🔐Ubuntu 20.04 da Let's Encrypt yordamida Apache-ni qanday himoyalash mumkin

// Qo'llanma //

Kirish

Let's Encrypt - bu bepul TLS/SSL sertifikatlarini olish va o'rnatishni osonlashtiradigan va shu bilan veb-serverlarda shifrlangan HTTPS-ni yoqadigan sertifikat organi (CA). Bu talab qilinadigan qadamlarning ko'pini (agar hammasi bo'lmasa ham) avtomatlashtirishga harakat qiladigan Certbot dasturiy mijozini taqdim etish orqali jarayonni soddalashtiradi. Hozirgi vaqtda sertifikat olish va o'rnatishning butun jarayoni ham Apache, ham Nginx-da to'liq avtomatlashtirilgan.

Ushbu qo'llanmada biz Ubuntu 20.04 da Apache uchun bepul SSL sertifikatini olish uchun Certbot -dan foydalanamiz va bu sertifikat avtomatik ravishda yangilanadigan qilib sozlanganligiga ishonch hosil qilamiz.

Ushbu qo'llanmada Let's Encrypt tomonidan himoyalanadigan veb-saytni sozlash uchun Apache standart konfiguratsiya fayli o'rniga alohida virtual xost faylidan foydalaniladi. Serverda joylashgan har bir domen uchun yangi Apache virtual xost fayllarini yaratishni tavsiya qilamiz , chunki bu keng tarqalgan xatolardan qochishga yordam beradi va standart konfiguratsiya fayllarini zaxira o'rnatish sifatida saqlaydi.

Shartlar

Ushbu qo'llanmani bajarish uchun sizga kerak bo'ladi:

Bitta Ubuntu 20.04 serveri Ubuntu 20.04 oʻquv qoʻllanmasi uchun ushbu dastlabki server sozlamalariga rioya qilish orqali oʻrnatildi , jumladan sudo root boʻlmagan foydalanuvchi va xavfsizlik devori.
To'liq ro'yxatdan o'tgan domen nomi. Ushbu qoʻllanmada sizning_domeningizdan namuna sifatida foydalaniladi. Siz Namecheap -da domen nomini sotib olishingiz, Freenom -da bepul olishingiz yoki o'zingiz tanlagan domen registratoridan foydalanishingiz mumkin.
Quyidagi ikkala DNS yozuvlari serveringiz uchun o'rnatilgan. Siz ularni qanday qo'shish haqida batafsil ma'lumot olish uchun DigitalOcean DNS-ga kirishni kuzatishingiz mumkin.
- your_domainServeringizning umumiy IP manziliga ishora qiluvchi A yozuvi .
- Serveringizning umumiy IP manziliga ishora qiluvchi A yozuvi .www.your_domain
Apache Ubuntu 20.04-da Apache-ni qanday o'rnatish bo'yicha quyidagi orqali o'rnatildi . Domeningiz uchun virtual xost fayli mavjudligiga ishonch hosil qiling. Ushbu qo'llanma misol sifatida ishlatiladi./etc/apache2/sites-available/your_domain.conf

1-qadam - Certbotni o'rnatish

Let's Encrypt bilan SSL sertifikatini olish uchun avvalo serveringizga Certbot dasturini o'rnatishimiz kerak bo'ladi. Buning uchun standart Ubuntu paketi omborlaridan foydalanamiz.

Bizga ikkita paket kerak: certbot, va python3-certbot-apache. Ikkinchisi Certbot-ni Apache bilan birlashtirgan plagin bo'lib, bitta buyruq bilan sertifikat olishni va veb-serveringizda HTTPS-ni sozlashni avtomatlashtirish imkonini beradi.

$ sudo apt install certbot python3-certbot-apache

O'rnatishni tasdiqlash so'raladi Y, keyin ni bosing ENTER.

Certbot endi serveringizga o'rnatildi. Keyingi bosqichda virtual xostingiz toʻgʻri oʻrnatilganligiga ishonch hosil qilish uchun Apache konfiguratsiyasini tekshiramiz. Bu certbotmijoz skripti sizning domenlaringizni aniqlay olishini va yangi yaratilgan SSL sertifikatingizdan avtomatik ravishda foydalanish uchun veb-serveringizni qayta sozlashini ta'minlaydi.

2-qadam - Apache virtual xost konfiguratsiyasini tekshirish

Veb-serveringiz uchun SSL-ni avtomatik ravishda olish va sozlash imkoniyatiga ega bo'lish uchun Certbot sizning Apache konfiguratsiya fayllaringiz ichida to'g'ri virtual xostni topishi kerak. Sizning server domen nomingiz(lar) ingiz konfiguratsiya blokida belgilangan ServerNameva direktivalaridan olinadi.ServerAliasVirtualHost

Agar siz Apache oʻrnatish boʻyicha qoʻllanmada virtual xostni oʻrnatish bosqichiga amal qilgan boʻlsangiz, domeningiz uchun VirtualHost blokiga ega boʻlishingiz va tegishli ravishda oʻrnatilgan koʻrsatmalarga ega boʻlishingiz kerak./etc/apache2/sites-available/your_domain.confServerNameServerAlias

Buni tekshirish uchun domeningiz uchun virtual xost faylini nanoyoki siz tanlagan matn muharriri yordamida oching:

$ sudo nano /etc/apache2/sites-available/your_domain.conf

ServerNameMavjud va ServerAliasqatorlarni toping . Ular shunday ko'rinishi kerak:

...
ServerName your_domain
ServerAlias www.your_domain
...

Agar sizda allaqachon mavjud bo'lsa ServerNameva ServerAliasshunday sozlangan bo'lsa, matn muharriridan chiqib, keyingi bosqichga o'tishingiz mumkin. dan foydalanayotgan bo'lsangiz , tasdiqlash uchun , keyin va nanotugmalarini terish orqali chiqishingiz mumkin .CTRL+XYENTER

Agar joriy virtual xost konfiguratsiyasi misolga mos kelmasa, uni mos ravishda yangilang. Ishingiz tugagach, faylni saqlang va tahrirlovchidan chiqing. Keyin o'zgarishlarni tasdiqlash uchun quyidagi buyruqni bajaring:

$ sudo apache2ctl configtest

Syntax OKJavob sifatida siz javob olishingiz kerak . Xatoga duch kelsangiz, virtual xost faylini qayta oching va matn terish xatosi yoki etishmayotgan belgilarni tekshiring. Konfiguratsiya faylingiz sintaksisi to'g'ri bo'lsa, o'zgarishlar kuchga kirishi uchun Apache-ni qayta yuklang:

$ sudo systemctl reload apache2

Ushbu o'zgarishlar bilan Certbot to'g'ri VirtualHost blokini topishi va uni yangilashi mumkin bo'ladi.

Keyinchalik, HTTPS trafigiga ruxsat berish uchun xavfsizlik devorini yangilaymiz.

3-qadam - Xavfsizlik devori orqali HTTPS-ga ruxsat berish

Agar sizda UFW xavfsizlik devori yoqilgan bo'lsa, zarur qo'llanmalar tavsiya qilganidek, HTTPS trafikiga ruxsat berish uchun sozlamalarni o'zgartirishingiz kerak bo'ladi. O'rnatishdan so'ng, Apache bir nechta turli UFW dastur profillarini ro'yxatdan o'tkazadi. Biz serveringizda HTTP va HTTPS trafigiga ruxsat berish uchun Apache Full profilidan foydalanishimiz mumkin.

Hozirda serveringizda qanday trafikka ruxsat berilganligini tekshirish uchun siz quyidagilarni foydalanishingiz mumkin:

$ sudo ufw status

Agar siz Apache oʻrnatish qoʻllanmalarimizdan biriga amal qilgan boʻlsangiz, chiqishingiz shunday koʻrinishi kerak, yaʼni 80hozirda portda faqat HTTP trafigiga ruxsat berilgan:

OutputStatus: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere                  
Apache                     ALLOW       Anywhere             
OpenSSH (v6)               ALLOW       Anywhere (v6)             
Apache (v6)                ALLOW       Anywhere (v6)

HTTPS trafigiga qoʻshimcha ruxsat berish uchun “Apache Full” profiliga ruxsat bering va ortiqcha “Apache” profilini oʻchiring:

$ sudo ufw allow 'Apache Full'
$ sudo ufw delete allow 'Apache'

Sizning holatingiz endi shunday ko'rinadi:

$ sudo ufw status

OutputStatus: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere                  
Apache Full                ALLOW       Anywhere                  
OpenSSH (v6)               ALLOW       Anywhere (v6)             
Apache Full (v6)           ALLOW       Anywhere (v6)

Endi siz Certbotni ishga tushirishga va sertifikatlaringizni olishga tayyorsiz.

4-qadam - SSL sertifikatini olish

Certbot plaginlar orqali SSL sertifikatlarini olishning turli usullarini taqdim etadi. Apache plagini Apache-ni qayta sozlash va kerak bo'lganda konfiguratsiyani qayta yuklash bilan shug'ullanadi. Ushbu plagindan foydalanish uchun quyidagilarni kiriting:

$ sudo certbot --apache

Ushbu skript sizni SSL sertifikatingizni sozlash uchun bir qator savollarga javob berishni taklif qiladi. Birinchidan, u sizdan to'g'ri elektron pochta manzilini so'raydi. Bu e-pochta yangilash bildirishnomalari va xavfsizlik bildirishnomalari uchun ishlatiladi:

OutputSaving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): you@your_domain

