前回は、SSL証明書の有効期限が切れた際の対処方法を書いたが、今回は、期限切れを起こさないようにする対策を書きます。
おすすめ記事
まずは、更新のテストをする方法
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 | # certbot renew --dry-run Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/www.maruweb.jp.net.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Attempting to parse the version 0.32.0 renewal configuration file found at /etc/letsencrypt/renewal/www.maruweb.jp.net.conf with version 0.31.0 of Certbot. This might not work. Cert not due for renewal, but simulating renewal for dry run Plugins selected: Authenticator standalone, Installer None Starting new HTTPS connection (1): acme-staging-v02.api.letsencrypt.org Renewing an existing certificate Performing the following challenges: http-01 challenge for www.maruweb.jp.net Waiting for verification... Cleaning up challenges Resetting dropped connection: acme-staging-v02.api.letsencrypt.org - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - new certificate deployed without reload, fullchain is /etc/letsencrypt/live/www.maruweb.jp.net/fullchain.pem - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ** DRY RUN: simulating 'certbot renew' close to cert expiry ** (The test certificates below have not been saved.) Congratulations, all renewals succeeded. The following certs have been renewed: /etc/letsencrypt/live/www.maruweb.jp.net/fullchain.pem (success) ** DRY RUN: simulating 'certbot renew' close to cert expiry ** (The test certificates above have not been saved.) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
1行目：オプションの–dry-runを付けることでSSL証明書更新のテストができます。
27行目：成功しました。
30行目：テストなので実際の更新（保存）は行われません。と、あります。
オプションの–dry-runを付けずに実行すると更新されます。
ただし、有効期限が30日以内でないと更新されないようです。
有効期限までの30日制限に関係なく即時更新したい場合
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 | # certbot renew --force-renew Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/www.maruweb.jp.net.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Attempting to parse the version 0.32.0 renewal configuration file found at /etc/letsencrypt/renewal/www.maruweb.jp.net.conf with version 0.31.0 of Certbot. This might not work. Plugins selected: Authenticator standalone, Installer None Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org Renewing an existing certificate Resetting dropped connection: acme-v02.api.letsencrypt.org - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - new certificate deployed without reload, fullchain is /etc/letsencrypt/live/www.maruweb.jp.net/fullchain.pem - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations, all renewals succeeded. The following certs have been renewed: /etc/letsencrypt/live/www.maruweb.jp.net/fullchain.pem (success) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
1行目：即時更新したい場合は、オプションに–force-renewを付けます。
20行目：成功しました。
有効期限の確認
1 2 3 4 5 6 7 8 9 10 11 | # certbot certificates Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Found the following certs: Certificate Name: www.maruweb.jp.net Domains: www.maruweb.jp.net Expiry Date: 2019-07-12 13:32:59+00:00 (VALID: 89 days) Certificate Path: /etc/letsencrypt/live/www.maruweb.jp.net/fullchain.pem Private Key Path: /etc/letsencrypt/live/www.maruweb.jp.net/privkey.pem - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
8行目：有効期限が2019/7/12までで、残り日数が89日となりました。
証明書を更新後にはWebサーバの設定ファイルを再読み込みする必要があります。
1 | # systemctl reload httpd.service |
自動更新設定
とりあえず、cronに設定しているもので更新されるかどうか様子見します。
恐らく、前回のOSエラー（pipのエラー？）が原因なのではと推測…
cronに設定しているサーバ証明書自動更新設定はリンク先のスクリプトを使用させてもらっています。
関連記事:
