{"id":421,"date":"2018-08-15T14:56:26","date_gmt":"2018-08-15T05:56:26","guid":{"rendered":"https:\/\/www.chohi.ga\/?p=421"},"modified":"2019-02-06T22:38:56","modified_gmt":"2019-02-06T13:38:56","slug":"lets-encrypt-%ec%99%80%ec%9d%bc%eb%93%9c%ec%b9%b4%eb%93%9c-dns-ssl-%ec%9d%b8%ec%a6%9d%ec%84%9c-%eb%b0%9c%ea%b8%89-%eb%b0%9b%ea%b8%b0","status":"publish","type":"post","link":"https:\/\/www.kkoc.org\/?p=421","title":{"rendered":"Let’s Encrypt \uc640\uc77c\ub4dc\uce74\ub4dc DNS SSL \uc778\uc99d\uc11c \ubc1c\uae09 \ubc1b\uae30"},"content":{"rendered":"\n

\uc778\uc99d\uc11c \ud655\uc778<\/h2>\n\n\n\n
[root@www conf]# certbot certificates\nSaving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nFound the following certs:\n  Certificate Name: chohi.ga-0001\n    Domains: *.chohi.ga chohi.ga\n    Expiry Date: 2018-11-13 04:13:35+00:00 (VALID: 89 days)\n    Certificate Path: \/etc\/letsencrypt\/live\/chohi.ga-0001\/fullchain.pem\n    Private Key Path: \/etc\/letsencrypt\/live\/chohi.ga-0001\/privkey.pem\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n## \uae30\uc874 \uc778\uc99d\uc11c \uc0ad\uc81c\n# certbot delete  --cert-name chohi.ga-0001<\/code><\/pre>\n\n\n\n
certbot-auto \uc124\uce58<\/h2>\n\n\n\n
## certbot-auto \ub2e4\uc6b4\ub85c\ub4dc\n[root@www temp]# wget https:\/\/dl.eff.org\/certbot-auto\n--2018-08-15 11:41:37--  https:\/\/dl.eff.org\/certbot-auto\nResolving dl.eff.org (dl.eff.org)... 151.101.0.201, 151.101.64.201, 151.101.128.201, ...\nConnecting to dl.eff.org (dl.eff.org)|151.101.0.201|:443... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 62299 (61K) [application\/octet-stream]\nSaving to: \u2018certbot-auto\u2019\n\n100%[==========================================================================================>] 62,299      --.-K\/s   in 0.1s    \n\n2018-08-15 11:41:38 (441 KB\/s) - \u2018certbot-auto\u2019 saved [62299\/62299]\n\n\n## \uc2e4\ud589\uad8c\ud55c \ubcc0\uacbd\n[root@www temp]# chmod +x certbot-auto \n<\/code><\/pre>\n\n\n\n
\uc778\uc99d\uc11c \ub2e4\uc6b4\ub85c\ub4dc<\/h2>\n\n\n\n
.\/certbot-auto certonly –manual -d *.\ub3c4\uba54\uc778\uba85<\/strong> -d \ub3c4\uba54\uc778\uba85<\/strong> –preferred-challenges dns-01 –server https:\/\/acme-v02.api.letsencrypt.org\/directory<\/p>\n\n\n\n
certbot-auto \uba85\ub839\uc744 \uc2e4\ud589\ud558\uba74 \uce5c\ucca0\ud558\uac8c \ud544\uc694\ud55c \ud328\ud0a4\uc9c0\ub4e4\uc744 \uc124\uce58\ud558\uba74\uc11c \uad6c\ub3d9\ub429\ub2c8\ub2e4.<\/p>\n\n\n\n
[root@www temp]# .\/certbot-auto certonly --manual -d \"*.chohi.ga\" -d chohi.ga  --preferred-challenges dns-01 --server https:\/\/acme-v02.api.letsencrypt.org\/directory\nBootstrapping dependencies for RedHat-based OSes... (you can skip this with --no-bootstrap)\nyum is \/bin\/yum\n\/usr\/bin\/yum\nyum is hashed (\/bin\/yum)\nLoaded plugins: fastestmirror\nLoading mirror speeds from cached hostfile\nepel\/x86_64\/metalink                                                                                         | 4.9 kB  00:00:00     \n * base: mirror.navercorp.com\n * epel: ftp.jaist.ac.jp\n * extras: mirror.navercorp.com\n * updates: mirror.navercorp.com\nbase                                                                                                         \n\n...\n\nComplete!\nCreating virtual environment...\nInstalling Python packages...\nInstallation succeeded.