Yaroqli elektron pochta manzilini kiritganingizdan so'ng ENTER, keyingi bosqichga o'tish uchun bosing. Shundan so‘ng sizdan Let's Encrypt xizmat shartlariga roziligingizni tasdiqlash so‘raladi. Siz tugmani bosib tasdiqlashingiz mumkin Ava keyin ENTER:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A

Keyin sizdan yangiliklar va boshqa maʼlumotlarni olish uchun elektron pochtangizni Electronic Frontier Foundation bilan baham koʻrishni xohlaysizmi, deb soʻraladi. Agar ularning mazmuniga obuna bo'lishni xohlamasangiz, yozing N. Aks holda, yozing Y. Keyin, ENTERkeyingi bosqichga o'tish uchun bosing.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N

Keyingi qadam sizdan Certbot-ga HTTPS-ni qaysi domenlar uchun faollashtirmoqchi ekanligingizni bildirishingizni taklif qiladi. ServerNameRo'yxatda keltirilgan domen nomlari avtomatik ravishda Apache virtual xost konfiguratsiyasidan olinadi, shuning uchun virtual xostingizda to'g'ri va ServerAliassozlamalar sozlanganligiga ishonch hosil qilish muhimdir . Agar roʻyxatdagi barcha domen nomlari uchun HTTPS-ni yoqmoqchi boʻlsangiz (tavsiya etiladi), soʻrovni boʻsh qoldirib, ENTERdavom etish uchun bosing. Aks holda, vergul va/yoki boʻshliqlar bilan ajratilgan har bir tegishli raqamni roʻyxatlash orqali HTTPS-ni yoqmoqchi boʻlgan domenlarni tanlang, soʻng tugmasini bosing ENTER.

Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: your_domain
2: www.your_domain
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):

Siz shunday chiqishni ko'rasiz:

Obtaining a new certificate
Performing the following challenges:
http-01 challenge for your_domain
http-01 challenge for www.your_domain
Enabled Apache rewrite module
Waiting for verification...
Cleaning up challenges
Created an SSL vhost at /etc/apache2/sites-available/your_domain-le-ssl.conf
Enabled Apache socache_shmcb module
Enabled Apache ssl module
Deploying Certificate to VirtualHost /etc/apache2/sites-available/your_domain-le-ssl.conf
Enabling available site: /etc/apache2/sites-available/your_domain-le-ssl.conf
Deploying Certificate to VirtualHost /etc/apache2/sites-available/your_domain-le-ssl.conf

Keyinchalik, sizdan HTTP trafigini HTTPSga yo'naltirishni xohlaysizmi yoki yo'qligini tanlashingiz so'raladi. Amalda, bu shuni anglatadiki, kimdir shifrlanmagan kanallar (HTTP) orqali veb-saytingizga tashrif buyursa, ular avtomatik ravishda veb-saytingizning HTTPS manziliga yo'naltiriladi. 2Qayta yo'naltirishni yoqishni tanlang yoki 1HTTP va HTTPS-ni veb-saytingizga kirishning alohida usullari sifatida saqlamoqchi bo'lsangiz.

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

Ushbu bosqichdan so'ng, Certbot konfiguratsiyasi tugallanadi va sizga yangi sertifikatingiz, yaratilgan fayllarni qayerda joylashtirish va sertifikatingizning haqiqiyligini tahlil qiluvchi tashqi vosita yordamida konfiguratsiyangizni qanday tekshirish haqida yakuniy izohlar taqdim etiladi:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://your_domain and
https://www.your_domain

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=your_domain
https://www.ssllabs.com/ssltest/analyze.html?d=www.your_domain
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/your_domain/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/your_domain/privkey.pem
   Your cert will expire on 2020-07-27. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

Sizning sertifikatingiz endi o'rnatildi va Apache konfiguratsiyasiga yuklandi. https://Brauzeringiz xavfsizlik indikatoridan foydalanib veb-saytingizni qayta yuklashga harakat qiling . Shuni ta'kidlash kerakki, sizning saytingiz to'g'ri himoyalangan, odatda manzil satriga qulf belgisini qo'shish orqali.

Sertifikat bahosini tekshirish va tashqi xizmat nuqtai nazaridan u haqida batafsil ma'lumot olish uchun SSL Labs Server Testidan foydalanishingiz mumkin .

Keyingi va oxirgi bosqichda biz Certbot-ning avtomatik yangilanish xususiyatini sinab ko'ramiz, bu sizning sertifikatingiz amal qilish muddati tugagunga qadar avtomatik ravishda yangilanishini kafolatlaydi.

5-qadam — Certbotning avtomatik yangilanishini tekshirish

Let's Encrypt sertifikatlari faqat to'qson kun davomida amal qiladi. Bu foydalanuvchilarni sertifikatni yangilash jarayonini avtomatlashtirishga undash, shuningdek, noto‘g‘ri foydalanilgan sertifikatlar yoki o‘g‘irlangan kalitlarning muddati tezroq tugashini ta’minlash uchundir.

