Let’s Encrypt ワイルドカード証明書を取得・手動更新する｜シンプル版

[root@centos7 ~]# certbot certonly --manual --preferred-challenges dns-01 -d *.example.com -d example.com -m your-email-account@your-domain.com --agree-tos --manual-public-ip-logging-ok --server https://acme-v02.api.letsencrypt.org/directory
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.example.com with the following value:

9EDkmlyOBgiwfYCO2yTN6tSBN_Heh_c5FjVN6CSaOiU  ◀︎　環境によって異なります。

Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue  ◀︎　ここで、照会待機！

Press Enter to Continue のところでエンタキーを押さず、別のコマンドライン・ウィンドウを開いて Let’s Encrypt が照会する項目を作ります。

_acme-challenge.example.com.        IN     TXT    "9EDkmlyOBgiwfYCO2yTN6tSBN_Heh_c5FjVN6CSaOiU"

example.com のゾーンデータベースファイルの最後に追加して BIND デーモンを再起動します。

[root@centos7 named]# vi example.com.db.wan

_acme-challenge.example.com.    IN  TXT "9EDkmlyOBgiwfYCO2yTN6tSBN_Heh_c5FjVN6CSaOiU"

BIND デーモン ( named また、named-chroot ) を再起動します。

[root@centos7 named]# systemctl restart named

２つのコマンドから確認できます。

環境によって反映まで掛かる時間は異なります。少し時間がたってから確認して見てください。

未反映の場合：

try????everything ~$ dig  _acme-challenge.example.com txt +short    # Answerのみ出力
＜何も出てきません＞

try????everything ~$ nslookup -type=TXT _acme-challenge.example.com 8.8.8.8
Server:        8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
*** Can't find _acme-challenge.example.com: No answer

try????everything ~$

反映済みの場合：

try????everything ~$ dig  _acme-challenge.example.com txt +short    # Answerのみ出力
"9EDkmlyOBgiwfYCO2yTN6tSBN_Heh_c5FjVN6CSaOiU"

try????everything ~$ nslookup -type=TXT _acme-challenge.example.com 8.8.8.8
Server:        8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
_acme-challenge.example.com    text = "9EDkmlyOBgiwfYCO2yTN6tSBN_Heh_c5FjVN6CSaOiU"

Authoritative answers can be found from:

try????everything ~$

DNS TXT レコードの追加が反映されたら、
Press Enter to Continue で照会待機されているコマンドライン・ウィンドウへ戻り、エンタキーを押してください。

下記のように2019-09-09日 ( 90日 ) まで有効なワイルドカード証明書が発行されます。

Waiting for verification...
Cleaning up challenges
Resetting dropped connection: acme-v02.api.letsencrypt.org

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/example.com/privkey.pem
   Your cert will expire on 2019-09-09. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

[root@centos7 ~]

発行ずみの証明書は /etc/letsencrypt/live/ドメイン名 に保存されますので確認して見ます。

[root@centos7 ~]# ll    /etc/letsencrypt/live/example.com/
total 4
lrwxrwxrwx 1 root root  36 Jun 12 01:02 cert.pem -> ../../archive/example.com/cert1.pem
lrwxrwxrwx 1 root root  37 Jun 12 01:02 chain.pem -> ../../archive/example.com/chain1.pem
lrwxrwxrwx 1 root root  41 Jun 12 01:02 fullchain.pem -> ../../archive/example.com/fullchain1.pem
lrwxrwxrwx 1 root root  39 Jun 12 01:02 privkey.pem -> ../../archive/example.com/privkey1.pem
-rw-r--r-- 1 root root 692 Jun 12 01:02 README

[root@centos7 ~]