Let's Encryptでサーバ証明書を取得 on Debian 9

Let’s Encryptのサーバ証明書を取得し,メールサーバのTLS接続を可能にする.

Let’s Encrypt フリーで自動化されたオープンな認証局:
https://letsencrypt.org/ja/

実施環境:

  • Debian 9.12 (Stretch)

Certbotのインストール

Let’s Encryptを利用し,サーバ証明書を取得するためのプログラム certbot をインストールする

1
% sudo apt-get install certbot

作業としては,これだけ

証明書の取得

「スタンドアロン方式」という方法でCertbotによる証明書の取得を試みる

事前に準備すべきもの

  1. サーバのホスト名 (FQDNで)
  2. メールアドレス
    緊急・セキュリティ通知をLet’s Encryptから受け取るためのもの

で,certbotを実行する

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
$ sudo certbot certonly --standalone -d <FQDN of your mail server>
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): admin@example.com (緊急やセキュリティん通知を受けるメールアドレスを入力)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for xxx.yyy.zzz
Cleaning up challenges
Problem binding to port 80: Could not bind to IPv4 or IPv6.

IMPORTANT NOTES:
- Your account credentials have been saved in your Certbot
configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Certbot so
making regular backups of this folder is ideal.

ん,失敗してる?
Problem binding to port 80: Could not bind to IPv4 or IPv6.

Webサーバ(Apache)を停止するのを忘れてた.なのでPort 80がふさがっていて処理失敗.なので,まずApache(Web server)を止める

1
% sudo systemctl stop apache2

で,やり直し.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
% sudo certbot certonly --standalone -d <FQDN of your mail server> -m <your email address>
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for xxx.yyy.zzz
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/xxx.yyy.zzz/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/xxx.yyy.zzz/privkey.pem
Your cert will expire on 2020-06-12. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

無事に取得できたようだ.取得できたサーバ証明書や秘密鍵ファイル群が格納される /etc/letsencrypt/live ディレクトリ配下を確認.
(なおweb serverは,忘れずに起動しなおしておく.)

1
2
3
4
5
6
7
8
9
% sudo find /etc/letsencrypt/live
live
live/README
live/<FQDN of your server>
live/<FQDN of your server>/README
live/<FQDN of your server>/chain.pem
live/<FQDN of your server>/cert.pem
live/<FQDN of your server>/fullchain.pem
live/<FQDN of your server>/privkey.pem

メールサーバの1実装であるpostfixでsmtpsを有効化するときには,秘密鍵ファイルとして privkey.pem を,サーバ証明書として fullchain.pemを指定する.
設定方法の子細は,他のWebを参照のこと(笑)

参考Webページ:
  1. How to secure Postfix using Let’s Encrypt
    https://upcloud.com/community/tutorials/secure-postfix-using-lets-encrypt/
  2. Debian 9.5 Let’s Encrypt Postfix Dovecot インストール
    https://bellett.moe.hm/index.php/2018/10/11/debian-9-5-install-lets-encrypt-postfix-dovecot/#Let8217s_Encrypt
  3. debian で無料のSSL/TLS証明書(Let’s Encrypt) を使う
    http://pyopyopyo.hatenablog.com/entry/20170906/p1
  4. Let’s encrypt + Postfix で SMTP-Auth over SSL なメールサーバ構築 (Debian 9 Stretch)
    https://kuratsuki.net/2018/09/lets-encrypt-postfix-%E3%81%A7-smtp-auth-over-ssl-%E3%81%AA%E3%83%A1%E3%83%BC%E3%83%AB%E3%82%B5%E3%83%BC%E3%83%90%E6%A7%8B%E7%AF%89-debian-9-stretch/
  5. Let’s Encryptを使ったセキュアなメールサーバの構築(Cent OS7 + Postfix + Dovecot)
    https://qiita.com/inductor/items/f6b05aa43bc11df28928
  6. postfix の starttls 通信を TLSv1.3 に対応させる
    https://qiita.com/ma3ki/items/3e40775e74bad58a06f3

証明書の更新自動化

以下のコマンドを実行すれば,証明書を自動更新できる

1
% sudo certbot renew 

上の参考Webページ 2) を見ると,以下の状態になっていれば,メッセージにも書かれている通り定期的(1日2回?)に上記のコマンドが実行されるよう設定されているとのこと.

1
2
3
4
% systemctl | grep certbot
certbot.timer
loaded active waiting Run certbot twice daily
# 上のメッセージ,実際には一行で書かれているが,見にくいので改行している

動作ログは,/var/log/letsencrypt/letsencrypt.log にある.ちょっと覗いてみたところ,7時と15時に動作しているようである.

追記:

3ヶ月後に確認してみたら,どうやら意図通りに証明書の更新処理は動いていなかったことが発覚.証明書の有効期限が切れたとの知らせが入ったためである.なのでセオリー通り手作業で証明書の更新を行ってみる

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
$ sudo certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/xxx.yyy.zzz.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator standalone, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for xxx.yyy.zzz
Cleaning up challenges
Attempting to renew cert (xxx.yyy.zzz) from /etc/letsencrypt/renewal/xxx.yyy.zzz.conf produced an unexpected error: Problem binding to port 80: Could not bind to IPv4 or IPv6.. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/xxx.yyy.zzz/fullchain.pem (failure)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/xxx.yyy.zzz/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)

ということで,証明書取得時と同じ失敗を繰り返していることに気づく
Problem binding to port 80: Could not bind to IPv4 or IPv6.. Skipping.

これは証明書を更新しようとしている計算機でWebサーバが動作している都合で,Port 80番はすでに使われていることから,更新処理のために80番ポートが使えなかった.というエラーである.なので,更新処理の間だけWebサーバを停止する(停止して困るようなコンテンツはないWebサーバなのでOK).

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
% sudo certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/xxx.yyy.zzz.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator standalone, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for xxx.yyy.zzz
Waiting for verification...
Cleaning up challenges

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/xxx.yyy.zzz/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/xxx.yyy.zzz/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

ということで,無事に証明書の更新は終了した.Webサーバも起動し直して対応作業はおしまい.Webサーバも動作している計算機での証明書であれば,letsencryptの更新処理は standaloneモードではなく,webrootモードで動作するようにした方が良いが,それはまた後回しにしておく.

— ends here

Let's Encryptでサーバ証明書を取得 on Debian 9

http://the.netaro.info/2020/03/14/2020-0314_letsEncryptSetup/

Author

T.T

Posted on

2020-03-14

Updated on

2020-12-12

Licensed under