HTTP2にしたりいろいろと楽しめそうなので、チェック！！！

ただ本番Webサーバでやるのは気が引けるということで、
他のサーバで証明書を作ってあげることが出来ないかやってみました。

OS・・・ Ubuntu14.04
（Redhat/CentOSの6系はEPLEを入れておいてください）

参考URL
Let’s Encrypt　User Guide
Let’s Encrypt の使い方

さてやってみよう！

$ apt-get install git
$ git clone https://github.com/letsencrypt/letsencrypt
Cloning into 'letsencrypt'...
remote: Counting objects: 25304, done.
remote: Compressing objects: 100% (4/4), done.
remote: Total 25304 (delta 0), reused 0 (delta 0), pack-reused 25300
Receiving objects: 100% (25304/25304), 6.66 MiB | 830.00 KiB/s, done.
Resolving deltas: 100% (17732/17732), done.
Checking connectivity... done.
$ cd letsencrypt/
$ ls
CHANGES.rst         letsencrypt-auto
CONTRIBUTING.md     letsencrypt-compatibility-test
Dockerfile          letsencrypt-nginx
Dockerfile-dev      letshelp-letsencrypt
LICENSE.txt         linter_plugin.py
MANIFEST.in         pep8.travis.sh
README.rst          py26reqs.txt
Vagrantfile         readthedocs.org.requirements.txt
acme                setup.cfg
bootstrap           setup.py
docker-compose.yml  tests
docs                tools
examples            tox.cover.sh
letsencrypt         tox.ini
letsencrypt-apache

たぶん、ApacheとかNginxは
「letsencrypt-apache」「letsencrypt-nginx」
一発で行くような気がしますｗ

さて、インストールですが、いろいろと依存関係で
最初はapt-get installが走るようです。

$ ./letsencrypt-auto

依存関係ツリーを作成しています
状態情報を読み取っています... 完了
python はすでに最新版です。
python は手動でインストールしたと設定されました。
ca-certificates はすでに最新版です。
git はすでに最新版です。
以下の特別パッケージがインストールされます:
  augeas-lenses binutils cpp cpp-4.8 gcc-4.8 libasan0 libatomic1 libc-dev-bin
  libc6-dev libcloog-isl4 libexpat1-dev libgcc-4.8-dev libgmp10 libgomp1
  libisl10 libitm1 libmpc3 libmpfr4 libpython-dev libpython2.7
  libpython2.7-dev libquadmath0 libtsan0 linux-libc-dev python-pkg-resources
  python-setuptools python2.7-dev zlib1g-dev
提案パッケージ:
  augeas-doc binutils-doc cpp-doc gcc-4.8-locales gcc-multilib make
  manpages-dev autoconf automake1.9 libtool flex bison gdb gcc-doc
  gcc-4.8-multilib gcc-4.8-doc libgcc1-dbg libgomp1-dbg libitm1-dbg
  libatomic1-dbg libasan0-dbg libtsan0-dbg libquadmath0-dbg augeas-tools
  glibc-doc python-distribute python-distribute-doc
推奨パッケージ:
  libssl-doc python-pip
以下のパッケージが新たにインストールされます:
  augeas-lenses binutils cpp cpp-4.8 dialog gcc gcc-4.8 libasan0 libatomic1
  libaugeas0 libc-dev-bin libc6-dev libcloog-isl4 libexpat1-dev libffi-dev
  libgcc-4.8-dev libgmp10 libgomp1 libisl10 libitm1 libmpc3 libmpfr4
  libpython-dev libpython2.7 libpython2.7-dev libquadmath0 libssl-dev libtsan0
  linux-libc-dev python-dev python-pkg-resources python-setuptools
  python-virtualenv python2.7-dev zlib1g-dev

OSは最小構成でいれているので結構多いです。

Creating virtual environment...
Updating letsencrypt and virtual environment dependencies...../home/neko6/.local/share/letsencrypt/local/lib/python2.7/site-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
./home/neko6/.local/share/letsencrypt/local/lib/python2.7/site-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
.
Running with virtualenv: sudo /home/neko6/.local/share/letsencrypt/bin/letsencrypt --help

  letsencrypt [SUBCOMMAND] [options] [-d domain] [-d domain] ...

The Let's Encrypt agent can obtain and install HTTPS/TLS/SSL certificates.  By
default, it will attempt to use a webserver both for obtaining and installing
the cert. Major SUBCOMMANDS are:

  (default) run        Obtain & install a cert in your current webserver
  certonly             Obtain cert, but do not install it (aka "auth")
  install              Install a previously obtained cert in a server
  revoke               Revoke a previously obtained certificate
  rollback             Rollback server configuration changes made during install
  config_changes       Show changes made to server config during installation
  plugins              Display information about installed plugins

Choice of server plugins for obtaining and installing cert:

  --apache          Use the Apache plugin for authentication & installation
  --standalone      Run a standalone webserver for authentication
  (nginx support is experimental, buggy, and not installed by default)
  --webroot         Place files in a server's webroot folder for authentication

OR use different plugins to obtain (authenticate) the cert and then install it:

  --authenticator standalone --installer apache

More detailed help:

  -h, --help [topic]    print this message, or detailed help on a topic;
                        the available topics are:

   all, automation, paths, security, testing, or any of the subcommands or
   plugins (certonly, install, nginx, apache, standalone, webroot, etc)

うまくインストールは出来た。
ヘルプを良く見ましょうｗ

さて、「manual」というプラグインが使えると思うので見てみる。

$ ./letsencrypt-auto plugins
Updating letsencrypt and virtual environment dependencies.......
Running with virtualenv: sudo /home/neko6/.local/share/letsencrypt/bin/letsencrypt plugins
* apache
Description: Apache Web Server - Alpha
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: apache = letsencrypt_apache.configurator:ApacheConfigurator

* webroot
Description: Webroot Authenticator
Interfaces: IAuthenticator, IPlugin
Entry point: webroot = letsencrypt.plugins.webroot:Authenticator

* standalone
Description: Automatically use a temporary webserver
Interfaces: IAuthenticator, IPlugin
Entry point: standalone = letsencrypt.plugins.standalone:Authenticator

あれ？manualがない？
うーんわからん。。。

ディレクトリを見てみる。

$ ls ./letsencrypt/plugins/
__init__.py  common_test.py  disco_test.py  manual_test.py  null_test.py   standalone_test.py  util_test.py  webroot_test.py
common.py    disco.py        manual.py      null.py         standalone.py  util.py             webroot.py

こっちには「manual.py」がある。。。

まぁやってみようか。
オプションは「certonly –manual」としました。

$ ./letsencrypt-auto certonly --manual

Enter email address (used for urgent notices and lost key recovery)

Eメールアドレスを入れましょう！！


Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf.
You must agree in order to register with the ACME server at
https://acme-staging.api.letsencrypt.org/directory

利用規約を読みましょう！！

Please enter in your domain name(s) (comma and/or space separated)

ドメインを入れましょう！！！（僕はwww.neko6.infoだけにしました）


NOTE: The IP of this machine willbe public logged as having requested this certificate.If you're running letsencrypt in manual mode on a machine that is not your server, please ensure you're okay with taht.

Are you OK with your IP being logged?

そのドメインが正しいかはWebサーバ、80ポートで確認してくるようです。


Make sure your web server displays the following content at
http://www.neko6.info/.well-known/acme-challenge/hagehoge_respons_code_txt before continuing:

HOGEGAGE_RESPONS_CODE

If you don't have HTTP server configured, you can run the following
command on the target server (as root):

mkdir -p /tmp/letsencrypt/public_html/.well-known/acme-challenge
cd /tmp/letsencrypt/public_html
printf "%s" HOGEGAGE_RESPONS_CODE > .well-known/acme-challenge/hagehoge_respons_code_txt
# run only once per server:
$(command -v python2 || command -v python2.7 || command -v python2.6) -c \
"import BaseHTTPServer, SimpleHTTPServer; \
s = BaseHTTPServer.HTTPServer(('', 80), SimpleHTTPServer.SimpleHTTPRequestHandler); \
s.serve_forever()"
Press ENTER to continue

ということで、一旦ここまで。

本来なら、
Pythonの簡易Webサーバを使って外部からアクセスさせて証明書を作るのでしょう。

ここで、注目は
Webサーバのルート/.well-known/acme-challenge/hagehoge_respons_code_txt
にレスポンスコード「HOGEGAGE_RESPONS_CODE」が書かれたテキストを外部から見に来る
ということです。
これだけ分かればあとは簡単。

ここから本番Webサーバ

$ mkdir -p public_html/.well-known/acme-challenge
$ printf "%s" HOGEGAGE_RESPONS_CODE > .well-known/acme-challenge/hagehoge_respons_code_txt
$ cat .well-known/acme-challenge/hagehoge_respons_code_txt
HOGEGAGE_RESPONS_CODE

ということで本番Webサーバにレスポンスコードが書かれたものを作ってしまいます。

で、再度letsencryptを動かしているほうへ移動し、
「Press ENTER to continue」してやると、本番Webサーバへアクセスしにきます。

121.111.135.33 - - [08/Dec/2015:12:46:27 +0900] "GET /.well-known/acme-challenge/hagehoge_respons_code_txt HTTP/1.1" 200 9604 "-" "python-requests/2.8.1"
66.133.109.36 - - [08/Dec/2015:12:46:44 +0900] "GET /.well-known/acme-challenge/hagehoge_respons_code_txt HTTP/1.1" 200 9604 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"

時間がかかってしまうと、その都度レスポンスコードとアクセスするテキストファイル名が変わるので注意。

で、上手くいくと

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/www.neko6.info/fullchain.pem. Your cert will
   expire on 2016-03-07. To obtain a new version of the certificate in
   the future, simply run Let's Encrypt again.
 - If like Let's Encrypt, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

出来た！！
期限が「90日」みたい。

出来上がった証明書を見てみよう

$ sudo su
# ls /etc/letsencrypt/live/www.neko6.info/
cert.pem  chain.pem  fullchain.pem  privkey.pem

あとは、これらを本番Webサーバに移動してあげて設定すればOK！！

[tegaki]楽しい[/tegaki]