Biz certboto'rnatgan paket yangilanish skriptini qo'shish orqali yangilanishlar bilan shug'ullanadi, bu xizmat /etc/cron.dtomonidan boshqariladi . Ushbu skript kuniga ikki marta ishlaydi va muddati tugaganidan keyin o'ttiz kun ichida bo'lgan har qanday sertifikat avtomatik ravishda yangilanadi.systemctlcertbot.timer

Ushbu xizmatning holatini tekshirish va uning faol va ishlayotganligiga ishonch hosil qilish uchun siz quyidagilarni foydalanishingiz mumkin:

$ sudo systemctl status certbot.timer

Siz shunga o'xshash natijani olasiz:

Output● certbot.timer - Run certbot twice daily
     Loaded: loaded (/lib/systemd/system/certbot.timer; enabled; vendor preset: enabled)
     Active: active (waiting) since Tue 2020-04-28 17:57:48 UTC; 17h ago
    Trigger: Wed 2020-04-29 23:50:31 UTC; 12h left
   Triggers: ● certbot.service

Apr 28 17:57:48 fine-turtle systemd[1]: Started Run certbot twice daily.

Yangilash jarayonini sinab ko'rish uchun siz quyidagi bilan quruq ishga tushirishingiz mumkin certbot:

$ sudo certbot renew --dry-run

Hech qanday xato ko'rmasangiz, hamma narsa tayyor. Zarur bo'lganda, Certbot sertifikatlaringizni yangilaydi va o'zgarishlarni qabul qilish uchun Apache-ni qayta yuklaydi. Agar avtomatik yangilash jarayoni muvaffaqiyatsiz tugasa, Let's Encrypt siz ko'rsatgan elektron pochta manziliga sertifikatning amal qilish muddati tugashi haqida ogohlantiruvchi xabar yuboradi.

Xulosa

Ushbu qo'llanmada siz Let's Encrypt mijozini certboto'rnatdingiz, domeningiz uchun SSL sertifikatini sozladingiz va o'rnatdingiz hamda Certbotning avtomatik yangilash xizmati ichida faol ekanligini tasdiqladingiz systemctl. Certbot-dan foydalanish bo'yicha qo'shimcha savollaringiz bo'lsa, ularning hujjatlari boshlash uchun yaxshi joy.

PreviousUbuntu 20.04 da Linux, Apache, MySQL, PHP (LAMP) stekini qanday o'rnatish kerak NextLinux nima

Last updated 2 years ago

OutputStatus: active To Action From -- ------ ---- OpenSSH ALLOW Anywhere Apache ALLOW Anywhere OpenSSH (v6) ALLOW Anywhere (v6) Apache (v6) ALLOW Anywhere (v6)

OutputStatus: active To Action From -- ------ ---- OpenSSH ALLOW Anywhere Apache Full ALLOW Anywhere OpenSSH (v6) ALLOW Anywhere (v6) Apache Full (v6) ALLOW Anywhere (v6)

OutputSaving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): you@your_domain

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must agree in order to register with the ACME server at https://acme-v02.api.letsencrypt.org/directory - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (A)gree/(C)ancel: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Would you be willing to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: N

Which names would you like to activate HTTPS for? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: your_domain 2: www.your_domain - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate numbers separated by commas and/or spaces, or leave input blank to select all options shown (Enter 'c' to cancel):

Obtaining a new certificate Performing the following challenges: http-01 challenge for your_domain http-01 challenge for www.your_domain Enabled Apache rewrite module Waiting for verification... Cleaning up challenges Created an SSL vhost at /etc/apache2/sites-available/your_domain-le-ssl.conf Enabled Apache socache_shmcb module Enabled Apache ssl module Deploying Certificate to VirtualHost /etc/apache2/sites-available/your_domain-le-ssl.conf Enabling available site: /etc/apache2/sites-available/your_domain-le-ssl.conf Deploying Certificate to VirtualHost /etc/apache2/sites-available/your_domain-le-ssl.conf

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations! You have successfully enabled https://your_domain and https://www.your_domain You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=your_domain https://www.ssllabs.com/ssltest/analyze.html?d=www.your_domain - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/your_domain/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/your_domain/privkey.pem Your cert will expire on 2020-07-27. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal. - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le

Output● certbot.timer - Run certbot twice daily Loaded: loaded (/lib/systemd/system/certbot.timer; enabled; vendor preset: enabled) Active: active (waiting) since Tue 2020-04-28 17:57:48 UTC; 17h ago Trigger: Wed 2020-04-29 23:50:31 UTC; 12h left Triggers: ● certbot.service Apr 28 17:57:48 fine-turtle systemd[1]: Started Run certbot twice daily.