Certbot: Kuisa Ngatinyorei Chitupa

Muchinyorwa chino, tichaongorora maitiro ekuisa nekugadzirisa Certbot paLinux server. Tichatsanangura zvakadzama kuti ungawana sei chitupa cheLet's Encrypt SSL/TLS chedomain yako. Tichatsanangurawo maitiro ekuchiisa pawebhu server (senge Nginx kana Apache) uye kugadzirisa otomatiki certification renovations kuti uve nechokwadi chekuti kubatana kwakachengeteka kunoramba kuripo newebhu resource yako.

Certbot chishandiso chemahara, chakavhurika-sosi chakagadzirirwa kutenga nekudzoreredza otomatiki zvitupa zveSSL/TLS . Chinoita basa rakakosha mukuchengetedza kubatana pakati peseva nemutengi, ichidzivirira data kubva pakuwanikwa kusina mvumo. Certbot inoita kuti kuiswa nekugadziriswa kwezvitupa zveSSL kuve nyore. Hazvingobatsiri chete kuchengetedza, asi zvinowedzerawo kuvimba kwevashandisi muwebhusaiti yako, nokudaro zvichivandudza mukurumbira wesaiti pamwe nerankings yayo yekutsvaga.

Kuisa Certbot

Certbot inosanganisirwa muzvizhinji zvekugovera nedefault, saka kuti uiise pane masisitimu eDebian/Ubuntu , unongoda kugadzirisa runyorwa rwemapakeji:

apt update

Zvadaro, tanga kuisa maitiro:

apt install certbot

Certbot inotsigira plugins inofambisa kuseta uye kumisikidzwa kwechitupa chewebhu server. Kuisa plugins idzi, shandisa murairo unoenderana:

apt install certbot python3-certbot-nginx # for Nginx
apt install certbot python3-certbot-apache # for Apache

Maitiro ekuisa maRed Hat systems (akadai seRHEL , CentOS , Fedora ) akasiyana zvishoma. Pakutanga, unofanira kuwedzera EPEL repository:

yum install epel-release

Wobva waisa chishandiso:

yum install certbot

Saizvozvo, pane sarudzo yekusarudza plugin kune chaiyo webhu server:

yum install python3-certbot-nginx # for Nginx
yum install python3-certbot-apache # for Apache

Mushure mekuisa, unogona kuenderera mberi nekutora chitupa.

Kuwana SSL Chitupa

Muchikamu chino, tichakurukura maitiro ekutora chitupa zvakazvimiririra kune chaiyo webhu server, zvichiteverwa nekutsanangura maitiro ekuisa chitupa cheNginx neApache. Nekudaro, zvakakosha kutanga kuti unzwisise syntax uye kushanda kwechirongwa. Zvinoratidzika sezvizvi:

certbot command option -d domain

Mirairo mikuru inosanganisira:

certbot certonly - Inotora chitupa asi hachiisi.
certbot certificates -Murairo uyu unoratidza runyorwa rwezvitupa zvese zvakaiswa.
certbot renew - Inowedzera chitupa chiripo.
certbot revoke - Inobvisa chitupa chiripo.
certbot delete - Inodzima chitupa chiripo.

Sarudzo dzinonyanya kushandiswa ndeidzi:

--nginx -Inoshandisa Nginx kumisikidzwa zvinyorwa zvedomendi verification.
--apache -Inoshandisa maApache kumisikidzwa zvinyorwa zvedomendi verification.
-d - Rondedzero yemadomasi inokumbirwa chitupa.
--standalone - Inoshandisa standalone modhi yekusimbisa domain.
--manual -Inoita manual domain verification.

Uyu ungori muenzaniso wemirairo inowanzoitika uye sarudzo. Iwe unogona kuzvijaira iwe neiyo yakazara runyorwa rwezvirongwa zvechirongwa muchikamu chekubatsira:

certbot –help

Tava kuenderera mberi nekutora chitupa. Semuenzaniso, tichawana chitupa che sevha yepamhepo yedhomaini yechitatu-level isina muripo senge yourusername.pserver.space.

Kutanga, iwe unofanirwa kuisa murairo:

certbot certonly

Mukupindura, chishandiso chinokukumbira kuti usarudze nzira yekusimbisa muridzi wedomasi:

Sarudzo yekutanga yakanakira kana iwe usina yakagadziriswa webhu server kana iwe usingade kuita shanduko kune iripo. Iyi nzira inogadzira yenguva pfupi sevha yewebhu kusimbisa kodzero yako kune iyo domain. Iyo yakanaka kune nyore uye nekukurumidza setup. Pakusarudza nzira iyi, zvakakosha kuchengetedza port 80 pasina.

