Certbot証明書発行・更新コマンドとNginx設定(Let’s Encrypt)

mkdir /var/www/html/letsencrypt
chown nginx:nginx /var/www/html/letsencrypt

vi /etc/nginx/conf.d/default.conf

server {
    listen       80
    listen       [::]:80;

    # ここから追加
    location ^~ /.well-known/acme-challenge/ {
        root     /var/www/html/letsencrypt;
    }
    location =  /.well-known/acme-challenge/ {
        return   404;
    }
    # ここまで追加

    location / {
        return   301 https://$host$request_uri;
    }
}
~以下略~

certbot-auto certonly --webroot --webroot-path /var/www/html/letsencrypt -d www.mulong.me

vi /etc/nginx/conf.d/default.conf

server {
    listen       80
    listen       [::]:80;

    ~省略~
}

server {
    listen       443 ssl http2;
    listen       [::]:443 ssl http2;

    server_name  www.mulong.me;

    # ここから追加
    ssl_certificate     "/etc/letsencrypt/live/www.mulong.me/fullchain.pem";
    ssl_certificate_key "/etc/letsencrypt/live/www.mulong.me/privkey.pem";
    # ここまで追加

    ~省略~
}
~省略~

certbot-auto renew --deploy-hook "systemctl reload nginx"

crontab -l > ~/.crontab-editlog.bk
crontab -e

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin
PYTHONIOENCODING='utf-8'

0 0,12 * * * python3 -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot-auto renew --deploy-hook "systemctl reload nginx"

less /var/log/cron