#################
centos 5.x 버젼이하인 서버에서
curl https://get.acme.sh | sh -s email=youid@email.com
를 실행 했을때, curl 문제로 acme.sh 설치가 안되는경우
#################
openssl version -a
curl --version
openssl 버젼이 0.9.8인경우 (1.1.1이상이 아닌경우) 설치방법
wget https://www.openssl.org/source/openssl-1.1.1b.tar.gz
tar xvfz openssl-1.1.1b.tar.gz
cd openssl-1.1.1b
./config --prefix=/usr/local/openssl shared zlib
make
make install
echo "/usr/local/openssl/lib" >> /etc/ld.so.conf.d/openssl.conf
ldconfig
mv /usr/bin/openssl /usr/bin/openssl.old
ln -s /usr/local/openssl/bin/openssl /usr/bin/
openssl version
--- openssl TLSv1.3 지원체크
openssl ciphers -v | grep TLSv1.3
/usr/local/openssl/bin/openssl version
curl 컴파일서치 ## (wget이 안되면 rz 또는 다른서버에서 복사)
wget https://curl.se/download/curl-7.61.1.tar.gz
tar xzf curl-7.61.1.tar.gz
cd curl-7.61.1
./configure --prefix=/usr/local/curl --with-ssl=/usr/local/openssl --without-libidn --disable-ldap --disable-ldaps CPPFLAGS="-I/usr/local/openssl/include" LDFLAGS="-L/usr/local/openssl/lib -Wl,-rpath,/usr/local/openssl/lib"
make
make install
ls -l /usr/local/curl/bin/curl
/usr/local/curl/bin/curl --version
mkdir -p /usr/local/openssl/ssl
/usr/local/curl/bin/curl -k -L https://curl.se/ca/cacert.pem -o /usr/local/openssl/ssl/cacert.pem
export PATH=/usr/local/curl/bin:$PATH
export CURL_CA_BUNDLE=/usr/local/openssl/ssl/cacert.pem
#################
curl 문제없는 경우 여기부터 진행
#################
acme.sh 설치
curl https://get.acme.sh | sh -s email=youid@email.com
source ~/.bashrc
acme.sh --version
기본 CA를 Let's Encrypt로 변경
acme.sh --set-default-ca --server letsencrypt
인증서발급 (-d 도메인 -w 웹폴더 형식)
acme.sh --issue -d vod.misoidc.com -w /usr/share/nginx/html
cd /root/.acme.sh/vod.misoidc.com_ecc
아파치인경우
acme.sh --install-cert -d www.newvpn.co.kr
--cert-file /home/www2/ssl/www.newvpn.co.kr.cer
--key-file /home/www2/ssl/www.newvpn.co.kr.key
--fullchain-file /home/www2/ssl/www.newvpn.co.kr.fullchain.cer
--reloadcmd "/home/www2/bin/apachectl graceful"
nginx인경우
acme.sh --install-cert -d vod.misoidc.com
--cert-file /etc/nginx/ssl/vod.misoidc.com.cer
--key-file /etc/nginx/ssl/vod.misoidc.com.key
--fullchain-file /etc/nginx/ssl/vod.misoidc.com.fullchain.cer
--reloadcmd "nginx -t && nginx -s reload"
httpd-ssl.conf 에 인증서 파일 경로및 이름변경.
아파치인경우
SSLCertificateFile /home/www2/ssl/www.newvpn.co.kr.cer
SSLCertificateKeyFile /home/www2/ssl/www.newvpn.co.kr.key
SSLCertificateChainFile /home/www2/ssl/www.newvpn.co.kr.fullchain.cer
nginx인경우
ssl_certificate /etc/nginx/ssl/vod.misoidc.com.fullchain.cer;
ssl_certificate_key /etc/nginx/ssl/vod.misoidc.com.key;
아파치 재시작후 인증서 적용 확인.
자동갱신
crontab에 다음과 같이 입력후 저장
31 0,6,12,18 * * * PATH=/usr/local/curl/bin:/usr/local/bin:/usr/bin:/bin CURL_CA_BUNDLE=/usr/local/openssl/ssl/cacert.pem "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" >> /var/log/acme.sh-cron.log 2>&1
curl 컴파일 설치하지 않고 acme.sh 설치가 그냥 잘 되었을 경우에는 (centos 6 이상)
crontab 에 자동등록된 설정으로 자동갱신 하면 됨.