\nSaving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\nPlugins selected: Authenticator manual, Installer None\nObtaining a new certificate\nPerforming the following challenges:\ndns-01 challenge for chohi.ga\ndns-01 challenge for chohi.ga\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nNOTE: The IP of this machine will be publicly logged as having requested this\ncertificate. If you're running certbot in manual mode on a machine that is not\nyour server, please ensure you're okay with that.\n\nAre you OK with your IP being logged?\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n(Y)es\/(N)o: y\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nPlease deploy a DNS TXT record under the name\n_acme-challenge.chohi.ga with the following value:\n\nK74FykR-HXsjhF8L_PRxKaVfnpX4U4OiPmy5blCbkas\n\nBefore continuing, verify the record is deployed.\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nPress Enter to Continue\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nPlease deploy a DNS TXT record under the name\n_acme-challenge.chohi.ga with the following value:\n\nl9cWMIZUb9zkhB9UR3oMyiHqWDO4HdWnKSg0_OrqpxE\n\nBefore continuing, verify the record is deployed.\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nPress Enter to Continue\nWaiting for verification...\nCleaning up challenges\nFailed authorization procedure. chohi.ga (dns-01): urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.chohi.ga\n\nIMPORTANT NOTES:\n - The following errors were reported by the server:\n\n   Domain: chohi.ga\n   Type:   None\n   Detail: DNS problem: NXDOMAIN looking up TXT for\n   _acme-challenge.chohi.ga<\/code><\/pre>\n\n\n\n
\uc544\ub798\uc640 \uac19\uc740 \uc624\ub958\uac00 \ubc1c\uc0dd\ud55c\ub2e4.<\/p>
IMPORTANT NOTES:
The following errors were reported by the server:<\/p>
Domain:  chohi.ga
Type: None
Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.chohi.ga <\/p><\/blockquote>\n\n\n\n
\uc800\uc758 \uacbd\uc6b0 txt\ub808\ucf54\ub4dc\ub97c \uc544\ub798\uc640 \uac19\uc774 \ucd94\uac00\ud588\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
DNS txt \ub808\ucf54\ub4dc \ud655\uc778<\/p>\n\n\n\n
# nslookup -q=txt _acme-challenge.chohi.ga\n\uc11c\ubc84:    kns.kornet.net\nAddress:  168.126.63.1\n\n\uad8c\ud55c \uc5c6\ub294 \uc751\ub2f5:\n_acme-challenge.chohi.ga        text =      \"NnzdPW7AT3LrTQVCEAxXd6XSSSfNf7uXTip1DgH-Is0\"\n_acme-challenge.chohi.ga        text =       \"l9cWMIZUb9zkhB9UR3oMyiHqWDO4HdWnKSg0_OrqpxE\"<\/code><\/pre>\n\n\n\n
\ub2e4\uc2dc certbot-auto \uad6c\ub3d9\ud558\ub2c8 \uc815\uc0c1\uc801\uc73c\ub85c \uc778\uc99d\uc11c\ub97c \ubc1b\uc544\uc635\ub2c8\ub2e4.<\/p>\n\n\n\n
[root@www temp]# .\/certbot-auto certonly --manual -d *.chohi.ga -d chohi.ga  --preferred-challenges dns-01 --server https:\/\/acme-v02.api.letsencrypt.org\/directory\nSaving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\nPlugins selected: Authenticator manual, Installer None\nAttempting to parse the version 0.27.0.dev0 renewal configuration file found at \/etc\/letsencrypt\/renewal\/duksfarm.ga.conf with version 0.26.1 of Certbot. This might not work.\nObtaining a new certificate\nPerforming the following challenges:\ndns-01 challenge for chohi.ga\ndns-01 challenge for chohi.ga\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nNOTE: The IP of this machine will be publicly logged as having requested this\ncertificate. If you're running certbot in manual mode on a machine that is not\nyour server, please ensure you're okay with that.\n\nAre you OK with your IP being logged?\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n(Y)es\/(N)o: y\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nPlease deploy a DNS TXT record under the name\n_acme-challenge.chohi.ga with the following value:\n\nl9cWMIZUb9zkhB9UR3oMyiHqWDO4HdWnKSg0_OrqpxE\n\nBefore continuing, verify the record is deployed.