Let’s Encrypt SSL証明書の期限切れ対策 certbot を使う

またまたこのサイトのSSL証明書が期限切れになった。

Kusanagi の自動更新ができていない。

それで手動であれこれしてみても、こんなエラーが出る。

＃ kusanagi update cert
Challenge failed for domain makotoiwasaki.com
Challenge failed for domain www.makotoiwasaki.com
Attempting to renew cert (makotoiwasaki.com) from /etc/letsencrypt/renewal/makotoiwasaki.com.conf produced an unexpected error: Some challenges have failed.. Skipping.

  root@:~# kusanagi ssl --email ma＊＊＊@makotoiwasaki.com  
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for makotoiwasaki.com
http-01 challenge for www.makotoiwasaki.com
Using the webroot path /home/kusanagi/www/DocumentRoot for all unmatched domains.
Waiting for verification...
Challenge failed for domain makotoiwasaki.com
Challenge failed for domain www.makotoiwasaki.com
http-01 challenge for makotoiwasaki.com
http-01 challenge for www.makotoiwasaki.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: makotoiwasaki.com
   Type:   connection
   Detail: Fetching
   http://makotoiwasaki.com/.well-known/acme-challenge/J_GSB8st8oqP2A5H15oU5Hk4JfjoZk7jSt4kz3AHw:
   Connection refused

   Domain: www.makotoiwasaki.com
   Type:   connection
   Detail: Fetching
   http://www.makotoiwasaki.com/.well-known/acme-challenge/VQhhUd34A3todPZPSKDbDeKATEKy2MPM3Fv069yd4:
   Connection refused

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.
Cannot get Let\'s Encrypt SSL Certificate files.
失敗しました。

それでこのサイトのように certbot でやってみると簡単にできた。

Let’s Encrypt SSLサーバ証明書有効期限切れで苦戦した。 | おしらべさん.com

www.oshirabesan.com

 

https://www.oshirabesan.com/2017/04/22/ssl-expiered/

なりいきで、/usr/local/certbot  に移動し、

./certbot-auto

でインターアクティブモードで最後まで行ってしまった。新規証明書の発行になる。

どちらかというと、

certbot-auto certonly --standalone -d makotoiwasaki.com

にした方が良かったのかもしれない。

3ヶ月毎の更でつっかえるのがいつも面倒くさい。

短か過ぎる。