GCP > Bitnami > redmineでLet's Encrypt



[Generate and Install a Let's Encrypt SSL Certificate for a Bitnami Application](https://docs.bitnami.com/google/how-to/generate-install-lets-encrypt-ssl/)



redmineのカーネルはDebian 9 (Stretch) 

```
sudo su
```


update

```
apt -y update
```


# Step 1: Install The Lego Client


```shell
cd /tmp
curl -Ls https://api.github.com/repos/xenolf/lego/releases/latest | grep browser_download_url | grep linux_amd64 | cut -d '"' -f 4 | wget -i -
```

ダウンロードされたファイル名を調べて解凍する

```
tar xf lego_vX.Y.Z_linux_amd64.tar.gz
```

legoを移動する

```
sudo mkdir -p /opt/bitnami/letsencrypt
sudo mv lego /opt/bitnami/letsencrypt/lego
```


# Step 2: Generate A Let’s Encrypt Certificate For Your Domain


サービスSTOP

```
sudo /opt/bitnami/ctlscript.sh stop
```


LEGO

```
sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADDRESS" --domains="ドメイン名" --domains="www.ドメイン名" --path="/opt/bitnami/letsencrypt" run
```

実行結果

```
!!!! HEADS UP !!!!
                Your account credentials have been saved in your Let's Encrypt
                configuration directory at "/opt/bantam/letsencrypt/accounts".
                You should make a secure backup of this folder now. This
                configuration directory will also contain certificates and
                private keys obtained from Let's Encrypt so making regular
                backups of this folder is ideal.2020/02/13 12:58:33 [INFO] [sugasaki.net] acme: Obtaining bundled SAN certificate
2020/02/13 12:58:33 [INFO] [ドメイン名] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/2789761459
2020/02/13 12:58:33 [INFO] [ドメイン名] acme: use tls-alpn-01 solver
2020/02/13 12:58:33 [INFO] [ドメイン名] acme: Trying to solve TLS-ALPN-01
2020/02/13 12:58:40 [INFO] [ドメイン名] The server validated our request
2020/02/13 12:58:40 [INFO] [ドメイン名] acme: Validations succeeded; requesting certificates
2020/02/13 12:58:40 [INFO] [ドメイン名] Server responded with a certificate.

```


ファイルが作成されているか確認する

```
ls -ll /opt/bitnami/letsencrypt/certificates/
```



## シンボリックリンクの作成


backup

```
sudo mv /opt/bitnami/apache2/conf/server.crt /opt/bitnami/apache2/conf/server.crt.old
sudo mv /opt/bitnami/apache2/conf/server.key /opt/bitnami/apache2/conf/server.key.old
sudo mv /opt/bitnami/apache2/conf/server.csr /opt/bitnami/apache2/conf/server.csr.old
```




シンボリックリンクの作成

```
sudo ln -sf /opt/bitnami/letsencrypt/certificates/ドメイン名.key /opt/bitnami/apache2/conf/server.key
sudo ln -sf /opt/bitnami/letsencrypt/certificates/ドメイン名.crt /opt/bitnami/apache2/conf/server.crt
```


確認

```
ls -ll /opt/bitnami/apache2/conf/server*
```


権限変更

```
sudo chown root:root /opt/bitnami/apache2/conf/server*
sudo chmod 600 /opt/bitnami/apache2/conf/server*
```



## 起動

```
sudo /opt/bitnami/ctlscript.sh start
```


# Step 3:自動更新


```
vi /opt/bitnami/letsencrypt/scripts/renew-certificate.sh
```



```enew-certificate.sh
#!/bin/bash

sudo /opt/bitnami/ctlscript.sh stop apache
sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADDRESS" --domains="ドメイン名" --path="/opt/bitnami/letsencrypt" renew --days 90
sudo /opt/bitnami/ctlscript.sh start apache
```


* Make the script executable:

```
sudo chmod +x /opt/bitnami/letsencrypt/scripts/renew-certificate.sh
```

* Execute the following command to open the crontab editor:

```
sudo crontab -e
```

以下を追加 (毎月1日の4時00分にスクリプトを実行)


```:crontab
0 4 1 * * /opt/bitnami/letsencrypt/scripts/renew-certificate.sh 2> /dev/null
```



# ログ出力
デフォルト設定ではOFFになっている

`vi /etc/rsyslog.conf`

cronの行を探し、先頭の#を削除

```
#/etc/rsyslog.conf
 ↓
/etc/rsyslog.conf

```

ログの確認は以下で
```
vi /var/log/cron.log
```


## CRONのステータス確認
起動確認は以下
/etc/init.d/cron status



# 参考

[Separate a Single WordPress Multisite Instance into Multiple Independent WordPress Websites/Blogs ](https://docs.bitnami.com/google/how-to/generate-install-lets-encrypt-ssl/)

[Let’s Encrypt の証明書の更新を自動化する手順 \(cron\) \| WEB ARCH LABO](https://weblabo.oscasierra.net/letsencrypt-renew-cron/)

[Generate and Install a Let's Encrypt SSL Certificate for a Bitnami Application](https://docs.bitnami.com/google/how-to/generate-install-lets-encrypt-ssl/)




# 逐次更新方法

自動更新ではなく、毎回実行したい場合は以下

```
/opt/bitnami/ctlscript.sh stop
lego --email=EMAIL@ADDRESS --domains=DOMAIN.com --path="/etc/lego" renew
/opt/bitnami/ctlscript.sh start
```