وب سرور آپاچی با گواهی رایگان Let’s Encrypt روی CentOS 8

1sudo yum install mod_ssl

1git clone https://github.com/Neilpang/acme.sh.git

1mkdir -p /var/www/html/.well-known/acme-challenge/

1acme.sh --issue -w /DocumentRootPath/ -d your-domain

1vi /etc/httpd/conf.d/ssl.conf

1sudo firewall-cmd --add-service=https

1sudo yum update

1$ sudo yum install mod_ssl

1$ sudo yum install wget curl bc git socat

1Last metadata expiration check: 0:06:51 ago on Wednesday 02 October 2019 05:49:51 PM UTC.2Package wget-1.19.5-7.el8_0.1.x86_64 is already installed.3Package curl-7.61.1-8.el8.x86_64 is already installed.4Dependencies resolved.5=========================================================================================6 Package                  Arch           Version                 Repository         Size7=========================================================================================8Installing:9 git                      x86_64         2.18.1-3.el8            AppStream         186 k10 socat                    x86_64         1.7.3.2-6.el8           AppStream         298 k11 bc                       x86_64         1.07.1-5.el8            BaseOS            129 k12Installing dependencies:13 git-core                 x86_64         2.18.1-3.el8            AppStream         4.1 M14 git-core-doc             noarch         2.18.1-3.el8            AppStream         2.3 M15 perl-Error               noarch         1:0.17025-2.el8         AppStream          46 k16 perl-Git                 noarch         2.18.1-3.el8            AppStream          77 k17 perl-TermReadKey         x86_64         2.37-7.el8              AppStream          40 k18 emacs-filesystem         noarch         1:26.1-5.el8            BaseOS             69 k19 20Transaction Summary21=========================================================================================22Install  9 Packages23 24Total download size: 7.1 M25Installed size: 38 M26Is this ok [y/N]: y

1$ cd /tmp/2$ git clone https://github.com/Neilpang/acme.sh.git

1$ cd acme.sh/2$ sudo -i3# cd acme.sh/4# ./acme.sh --install

1$ sudo source ~/.bashrc

1# acme.sh --version

1https://github.com/Neilpang/acme.sh2v2.8.3

1# D=/var/www/html/2# mkdir -vp ${D}/.well-known/acme-challenge/3###---[ NOTE: Adjust permission as per your setup ]---###4# chown -R apache:apache ${D}/.well-known/acme-challenge/5# chmod -R 0555 ${D}/.well-known/acme-challenge/

1# mkdir -p /etc/httpd/ssl/cyberciti.biz/

1# cd /etc/httpd/ssl/cyberciti.biz/2# openssl dhparam -out dhparams.pem -dsaparam 4096

1$ sudo systemctl status httpd.service2$ sudo systemctl enable httpd.service3$ sudo systemctl start httpd.service4$ sudo systemctl status httpd.service

1$ sudo firewall-cmd --permanent --add-service=http --zone=public2$ sudo firewall-cmd --reload3$ sudo firewall-cmd --list-services --zone=public

1# acme.sh --issue -w /path/to/www/htmlRoot/ -d your-domain-example-com -k 20482# acme.sh --issue -w /path/to/www/htmlRoot/ -d www.cyberciti.biz -k 40963# acme.sh --issue -w /var/www/html/ -d centos8.cyberciti.biz -k 4096

1$ sudo vi /etc/httpd/conf.d/ssl.conf

1### Start config for port 443 #2Listen 443 https3SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog4SSLSessionCache         shmcb:/run/httpd/sslcache(512000)5SSLSessionCacheTimeout  3006SSLCryptoDevice builtin7 8### Turn on HTTP2 support #9Protocols h2 http/1.110 11### Redirect all http urls to https #12RewriteEngine On13RewriteCond %{HTTPS} off14RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=302,L,QSA]15#################################################16# SSL/TLS config for domain centos8.cyberciti.biz #17#################################################18<VirtualHost centos8.cyberciti.biz:443>19 20        ### Log files  #21        ErrorLog logs/ssl_error_log22        TransferLog logs/ssl_access_log23        LogLevel warn24        SSLEngine on25 26        ### No more SSL3/2 #27        SSLProtocol             all -SSLv328        SSLHonorCipherOrder on29        SSLCompression          off30        SSLSessionTickets       off31        SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS32 33        ### Path to certs #34        SSLCertificateFile      /etc/httpd/ssl/cyberciti.biz/centos8.cyberciti.biz.cer35        SSLCertificateKeyFile   /etc/httpd/ssl/cyberciti.biz/centos8.cyberciti.biz.key36 37        #Forward Secrecy & Diffie Hellman ephemeral parameters38        SSLOpenSSLConfCmd DHParameters "/etc/httpd/ssl/cyberciti.biz/dhparams.pem"39 40        # HSTS (mod_headers is required) (15768000 seconds = 6 months)41        Header always set Strict-Transport-Security "max-age=15768000"42        <FilesMatch "\.(cgi|shtml|phtml|php)$">43            SSLOptions +StdEnvVars44        </FilesMatch>45        <Directory "/var/www/cgi-bin">46                SSLOptions +StdEnvVars47        </Directory>48        BrowserMatch "MSIE [2-5]" \49         nokeepalive ssl-unclean-shutdown \50         downgrade-1.0 force-response-1.051         CustomLog logs/ssl_request_log \52          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"53</VirtualHost>54 55### OCSP stapling config56SSLUseStapling          on57SSLStaplingResponderTimeout 558SSLStaplingReturnResponderErrors off59SSLStaplingCache        shmcb:/var/run/ocsp(128000)

1SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.12SSLHonorCipherOrder off3SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

1# acme.sh --installcert -d centos8.cyberciti.biz \2--keypath /etc/httpd/ssl/cyberciti.biz/centos8.cyberciti.biz.key \3--fullchainpath /etc/httpd/ssl/cyberciti.biz/centos8.cyberciti.biz.cer \4--reloadcmd 'systemctl reload httpd'

1$ sudo firewall-cmd --permanent --add-service=https --zone=public2$ sudo firewall-cmd --reload3$ sudo firewall-cmd --list-services --zone=public

1$ sudo ss -tulpn2$ sudo ss -tulpn | egrep ':(80|443)'

1tcp  LISTEN  0  128  *:443   *:*  users:(("httpd",pid=12079,fd=9),("httpd",pid=12078,fd=9),("httpd",pid=12077,fd=9),("httpd",pid=10782,fd=9))2tcp  LISTEN  0  128  *:80    *:*  users:(("httpd",pid=12079,fd=4),("httpd",pid=12078,fd=4),("httpd",pid=12077,fd=4),("httpd",pid=10782,fd=4))

1sudo vi /var/www/html/index.html

1<html>2     <head>3    	<title>CentOS8 Apache test server - nixCraft</title>4     </head>5     <body>6	<h2>Hello, world!</h2>7	<p>8		I run on CentOS Linux 8. I act as a testbed for nixCraft test lab.9		I exist to help sysadmins and developers to help learn CentOS 8.10	</p>11	<hr>12	<small>Apache 2 server running on CentOS 8 with Let's Encrypt</small>13     </body>	14</html>

1# acme.sh --list

1# acme.sh --renew -d server2.ariaservice.net

1# crontab -l

138 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

1# acme.sh --upgrade

1# acme.sh --help | more