CentOS8+Apache2.4(SSL)+PHP7.4 環境構築手順
目次
事前準備
CentOS8.1環境構築
SSH+rootへ昇格
sudo -i
wget
python38
インストール (Let's encrypt用のツールcerbot
を利用するために必要)
dnf -y install wget python38
- 好みに合わせてインストール
dnf -y install mlocate vim
構築手順
- Apacheインストール
dnf -y install httpd mod_ssl
systemctl start httpd
- PHP7.4(現時点の最新版)
dnf install https://rpms.remirepo.net/enterprise/remi-release-8.rpm dnf -y module install php:remi-7.4 php -v # --> PHP 7.4.9 が出力
dnf -y module install php74-php
- Let's Encrypt用ツール
cerbot
をインストール
cd /tmp wget https://dl.eff.org/certbot-auto mv certbot-auto /usr/local/bin/certbot-auto chown root /usr/local/bin/certbot-auto chmod 0755 /usr/local/bin/certbot-auto
- サーバ証明書作成
/usr/local/bin/certbot-auto certonly --webroot -w /var/www/html -d kzyosimo.example.com --email info@example.com ... Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator webroot, Installer None - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must agree in order to register with the ACME server at https://acme-v02.api.letsencrypt.org/directory - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (A)gree/(C)ancel: A ... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must agree in order to register with the ACME server at https://acme-v02.api.letsencrypt.org/directory - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (A)gree/(C)ancel: A - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Would you be willing, once your first certificate is successfully issued, to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: Y Obtaining a new certificate Performing the following challenges: http-01 challenge for kzyosimo.example.com Using the webroot path /var/www/html for all unmatched domains. Waiting for verification... Cleaning up challenges Subscribe to the EFF mailing list (email: kzyosimo@example.com). IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/kzyosimo.example.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/kzyosimo.example.com/privkey.pem Your cert will expire on 2020-11-13. To obtain a new or tweaked version of this certificate in the future, simply run certbot-auto again. To non-interactively renew *all* of your certificates, run "certbot-auto renew" - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal. - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
- サーバ証明書の確認
ls -1d /etc/letsencrypt/live/kzyosimo.example.com/* #--> /etc/letsencrypt/live/kzyosimo.example.com/README #--> /etc/letsencrypt/live/kzyosimo.example.com/cert.pem #--> /etc/letsencrypt/live/kzyosimo.example.com/chain.pem #--> /etc/letsencrypt/live/kzyosimo.example.com/fullchain.pem #--> /etc/letsencrypt/live/kzyosimo.example.com/privkey.pem
- サーバ証明書を適用
vim /etc/httpd/conf.d/ssl.conf -- SSLCertificateFile /etc/letsencrypt/live/kzyosimo.example.com/cert.pem SSLCertificateKeyFile /etc/letsencrypt/live/kzyosimo.example.com/privkey.pem SSLCertificateChainFile /etc/letsencrypt/live/kzyosimo.example.com/chain.pem ---
- サーバ証明書の更新設定追加(毎月1日3時に更新)
# Let’s Encrypt で発行した証明書は、有効期限が3ヶ月です。 00 3 1 * * /usr/local/bin/certbot-auto renew -q --deploy-hook "systemctl restart httpd"
- preforkを有効化
vim /etc/httpd/conf.modules.d/00-mpm.conf --- # 以下をコメントイン LoadModule mpm_prefork_module modules/mod_mpm_prefork.so # 以下をコメントアウト #LoadModule mpm_event_module modules/mod_mpm_event.so ---
- Apacheの再起動
systemctl restart httpd