GOOGLE VM Bagian 3.
Persyaratan untuk membaca artikel ini adalah sudah mengerti step sebelumnya atau anda sudah mengerti langkah setup virtual host
Jika belum, ada di link ini
Memulai Instalasi CERTBOT
Dimulai dengan command
sudo add-apt-repository ppa:certbot/certbot
Kemudian Accept
Install certbot apache dengan command
sudo apt install python-certbot-apache
Jika mengikuti tutorial ini dari aawal maa seharusnya tidak menjadi masalah
Chek
sudo nano /etc/apache2/sites-available/namadomainmu.com.conf
Apakah ada servername namadomainmu.com;
tertera disana?
Jika ada move to next step,
Agar HTTPS dapat melewati firewall maka check konfigurasi UFW (uncomlicated firewall) terlebih dahulu
sudo ufw status
jika masih kosong maka perlu di enable
sudo ufw enable
Perlu diperhatikan jika anda menggunakan koneksi remote ke VPS, konesi bisa putus dan tidak dapat melakukan ssh. Maka segera allow ssh ke UFW dan Apache sekalian
sudo ufw allow openssh
atau sudo ufw allow 'openssh'
sudo ufw allow ‘Apache Full’
kemudian check ufw status
sudo ufw status
harusnya hasilnya seperti ini
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Apache Full ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Apache Full (v6) ALLOW Anywhere (v6)
Mendapatkan Sertifikat SSL Cukup run command
sudo certbot --apache -d example.com -d www.example.com
Akan ada konfirmasi
Output
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel):
Pilih yang sesuai
Kemudian jika sudah selesai maka outputnya
Output
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/example.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/example.com/privkey.pem
Your cert will expire on 2018-07-23. To obtain a new or tweaked
version of this certificate in the future, simply run certbot again
with the "certonly" option. To non-interactively renew *all* of
your certificates, run "certbot renew"
- Your account credentials have been saved in your Certbot
configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Certbot so
making regular backups of this folder is ideal.
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
Renewal
Tutorial ini memakai service lets encrypt yang hanya valid sampai 9 hari. Tetapi cerbot sudah menanamkan renew script ke cron /etc/cron.d
Untuk test script autorenewal commandnya adalah
sudo certbot renew --dry-run
Jika ingin mempunyai sub domain dan domain tersebut ingin https juga, cara ini bisa diulang lagi
Selesai
Komentar