\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nPress Enter to Continue\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nPlease deploy a DNS TXT record under the name\n_acme-challenge.chohi.ga with the following value:\n\nNnzdPW7AT3LrTQVCEAxXd6XSSSfNf7uXTip1DgH-Is0\n\nBefore continuing, verify the record is deployed.\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nPress Enter to Continue\nWaiting for verification...\nCleaning up challenges\n\nIMPORTANT NOTES:\n - Congratulations! Your certificate and chain have been saved at:\n   \/etc\/letsencrypt\/live\/chohi.ga-0001\/fullchain.pem\n   Your key file has been saved at:\n   \/etc\/letsencrypt\/live\/chohi.ga-0001\/privkey.pem\n   Your cert will expire on 2018-11-13. To obtain a new or tweaked\n   version of this certificate in the future, simply run certbot-auto\n   again. To non-interactively renew *all* of your certificates, run\n   \"certbot-auto renew\"\n - If you like Certbot, please consider supporting our work by:\n\n   Donating to ISRG \/ Let's Encrypt:   https:\/\/letsencrypt.org\/donate\n   Donating to EFF:                    https:\/\/eff.org\/donate-le\n    <\/code><\/pre>\n\n\n\n
httpd \uc7ac\uae30\ub3d9<\/h2>\n\n\n\n
ssl.conf \ud30c\uc77c\uc5d0\uc11c \uc778\uc99d\uc11c \uc704\uce58\ub97c \ubcc0\uacbd\ud574 \uc8fc\uace0 httpd \uc11c\ube44\uc2a4\ub97c \uc7ac\uae30\ub3d9 \uc2dc\ucf1c \uc8fc\uba74\ub429\ub2c8\ub2e4.<\/p>\n\n\n\n
[root@www conf.d]# service httpd restart\nRedirecting to \/bin\/systemctl restart httpd.service<\/code><\/pre>\n\n\n\n
\uc640\uc774\ub4dc\uce74\ub4dc \ub3c4\uba54\uc778 \uc778\uc99d\uc11c \ud655\uc778<\/h2>\n\n\n\n
\ub3c4\uba54\uc778 \ucd94\uac00\ud560\ub54c \ub9c8\ub2e4 \uc778\uc99d\uc11c \ucd94\uac00 \uc791\uc5c5\uc744 \ud588\uc5c8\ub294\ub370 \uc774\uc81c \uc880\ub354 \ud3b8\ub9ac\ud558\uac8c \ub3c4\uba54\uc778\uc744 \ucd94\uac00\ud560 \uc218 \uc788\uac8c \ub418\uc5c8\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
  • \"\"
    \uc640\uc77c\ub4dc\uce74\ub4dc \ub3c4\uba54\uc778 \uc778\uc99d\uc11c<\/figcaption><\/figure><\/li>
  • \"\"
    \uc640\uc77c\ub4dc\uce74\ub4dc \ub3c4\uba54\uc778 \uc778\uc99d\uc11c<\/figcaption><\/figure><\/li><\/ul>\n\n\n\n
    Let’s Encrypt \uc778\uc99d\uc11c\ub294 \ubb34\ub8cc\uc778\ub370\ub3c4 \uc640\uc774\ub4dc\uce74\ub4dc \uc778\uc99d\uc11c\ub97c \uc9c0\uc6d0\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
    \uc778\uc99d\uc11c \uac31\uc2e0<\/h2>\n\n\n\n
    \uc778\uc99d\uc11c\ub294 3\uac1c\uc6d4\uc5d0 \ud55c\ubc88\uc529 \uac31\uc2e0\ud574 \uc918\uc57c \ud569\ub2c8\ub2e4. crontab\uc5d0 certbot renew \uc778\uc99d\uc11c \uac31\uc2e0\ud558\ub294 \ud0a4\uc6cc\ub4dc\ub97c \ub4f1\ub85d\ud574 \ub193\uc73c\uba74 \uc815\ud574\uc9c4 \uc2dc\uac04\uc5d0 \uc5c5\ub370\uc774\ud2b8\uac00 \ub418\ub294\ub370\uc694. \uc640\uc774\ub4dc \uce74\ub4dc \uc778\uc99d\uc11c\ub294 \uac31\uc2e0\uc774 \ub418\ub294\uc9c0 3\uac1c\uc6d4 \ub4a4\uc5d0 \uc54c \uc218 \uc788\uc744\uac83 \uac19\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n
    0 3 * * *  certbot renew   #\ub9e4\uc77c 3\uc2dc\uc5d0 \uad6c\ub3d9<\/p>\n\n\n\n
    [root@www conf]# certbot renew\nSaving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nProcessing \/etc\/letsencrypt\/renewal\/chohi.ga-0001.conf\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nCert not yet due for renewal\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n  \/etc\/letsencrypt\/live\/chohi.ga-0001\/fullchain.pem expires on 2018-11-13 (skipped)\nNo renewals were attempted.\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n##\uac15\uc81c\ub85c \uac31\uc2e0\ud558\uae30\ncertbot renew --dry-run<\/code><\/pre>\n\n\n\n
