CentOS8でLet’s Encryptを使いSSL化対応(https)対応をする

$ dnf module -y install python36
$ dnf -y install gcc mod_ssl python3-virtualenv redhat-rpm-config augeas-libs libffi-devel openssl-devel
$ curl -O https://dl.eff.org/certbot-auto$ mv certbot-auto /usr/local/bin/ $ chmod 700 /usr/local/bin/certbot-auto

# -w の後にはドキュメントルートを指定します。Laravelプロジェクトの場合は"puclic"まで入れるようにしてください。
# -d の後には独自ドメインを指定します。IPアドレスは不可です。
$ certbot-auto certonly --webroot -w /home/hoge/public_html/project_name/public -d hogehoge.com

Bootstrapping dependencies for RedHat-based OSes that will use Python3... (you can skip this with --no-bootstrap)
dnf is /usr/bin/dnf
dnf is hashed (/usr/bin/dnf)
Last metadata expiration check: 0:00:42 ago on Tue 07 Jul 2020 10:49:59 PM JST.
Package gcc-8.3.1-5.el8.0.2.x86_64 is already installed.
Package augeas-libs-1.12.0-5.el8.x86_64 is already installed.
Package openssl-1:1.1.1c-15.el8.x86_64 is already installed.
Package openssl-devel-1:1.1.1c-15.el8.x86_64 is already installed.
Package libffi-devel-3.1-21.el8.x86_64 is already installed.
Package redhat-rpm-config-122-1.el8.noarch is already installed.
Package ca-certificates-2019.2.32-80.0.el8_1.noarch is already installed.
Package python36-3.6.8-2.module_el8.1.0+245+c39af44f.x86_64 is already installed.
Package python3-virtualenv-15.1.0-19.module_el8.1.0+245+c39af44f.noarch is already installed.
Package python36-devel-3.6.8-2.module_el8.1.0+245+c39af44f.x86_64 is already installed.
Package mod_ssl-1:2.4.37-21.module_el8.2.0+382+15b0afa8.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
Creating virtual environment...
Installing Python packages...
Installation succeeded.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Enter email address (used for urgent renewal and security notices)

# 初回のみメールアドレスの登録と利用条件への同意が必要です。
 (Enter 'c' to cancel): hogehoge@hoge.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for achieve-app.work
Using the webroot path /home/hoge/public_html/puroject_name/public for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/hogehoge.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/hogehoge.com/privkey.pem
   Your cert will expire on 2020-10-05. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

$ ll /etc/letsencrypt/live/hogehoge.com/
total 4
lrwxrwxrwx 1 root root  40 Jul  7 23:06 cert.pem -> ../../project_name/hogehoge.com/cert1.pem
lrwxrwxrwx 1 root root  41 Jul  7 23:06 chain.pem -> ../../project_name/hogehoge.com/chain1.pem
lrwxrwxrwx 1 root root  45 Jul  7 23:06 fullchain.pem -> ../../project_name/hogehoge.com/fullchain1.pem
lrwxrwxrwx 1 root root  43 Jul  7 23:06 privkey.pem -> ../../project_name/hogehoge.com/privkey1.pem
-rw-r--r-- 1 root root 692 Jul  7 23:06 README

# 該当のvirtualhostファイルを修正します。
$ vi /etc/httpd/conf.d/project_name.conf
# ↓は元々記載してある箇所
<VirtualHost *:80>
   # リダイレクト設定なので下記3行は追記してください。httpにブラウザでアクセスした際もhttpsにリダイレクトしてくれます。
   RewriteEngine On
   RewriteCond %{HTTPS} off
   RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

   DocumentRoot /home/hoge/public_html/project_name/public
   ServerName hogehoge.com
   ErrorLog /home/hoge/logs/hogehoge.com/error_log
   CustomLog /home/hoge/logs/hogehoge.com/access_log combined
   AddDefaultCharset UTF-8
   <Directory "/home/hoge/public_html/project_name/public">
      AllowOverride All
   </Directory>
</VirtualHost>

# ↓下記を追記
<VirtualHost *:443>
  SSLEngine on
  ServerName hogehoge.com
  DocumentRoot /home/hoge/public_html/project_name/public
  # fullchain.pem(SSL証明書と中間証明書のセット)のパスを記載
  SSLCertificateFile /etc/letsencrypt/live/hogehoge.com/fullchain.pem
  # privkey.pem(秘密鍵ファイル)のパスを記載
  SSLCertificateKeyFile /etc/letsencrypt/live/hogehoge.com/privkey.pem
  <Directory "/home/hoge/public_html/project_name/public">
    Options FollowSymLinks
    AllowOverride All
    Order deny,allow
    Allow from all
  </Directory>
ErrorLog /home/hoge/logs/hogehoge.com/ssl_error_log
CustomLog /home/hoge/logs/hogehoge.com/ssl_access_log combined
</VirtualHost>

$ httpd -t
Syntax OK

$ systemctl restart httpd

$ httpd -t
AH00526: Syntax error on line 85 of /etc/httpd/conf.d/ssl.conf:
SSLCertificateFile: file '/etc/pki/tls/certs/localhost.crt' does not exist or is empty

$ crontab -e

# root権限で毎日午前3時に更新コマンドを実行するよう設定
0 3 * * * root /usr/local/bin/certbot-auto renew