nginx + certbot 自動設定の時の確認

自動設定できないというかcertbotで入力が必要なので。

nginxの configにsslのドメイン部分があればすべてコメントアウトしておく

  #ssl_certificate     /etc/letsen.../fullchain.pem;
  #ssl_certificate_key /etc/letsen.../privkey.pem;

などキーの指定はコメントアウトしている状態（まだファイルは生成していない。

この状態で、certbot実行

$ sudo certbot certonly --nginx --no-bootstrap
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: grg.grtlab.com
2: www.grg.grtlab.com
3: lobby.grtlab.com
4: www.lobby.grtlab.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1
Requesting a certificate for grg.grtlab.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/grg.grtlab.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/grg.grtlab.com/privkey.pem
This certificate expires on 2023-10-10.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

grg.grtlab.comだけ生成。

ドメイン+IPaddressがネームサーバーに設定されていないと利用できない。

ssl部分のコメントを外して nginx再起動

sudo systemctl restart nginx
でなぜか プロセスが消えないので手動でkillしました。

↓正常に動作した状態、と違う master processが残っていました。

1538838 ?        Ss     0:00 nginx: master process /usr/sbin/nginx
1538839 ?        S      0:00 nginx: worker process
1538840 ?        S      0:00 nginx: cache manager process

$ sudo systemctl status nginx
● nginx.service - The nginx HTTP and reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vendor preset: disabled)
    Drop-In: /usr/lib/systemd/system/nginx.service.d
             └─php-fpm.conf
     Active: active (running) since Wed 2023-07-12 07:27:11 UTC; 4min 40s ago
    Process: 1538835 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited, status=0/SUCCESS)
    Process: 1538836 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
    Process: 1538837 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCESS)
   Main PID: 1538838 (nginx)
      Tasks: 3 (limit: 4455)
     Memory: 4.1M
        CPU: 72ms
     CGroup: /system.slice/nginx.service
             ├─1538838 "nginx: master process /usr/sbin/nginx"
             ├─1538839 "nginx: worker process"
             └─1538840 "nginx: cache manager process"

 7月 12 07:27:11 i-14100000403049 systemd[1]: Starting The nginx HTTP and reverse proxy server...
 7月 12 07:27:11 i-14100000403049 nginx[1538836]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
 7月 12 07:27:11 i-14100000403049 nginx[1538836]: nginx: configuration file /etc/nginx/nginx.conf test is successful
 7月 12 07:27:11 i-14100000403049 systemd[1]: Started The nginx HTTP and reverse proxy server.

OKです^^

certbotの自動更新

rootのcronに入れています。
/usr/bin/certbot renew –no-random-sleep-on-renew >> /tmp/certbot.log 2>&1

The following certificates are not due for renewal yet:
  /etc/letsencrypt/live/grg.grtlab.com/fullchain.pem expires on 2023-10-10 (skipped)
  /etc/letsencrypt/live/lobby.grtlab.com/fullchain.pem expires on 2023-08-13 (skipped)
No renewals were attempted.

こんな感じで、確認できます！