... | ... | @@ -99,7 +99,9 @@ Wir nutzen `acme_tiny` für Let's Encrypt. Zertifikate sind in `/etc/ssl/letsenc |
|
|
// mehrere Domains in einem Zertikat (www.meinedomain.de, meinedomain.de, foobar.meinedomain.de..)
|
|
|
# openssl req -new -sha256 -key subdomain.bau-ha.us.key \
|
|
|
-subj "/" -reqexts SAN \
|
|
|
-config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:subdomain.bau-ha.us,DNS:www.subdomain.de")) > subdomain.bau-ha.us.csr
|
|
|
-config <(cat /etc/ssl/openssl.cnf } \
|
|
|
<(printf "[SAN]\nsubjectAltName=DNS:subdomain.bau-ha.us,DNS:www.subdomain.de")) \
|
|
|
> subdomain.bau-ha.us.csr
|
|
|
|
|
|
// Challenges Verzeichnis in nginx Konfiguration einbinden
|
|
|
// /etc/nginx/sites-available/subdomain.bau-ha.us
|
... | ... | @@ -117,12 +119,50 @@ server { |
|
|
}
|
|
|
}
|
|
|
|
|
|
// Zertifikat abholen
|
|
|
// Zertifikat von Let's Encrypt unterschreiben lassen.
|
|
|
|
|
|
// Automatisch
|
|
|
|
|
|
# /etc/letsencrypt/ssl/renew.sh subdomain.bau-ha.us
|
|
|
|
|
|
// Manuell
|
|
|
|
|
|
# acme_tiny --account-key ./account.key --csr ./subdomain.bau-ha.us.csr --acme-dir /var/www/challenges/ > ./subdomain.bau-ha.us.crt
|
|
|
|
|
|
// Let's Encrypt Intermediate Zertifikat hinzufügen
|
|
|
# wget -q -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > /tmp/intermediate.pem
|
|
|
# cat subdomain.bau-ha.us.crt /tmp/intermediate.pem > subdomain.bau-ha.us.chained.pem
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
Jetzt kann man die Zertifikate in den nginx Virtualhost einbinden:
|
|
|
|
|
|
``
|
|
|
server {
|
|
|
listen 443 ssl http2;
|
|
|
server_name subdomain.bau-ha.us;
|
|
|
server_tokens off;
|
|
|
|
|
|
ssl on;
|
|
|
|
|
|
# ssl magic
|
|
|
ssl_certificate /etc/ssl/letsencrypt/subdomain.bau-ha.us.chained.pem;
|
|
|
ssl_certificate_key /etc/ssl/letsencrypt/subdomain.bau-ha.us.key;
|
|
|
ssl_stapling on;
|
|
|
ssl_stapling_verify on;
|
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
|
|
|
|
|
|
...
|
|
|
|
|
|
}
|
|
|
|
|
|
Jetzt noch die `crontab` für das monatliche erneuern der Zertifikate:
|
|
|
|
|
|
0 0 1 * * /etc/ssl/letsencrypt/renew.sh kulturtragwerk.de 2>> /var/log/acme_tiny.log
|
|
|
|
|
|
Testen kann man mit `nginx -t` und nginx neustarten mit `nginx -s`.
|
|
|
|
|
|
# Datenbank
|
|
|
|
|
|
## PostgreSQL
|
... | ... | |