Letsencrypt - SSL Trusted Gratisan

Beranda

...

Linux dan OS Selain Microsoft & Mac
Letsencrypt - SSL Trusted Gratisan

linboxs

02-01-2016 13:31

Letsencrypt - SSL Trusted Gratisan

Halo gan

Melalui tulisan ini, ane mau share knowlegde aja nih tentang Letsecrypt, salah satu penyedia sertifikat SSL gratis namun Trusted di berbagai macam browser baik itu Google Chrome, Mozilla Firefox dll. Letsencrypt ini bisa ente install di server Linux ente (Debian, Ubuntu, Redhat, CentOS, SUSE dll). Dijamin https domain ente akan berwana hijau kinclong emoticon-Ngakak (S)

Quote:

Let’s Encrypt is a free, automated, and open certificate authority brought to you by the Internet Security Research Group (ISRG). ISRG is a California public benefit corporation, and is recognized by the IRS as a tax-exempt organization under Section 501(c)(3) of the Internal Revenue Code.

Trus cara installasi nya gimana gan?
Cara installasinya sedikit berbeda dengan SSL pada umumnya, biasa nya kan kita generate CSR nya terlebih dahulu kemudian kita proses di SSL penyedianya kemudian baru kita dapat sertifikat SSL nya (root, intermediate dan CA). Tapi kalau letsencrypt ini kita cukup install aplikasinya di server kita kemudian arahkan konfigurasi SSL di web server ke lokasi hasil generate SSL Letsencryptnya.

Berikut hasil uji coba ane gan:
Server yang ane gunakan adalah CentOS 7 dengan minimal installasi.

Pastikan server CentOS sudah mempunyai git dan repositori epel. Kalau belum install terlebih dahulu:

Code:

# yum install git

# yum install epel-release

# yum install mod_ssl

Download file letsencrypt:

Code:

# git clone https://github.com/letsencrypt/letsencrypt

Installasi letsencrypt:

Code:

# cd letsencrypt

# ./letsencrypt-auto --help

Setelah selesai, disini saya akan melakukan installasi sertifikat untuk domain enzu02.linboxs.net menggunakan command berikut:

Code:

# ./letsencrypt-auto certonly --webroot -w /var/www/html -d enzu02.linboxs.net

Nanti akan muncul tampilan seperti berikut kemudian masukkan alamat email kita untuk kebutuhan recovery letencrypt:

Spoiler for :

Tekan Enter untuk melanjutkan proses nya

Spoiler for :

Setelah proses selesai akan muncul notifikasi seperti berikut:

Code:

IMPORTANT NOTES:

 - If you lose your account credentials, you can recover through

 e-mails sent to [email]support@linboxs.net[/email].

 - Congratulations! Your certificate and chain have been saved at

 /etc/letsencrypt/live/enzu02.linboxs.net/fullchain.pem. Your cert

 will expire on 2016-04-01. To obtain a new version of the

 certificate in the future, simply run Let's Encrypt again.

 - Your account credentials have been saved in your Let's Encrypt

 configuration directory at /etc/letsencrypt. You should make a

 secure backup of this folder now. This configuration directory will

 also contain certificates and private keys obtained by Let's

 Encrypt so making regular backups of this folder is ideal.

 - If you like Let's Encrypt, please consider supporting our work by:

 

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate

Donating to EFF: https://eff.org/donate-le

File sertifikat akan tersimpan di :

Code:

/etc/letsencrypt/live/enzu02.linboxs.net/

Edit file ssl.conf:

Code:

# vim /etc/httpd/conf.d/ssl.conf

Rubah letak file SSLCertificateFile, SSLCertificateKeyFile dan SSLCertificateChainFile seperti berikut:

Code:

SSLCertificateFile /etc/letsencrypt/live/enzu02.linboxs.net/cert.pem

SSLCertificateKeyFile /etc/letsencrypt/live/enzu02.linboxs.net/privkey.pem

SSLCertificateChainFile /etc/letsencrypt/live/enzu02.linboxs.net/chain.pem

Setelah itu restart service apache nya:

Code:

# systemctl restart httpd

Cek di browser apakah SSL sudah terdeteksi di browser seperti gambar berikut:

Spoiler for :

Kalau hasil di browser sudah menampilkan seperti gambar di atas artinya domain kita sudah terenkripsi menggunakan SSL Letsencrypt. emoticon-I Love Indonesia (S)

Meski gratis SSL Letsencrypt ini hanya valid selama 3 bulan, kalau sudah habis maka kita harus renewal sertifikat lagi. Namanya juga gratisan emoticon-Ngakak (S)

Sumber: http://www.linboxs.net/installasi-le...s-di-centos-7/

Sekian dan semoga bermanfaat ya.

agan yg sudah mencoba:

Quote:

Original Posted By zackad►
langsung install gan, sukses

Quote:

Original Posted By zackad►
oh ya , nambahin dikit.
ane pake raspbian (turuanan debian + apache2) command yg ane pake :
install certificate

Code:

./letsencrypt-auto --apache -w /var/www/sitepath -d nama.domain.com

edit file vhost (dalam kasus ane, ane jadiin satu di file /etc/apache2/apache2.conf) buat redirect ke virtualhost yg udah dibuat

Code:

<VirtualHost *:443>

DocumentRoot /path/to/web/folder

ServerName nama.domain.com

</VirtualHost>

kalo gk diarahin, ntar malah masuk ke default site di server.

Quote:

Original Posted By linboxs►dapet info dari forum sebelah nih agan2 emoticon-Big Grin

"paling mudah pakai acme-tiny . sedikit bash script dari sini: https://gist.github.com/deanet/4754b...c2497e39669f17 , dah bisa pakai SSL Letsencrypt dalam hitungan menit"

Berikut cara make kata nya:

Spoiler for Cara Pake:

Code:



root@djaja:~# bash -x gen-le-ssl.sh

+ '[' -d ./acme-tiny ']'

+ mkdir ./acme-tiny

+ curl https://raw.githubusercontent.com/diafygi/acme-tiny/master/acme_tiny.py

 % Total % Received % Xferd Average Speed Time Time Time Current

 Dload Upload Total Spent Left Speed

100 9150 100 9150 0 0 37979 0 --:--:-- --:--:-- --:--:-- 47409

+ echo -n 'Enter DN or FQDN: '

Enter DN or FQDN: + read domain

[url=http://www.abc.com]www.abc.com[/url]

+ echo -n 'Enter Full Path www: '

Enter Full Path www: + read fullpath

/srv/st

+ echo [url=http://www.abc.com]www.abc.com[/url]

[url=http://www.abc.com]www.abc.com[/url]

+ echo /srv/st

/srv/st

+ rm -rf [url=http://www.abc.com]www.abc.com[/url]

+ echo 'mkdir working directory...'

mkdir working directory...

+ mkdir [url=http://www.abc.com]www.abc.com[/url]

++ pwd

+ workdir=/root/www.abc.com/

+ echo 'generate account key for [url=http://www.abc.com]www.abc.com[/url] ..'

generate account key for [url=http://www.abc.com]www.abc.com[/url] ..

+ openssl genrsa 4096

Generating RSA private key, 4096 bit long modulus

.........................................................................................................................................................................................++

........................................................................................++

e is 65537 (0x10001)

+ echo 'generate domain private key....'

generate domain private key....

+ openssl genrsa 4096

Generating RSA private key, 4096 bit long modulus

................................................++

...........................++

e is 65537 (0x10001)

+ echo 'generate csr..'

generate csr..

+ openssl req -new -sha256 -key /root/www.abc.com//www.abc.com.key -subj /CN=www.abc.com

+ echo 'create directory acmi at /srv/st..'

create directory acmi at /srv/st..

+ mkdir -p /srv/st/.well-known/acme-challenge

+ echo 'create file verification at /srv/st/.well-known/acme-challenge/..'

create file verification at /srv/st/.well-known/acme-challenge/..

+ echo 'Get a signed certificate..'

Get a signed certificate..

+ python acme-tiny/acme_tiny.py --account-key /root/www.abc.com//www.abc.com_account.key --csr /root/www.abc.com//www.abc.com.csr --acme-dir /srv/st/.well-known/acme-challenge/

Parsing account key...

Parsing CSR...

Registering account...

Registered! 

Verifying [url=http://www.abc.com...]www.abc.com...[/url]

[url=http://www.abc.com]www.abc.com[/url] verified!

Signing certificate...

Certificate signed!

+ wget -O - https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem

--2016-01-06 03:07:05-- https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem

Resolving letsencrypt.org (letsencrypt.org)... 23.195.140.215, 2a02:26f0:b7:188::2a1f, 2a02:26f0:b7:187::2a1f

Connecting to letsencrypt.org (letsencrypt.org)S E N S O R3.195.140.215|:443... connected.

HTTP request sent, awaiting response... 200 OK

Length: 1675 (1.6K) [application/x-x509-ca-cert]

Saving to: `STDOUT'



100%[==============================================================================================================================>] 1,675 --.-K/s in 0s



2016-01-06 03:07:08 (19.1 MB/s) - written to stdout [1675/1675]



+ cat /root/www.abc.com//signed.crt /root/www.abc.com//intermediate.pem

+ echo 'File [url=http://www.abc.com/chained.crt]www.abc.com/chained.crt[/url] = Signed + Intermediate Cert'

File [url=http://www.abc.com/chained.crt]www.abc.com/chained.crt[/url] = Signed + Intermediate Cert

+ echo 'File [url=http://www.abc.com/signed.crt]www.abc.com/signed.crt[/url] = Signed Cert'

File [url=http://www.abc.com/signed.crt]www.abc.com/signed.crt[/url] = Signed Cert

+ echo 'File [url=http://www.abc.com/www.abc.com.key]www.abc.com/www.abc.com.key[/url] = Private key'

File [url=http://www.abc.com/www.abc.com.key]www.abc.com/www.abc.com.key[/url] = Private key

Selamat mencoba emoticon-Cendol (S)

Quote:

Original Posted By linboxs►Di CentOS versi 6 hanya tersedia Python versi 2.6 dan Letsencrypt membutuhkan python versi 2.7 maka ada beberapa langkah yang harus di lakukan:

Download Repositori IUS

Code:



wget https://centos6.iuscommunity.org/ius-release.rpm

Install Repositori IUS

Code:



yum -y install python27 python27-devel python27-pip python27-setuptools python27-virtualenv --enablerepo=ius

Arahkan path python 2.7 ke letsencrypt

Code:



sed -i "s|--python python2|--python python2.7|" letsencrypt-auto

Diubah oleh linboxs 07-01-2016 04:19

7.2K

Kutip

Balasan

Guest

Tulis komentar menarik atau mention replykgpt untuk ngobrol seru

Mari bergabung, dapatkan informasi dan teman baru!

Linux dan OS Selain Microsoft & Mac

4.4KThread•2KAnggota

Terlama

Guest

Tulis komentar menarik atau mention replykgpt untuk ngobrol seru