    \uad6d\ub0b4 \uc720\uba85 \ud3ec\ud138\ud68c\uc0ac\uc778 Naver\ub3c4 \uc544\uc9c1 \uc640\uc774\ub4dc\uce74\ub4dc SSL \uc778\uc99d\uc11c\ub97c \uc0ac\uc6a9\ud558\uace0 \uc788\uc9c0 \uc54a\uad70\uc694..<\/p>\n\n\n\n
    • \"\"
      Daum SSL \uc778\uc99d\uc11c
      <\/figcaption><\/figure><\/li>
    • \"\"
      Naver SSL \uc778\uc99d\uc11c<\/figcaption><\/figure><\/li><\/ul>\n\n\n\n
      2019-02-06 \ub0b4\uc6a9 \ucd94\uac00<\/h2>\n\n\n\n
      \uc640\uc774\ub4dc\uce74\ub4dc SSL\uc778\uc99d\uc11c\ub294 \uc790\ub3d9\uc73c\ub85c \uac31\uc2e0\uc774 \uc548\ub429\ub2c8\ub2e4.<\/p>\n\n\n\n
      3\uac1c\uc6d4\ub9c8\ub2e4 \uc704\uc758 \ucc98\ub9ac \uc21c\uc11c\ub85c \uc778\uc99d\uc11c\ub97c \uac31\uc2e0\ud558\uace0 HTTP\uc6f9\uc11c\ubc84\ub97c \uc7ac\uc2dc\uc791\uc2dc\ucf1c \uc918\uc57c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
      \uc774\uc720\ub294 DNS\uc11c\ubc84\uc5d0 TXT\ud0c0\uc785\uc758  _acme-challenge \ud56d\ubaa9\uc744 \ub123\uc5b4\uc918\uc57c \ud569\ub2c8\ub2e4. 2\uac1c\ub97c \ub123\uc5b4 \uc918\uc57c \ud558\ub294\ub370, \uccab\ubc88\uc9f8 \ud56d\ubaa9\uc744 DNS\uc5d0 \uac31\uc2e0\uc2dc\ucf1c \uc8fc\uace0 “nslookup -q=txt _acme-challenge.<\ub3c4\uba54\uc778\uba85>” \uac31\uc2f1\ub41c \ub0b4\uc6a9\ud655\uc778\ud6c4 \ub2e4\uc74c\uc9c4\ud589 \ud574\uc57c\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
      \uad6c\uae00\ub3c4\uba54\uc778\uc778 \uacbd\uc6b0 \uac31\uc2e0\ub418\uae30\uae4c\uc9c0 10\ubd84\uc815\ub3c4 \uc18c\uc694\ub418\ub294\uad70\uc694.<\/p>\n\n\n\n
      \ub450\ubc88\uc9f8  _acme-challenge \ud56d\ubaa9\ub3c4 \ub9c8\ucc2c\uac00\uc9c0\ub85c DNS\uac31\uc2e0\ub41c \ub0b4\uc6a9 \ud655\uc778 \ud6c4 \ub2e4\uc74c \uc9c4\ud589 \ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
      \uc778\uc99d\uc11c\ub97c \uac31\uc2e0\ud558\ub294\ub370, \uac70\uc758 30\ubd84\uc815\ub3c4 \uc18c\uc694 \ub418\ub294\uad70\uc694…<\/p>\n\n\n\n
      \uadf8\ub798\ub3c4 \uacf5\uc9dc\ub2c8\uae4c \uac10\uc0ac\ud788 \uc0ac\uc6a9\ud558\uace0 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
      \uc548\uc804\ud55c \uc0ac\uc774\ud2b8\ub97c \uc704\ud574 30\ubd84\uc815\ub3c4\ub294 \uc544\ub08c\uc5c6\uc774 \ud22c\uc790\ub97c \ud569\uc2dc\ub2e4.  <\/p>\n","protected":false},"excerpt":{"rendered":"
      \uc778\uc99d\uc11c \ud655\uc778 certbot-auto \uc124\uce58 \uc778\uc99d\uc11c \ub2e4\uc6b4\ub85c\ub4dc .\/certbot-auto certonly –manual -d *.\ub3c4\uba54\uc778\uba85 -d \ub3c4\uba54\uc778\uba85 –preferred-challenges dns-01 –server https:\/\/acme-v02.api.letsencrypt.org\/directory certbot-auto \uba85\ub839\uc744 \uc2e4\ud589\ud558\uba74 \uce5c\ucca0\ud558\uac8c \ud544\uc694\ud55c \ud328\ud0a4\uc9c0\ub4e4\uc744 \uc124\uce58\ud558\uba74\uc11c \uad6c\ub3d9\ub429\ub2c8\ub2e4. \uc544\ub798\uc640 \uac19\uc740 \uc624\ub958\uac00 \ubc1c\uc0dd\ud55c\ub2e4. IMPORTANT NOTES:The following errors were reported by the server:… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[],"_links":{"self":[{"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/posts\/421"}],"collection":[{"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=421"}],"version-history":[{"count":22,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/posts\/421\/revisions"}],"predecessor-version":[{"id":601,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/posts\/421\/revisions\/601"}],"wp:attachment":[{"href":"https:\/\/www.kkoc.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}