documentation/infra/letsencrypt.md

Let's encrypt

Installation

Installer les paquets :

apt-get install dehydrated dehydrated-apache2

Recharger Apache :

systemctl reload apache2.service

S'enregistrer :

/usr/bin/dehydrated --register --accept-terms

Générer un certificat

Ouvrir les ports http (80) et https (443) :

ufw allow '80'
ufw allow '443'

Configurer a minima le site web dans /etc/apache2/sites-available/foo.libre-service.org.conf :

<VirtualHost *:80>
        ServerName foo.libre-service.eu
        ServerAdmin admin@libre-service.eu

        CustomLog ${APACHE_LOG_DIR}/foo.libre-service.eu/infos.libre-service.eu-access.log combined
        ErrorLog  ${APACHE_LOG_DIR}/foo.libre-service.eu/infos.libre-service.eu-error.log
        LogLevel warn

        Redirect 302 / https://foo.libre-service.eu/
</VirtualHost>

Activer la configuration :

a2ensite foo.libre-service.eu.conf

Vérifier que c'est bon et recharger :

apachectl configtest && systemctl reload apache2

Vérifier le logrotate des logs :

/var/log/apache2/*.log
/var/log/apache2/*/*log
{
    monthly
    missingok
    rotate 6
…

Ajouter foo.libre-service.eu dans /etc/dehydrated/domains.txt.

Lancer la génération :

/usr/bin/dehydrated -c

Le certificat est généré dans /var/lib/dehydrated/certs/foo.libre-service.eu/.

Compléter la partie SSL /etc/apache2/sites-enabled/foo.libre-service.org.conf :

<VirtualHost *:443>
        ServerName pad.libre-service.eu
        ServerAdmin admin@libre-service.eu

        CustomLog ${APACHE_LOG_DIR}/pad.libre-service.eu/pad.libre-service.eu-access.log combined
        ErrorLog  ${APACHE_LOG_DIR}/pad.libre-service.eu/pad.libre-service.eu-error.log
        LogLevel warn

        SSLEngine On
        SSLCertificateFile /var/lib/dehydrated/certs/pad.libre-service.eu/fullchain.pem
        SSLCertificateKeyFile /var/lib/dehydrated/certs/pad.libre-service.eu/privkey.pem

        #Include hsts.conf
        #Include statoolinfos.conf
                                                                        
        DocumentRoot /var/www/pad.libre-service.eu
        #php_admin_value open_basedir "/var/www/pad.libre-service.eu/"
        <Directory "/var/www//pad.libre-service.eu/">
                Options FollowSymLinks
                AllowOverride None
                Require all granted
                DirectoryIndex index.xhtml
        </Directory>
</VirtualHost>

Activer le module SSL :

apachectl configtest && systemctl reload apache2

Vérifier que c'est bon et recharger :

apachectl configtest && systemctl reload apache2

Renouvellement automatique

Ajouter un script cron dans /etc/cron.weekly/dehydrated :

#!/bin/bash

/usr/bin/dehydrated -c
systemctl reload apache2.service

Et lui donner les bonnes permissions :

chmod a+rx /etc/cron.weekly/dehydrated