Différences entre les versions de « Letsencrypt »
| Ligne 54 : | Ligne 54 : | ||
SSLOptions +StrictRequire | SSLOptions +StrictRequire | ||
</pre> | </pre> | ||
[[category:linux]] | [[category:linux]] | ||
Version du 30 juin 2020 à 01:17
Dans /opt/letsencrypt/
./certbot-auto certonly --webroot --webroot-path /home/letsencrypt/ --domain nomdomaine.fr --domain www.nomdomaine.fr --email qqn@qqch.fr
Dans /home/letsencrypt/
créer les répertoires .well-known/acme-challenge
Dans le vhost port 80
Alias /.well-known "/home/letsencrypt/.well-known" <Directory "/home/letsencrypt/.well-known"> Options Indexes MultiViews AllowOverride None Require all granted </Directory>
Dans le vhost port 443
SSLEngine on SSLCertificateFile /etc/letsencrypt/live/nomdomaine.fr/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/nomdomaine.fr/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf
Dans le .htaccess
# Rediriger HTTP vers HTTPS et gérer www en même temps
# 2 redirections en 1 seul coup pour éviter les chaînes de redirections.
# sauf le répertoire acme-challenge
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteCond %{REQUEST_URI} !/acme-challenge/(.*)$
RewriteRule ^.*$ https://www.%1%{REQUEST_URI} [L,NE,R=301]
/etc/letsencrypt/options-ssl-apache.conf
# This file contains important security parameters. If you modify this file # manually, Certbot will be unable to automatically provide future security # updates. Instead, Certbot will print and log an error message with a path to # the up-to-date file that you will need to refer to when manually updating # this file. SSLEngine on # Intermediate configuration, tweak to your needs SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS SSLHonorCipherOrder on SSLCompression off SSLOptions +StrictRequire