Yechipiri sarudzo inodiwa kana uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchinge uchi , uye iwe uchida kuishandisa kuratidza iyo kodzero kune iyo domain . Certbot inoisa akakosha mafaera mufolda pane yako sevha, ayo anozotariswa nenzvimbo yekusimbisa.

Isu tinosarudza sarudzo yekutanga uye tinya inotevera. Panguva ino, unofanira:

1. Isa email address;
2. Bvumiranai nemitemo yebasa;
3. Bvumirana kana kuramba kugamuchira maemail pachinzvimbo chekambani nevabatsiri vayo;
4. Taura zita renzvimbo inopihwa chitupa.

Mushure mekupedza chirongwa chekuburitsa chitupa neCertbot chishandiso, chinoratidza nzira inoenda kudhairekitori kunochengeterwa chitupa chakapihwa uye data reakaundi yako:

Chasara ndechekuti iwe ubatanidze chitupa chakawanikwa kune sevhisi inodiwa.

Kuisa Chitupa cheNginx kana Apache

Ichi chikamu chinofungidzira kuti mamwe mamiriro akakosha akazadzikiswa:

1. Iwe wakatoisa uye nekugadzirisa webhu server, ingave Nginx kana Apache. Inofanirwa kuwanikwa kubva pawebhusaiti kuburikidza nezita rezita rauri kuda kutora chitupa;
2. Panguva yekuiswa kwechishandiso, wakaisawo plugin yeNginx kana Apache uchishandisa murairo wakakodzera;
3. Mafirewall anobvumira kubatanidza pazviteshi 80 uye 443. Kana zviteshi izvi zvakavharwa kune zvinongedzo, sevhisi inenge isipo pazvikochekedzo zvinopinda. Kuti uwane rumwe ruzivo nezve firewall operation, takakurukura izvi muchinyorwa pamusoro kumisikidza firewall paLinux.

Kana mamiriro ese agutsikana, unogona kuenderera wakananga kupihwa setifiketi. Isu tichafunga nezve maitiro ekutora SSL chitupa pane server uchishandisa Nginx semuenzaniso. Nekudaro, kana uri kushandisa Apache web server, maitiro acho akafanana zvachose.

Kuti uwane chitupa, unofanirwa kuisa murairo:

certbot --nginx # for Nginx
certbot --apache # for Apache

Mukupindura, chishandiso chinokumbira: kero yeemail, mvumo kumitemo yekushandiswa kweRega Encrypt sevhisi, uye mvumo yekutumira maemail pachinzvimbo chesevhisi nevamwe vayo.

Mushure meizvozvo, uchafanirwa kudoma zita redhomaini rakapihwa chitupa. Certbot inogona kuona otomatiki dhomaini kana yakadoma mu server_name field yeNginx configuration kana ServerName uye ServerAlias ​​yeApache . Kana isina kudoma, chirongwa ichi chichakuzivisa uye chichakukumbira kuti uise zita redhomaini nemaoko . Zvadaro, utility ichabvunza kana ichibvumira kudzoreredzwa kwezvikumbiro kubva kuHTTP kuenda kuHTTPS protocol. Kuti ugadzire kudzoreredzwa otomatiki, unofanirwa kusarudza sarudzo yechipiri:

Mushure menguva yakati, Certbot inokuzivisa iwe nezve yakabudirira kutora kwechitupa cheiyo dura rakataurwa. Kubva panguva ino zvichienda mberi, zvese zvinongedzo zvinongedzo zvinodzoserwa kubva pachiteshi 80 kusvika 443. Chishandiso chicharatidza madhairekitori maunogona kuwana ese echitupa data uye Let's Encrypt account account:

Iyo meseji ichatsanangurawo nguva yechokwadi yechitupa chakawanikwa uye yakakosha sarudzo dzekutonga ese anoshanda zvitupa:

1. certonly. Iyi sarudzo inoshandiswa kutora kana kugadzirisa chitupa pasina otomatiki web server kumisikidza. Certbot inongokumbira kana kugadzirisa chitupa asi haizoite chero otomatiki shanduko kune server kumisikidzwa. Kare, takashandisa sarudzo iyi kuwana chitupa pasina kusungirirwa kune web server.
2. kuvandudza inoshandiswa pakuvandudza otomatiki kwese zvitupa zvakawanikwa kuburikidza neCertbot uye zviri mukati menguva yavo yechokwadi. Chirongwa chinotarisa zvitupa zvese, uye kana chimwe chazvo chikapera mukati memazuva makumi matatu kana pasi, chinozoitwa kuvandudzwa.

