonly --webroot -w { ドキュメントルート } -d { ドメイン名 } --email { メールアドレス }

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for kishi-r.com
Using the webroot path { ドキュメントルート } for all unmatched domains.
Waiting for verification...
Cleaning up challenges
 
IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/{ ドメイン名 }/fullchain.pem. Your cert will
   expire on 2017-09-06. To obtain a new or tweaked version of this
   certificate in the future, simply run certbot-auto again. To
   non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:
 
   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

/etc/letsencrypt/live/{ ドメイン名 }/fullchain.pem

$ cd /etc/nginx/ssl
$ sudo openssl dhparam 2048 -out dhparam-2048.pem
$ sudo chown root:root dhparam-2048.pem
$ sudo chmod 600 dhparam-2048.pem

$ sudo vim /etc/nginx/conf.d/wordpress.conf

#
# The default server
#
server {
  listen       443 ssl;
  server_name  { ドメイン名 };
 
  client_max_body_size 20M;
 
  ssl_certificate     /etc/letsencrypt/live/{ lets encrypt設定ドメイン名 }/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/{ lets encrypt設定ドメイン名 }/privkey.pem;
 
  ssl_session_timeout 1d;
 
  ssl_dhparam /etc/nginx/ssl/dhparam-2048.pem;
 
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
  ssl_prefer_server_ciphers on;
 
  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /etc/letsencrypt/live/{ lets encrypt設定ドメイン名 }/fullchain.pem;
  resolver 8.8.8.8;
 
  root { wordpress ドキュメントルート };
  index index.php;
 
  location ~* /wp-login\.php|/wp-admin/(^admin-ajax\.php) {
    auth_basic "Restricted";                   # 認証時に表示されるメッセージ
    auth_basic_user_file /etc/nginx/.htpasswd; # .htpasswdファイルのパス
    try_files $uri $uri/ @wordpress;
  }
 
  location = /xmlrpc.php {
    deny all;
  }
 
  location / {
    try_files $uri $uri/ @wordpress;
  }
 
  location ~ \.php$ {
    try_files $uri @wordpress;
    fastcgi_index index.php;
    fastcgi_split_path_info ^(.+\.php)(.*)$;
    fastcgi_pass unix:/run/php-fpm/php-fpm.sock;
    fastcgi_param SCRIPT_FILENAME  { wordpress ドキュメントルート }$fastcgi_script_name;
    include fastcgi_params;
  }
 
  location @wordpress {
    fastcgi_index index.php;
    fastcgi_split_path_info ^(.+\.php)(.*)$;
    fastcgi_pass unix:/run/php-fpm/php-fpm.sock;
    fastcgi_param SCRIPT_FILENAME  { wordpress ドキュメントルート }/index.php;
    include fastcgi_params;
  }
 
  include /etc/nginx/default.d/*.conf;
}

systemctl restart php-fpm
systemctl restart nginx

$ sudo /usr/local/src/certbot/certbot-auto renew --post-hook "sudo service nginx restart"
 
Saving debug log to /var/log/letsencrypt/letsencrypt.log
 
-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/{ ドメイン名 }.conf
-------------------------------------------------------------------------------
Cert not yet due for renewal
 
The following certs are not due for renewal yet:
  /etc/letsencrypt/live/{ ドメイン名 }/fullchain.pem (skipped)
No renewals were attempted.
No hooks were run.

$ sudo su
$ vim /etc/cron.d/letsencrypt

0 3 1 * * root /usr/local/src/certbot/certbot-auto renew --post-hook "sudo service nginx restart"