Tevere mumirayiridzo, tichakurukura maitiro ekumisikidza otomatiki kuvandudzwa kwezvitupa pasina kupindira kwemushandisi mwedzi mitatu yega yega.

Otomatiki Chitupa Kuvandudza muCertbot

YeDebian/Ubuntu

Paunenge uchishandisa aya masisitimu anoshanda, Certbot inongowedzera script kune yebasa runyorwa rwekuvandudza otomatiki kwezvitupa zvakaiswa. Unogona kutarisa kushanda kwescript nemurairo unotevera:

systemctl status certbot.timer

Mhinduro yacho icharatidza mamiriro ebasa racho, pamwe nedhairekitori rine faira rekugadzirisa. Unogona kuvhura izvi uchishandisa chero text editor. Kana usina ruzivo rwekugadzirisa text muLinux, tinokurudzira kuti uzive nezvemhinduro dzatinoshandisa zvakanyanya kufarirwa. Muchiitiko ichi, tichashandisa nano:

nano /lib/systemd/system/certbot.timer

Ese akakosha ma parameter anoratidzwa:

1. Purogiramu inoratidza kuti sevhisi ichaitwa kaviri pazuva na 00:00 na12:00;
2. Chechipiri kukosha kunoratidza kunonoka kusingaite mumasekonzi ayo anozowedzerwa kune iyo nguva yekutanga. Muchiitiko ichi, ndeye 43,200 seconds (12 maawa), izvo zvinoita kuti kutanga kuwedzere uye kuparadzira mutoro;
3. Iyi parameter inovimbisa kuti kana timer yaifanirwa kuitwa panguva yekuvharwa kwehurongwa, inozoitwa nekukasira pakatanga.

Iwe unogona zvakare kumhanyisa cheki yekumanikidzwa yekuvandudzwa kwechitupa nemurairo:

certbot renew --dry-run

Uchishandisa uyu murairo, zvitupa hazvizogadziriswe. Pane kudaro, chishandiso chichaita zviito zvakafanana nekuwana chitupa pakupera kwayo. Nenzira iyi, unogona kuve nechokwadi chekushanda kwesevhisi maererano nekuvandudza otomatiki.

YeCentOS, Fedora, nevamwe

Maitiro ekugonesa otomatiki magadzirirwo ehurongwa hwemhuri yeRed Hat akasiyana zvishoma. Kusiyana neDebian/Ubuntu, kune CentOS nedzimwe system, unofanirwa kuwedzera basa nemaoko kune scheduler. Kuti tiite izvi, tichashandisa cron tool:

crontab -e

Zvadaro, mufaira rinovhura, wedzera mutsara unotevera:

0 12 * * * /usr/bin/certbot renew --quiet

Ngatiburitsei nharo huru dzemurairo:

1. Nguva yekuuraya. Muchiitiko ichi, murairo unozotanga kushanda na12: 00 zuva rega rega;
2. Murairo wekuvandudza SSL/TLS zvitupa uchishandisa Certbot;
3. The --nyarara mureza unodzvanya zvinobuda, zvichiita kuti maitiro acho awedzere kuvanzika uye asanyanya kupindira muhurongwa matanda kana kuratidza.

Mushure mekuwedzera murairo, unoda kuchengetedza shanduko mufaira.

Sezvakangoita neDebian/Ubuntu, unogona zvakare kutanga cheki yekumanikidzwa yekuvandudzwa kwechitupa:

certbot renew --dry-run

Mhedzisiro yekubudirira kwekuita kwemirairo inotaridzika seizvi:

mhedziso

Isu takaongorora iyo yakazara maitiro ekuisa uye kugadzirisa Certbot pane Linux server. Nekutevera mirairo yakapihwa, unogona kubudirira kuwana chitupa cheSSL/TLS kubva kuLet Encrypt, chiise pawebhu server yako, uye gadzirisa otomatiki kuvandudzwa kuti uve nechokwadi chekuchengetedzwa kunoenderera uye kuwedzera kuvimba mune yako webhu sosi. NeCertbot, unogona nyore kugadzira yakavimbika uye yakachengeteka nharaunda yevashandisi.