Let’s Encrypt の TLS-SNI-01 validation の無効化への対応備忘録です．
本 blog の証明書は Let’s Encrypt のものです．
で，本日，その Let’s Encrypt より，
Hello,
**Action is required to prevent your Let’s Encrypt certificate renewals from breaking.**
Your Let’s Encrypt client used ACME TLS-SNI-01 domain validation to issue a certificate in the past 60 days.
TLS-SNI-01 validation is reaching end-of-life and will stop working on **February 13th, 2019.**
You need to update your ACME client to use an alternative validation method (HTTP-01, DNS-01 or TLS-ALPN-01) before this date or your certificate renewals will break and existing certificates will start to expire.
If you need help updating your ACME client, please open a new topic in the Help category of the Let’s Encrypt community forum:
https://community.letsencrypt.
Please answer all of the questions in the topic template so we can help you.
For more information about the TLS-SNI-01 end-of-life please see our API announcement:
Thank you,
Let’s Encrypt Staff
なるメールが届きました．調べてみると，どうも Let’s Encrypt が利用してきた TLS-SNI-01 なる方式のドメイン認証方法に脆弱性が見付かったため，この方式での証明書の新規取得だけでなく，更新についても2019年2月13日までとすること．そして，HTTP-01, DNS-01, TLS-ALPN-01 のいずれかに対応する ACME クライアントに入れ替える必要があるとのことの様です．
本 blog の場合，ACME クライアントとして，certbot を利用しています．
で，Let’s Encrypt の community forum を見てみると，要するに certbot の version を TLS-ALPN-01 に対応したものにすれば良さそう．と言う事で，
$ cd /usr/local $ sudo cp -rf certbot certbot.bk $ sudo git clone https://github.com/certbot/certbot $ /usr/local/certbot/certbot-auto renew --dry-run
としてみると，python3 等が自動的にインストールされ，http-01 方式が試されたあと，残念ながら，
Attempting to renew cert (www.labohyt.net) from /etc/letsencrypt/renewal/www.labohyt.net.conf produced an unexpected error: Unable to find a virtual host listening on port 80 which is currently needed for Certbot to prove to the CA that you control your domain. Please add a virtual host for port 80.. Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/www.labohyt.net/fullchain.pem (failure)
とのこと．
エラーを見るに，80番で virtualhost を設定せよとのことなので，/etc/httpd/httpd.conf の最後に，
NameVirtualHost *:80
<VirtualHost *:80>
ServerAdmin [email protected]
DocumentRoot /var/www/html
ServerName www.labohyt.net
</VirtualHost>
を付け加え，Web Server を再起動してから，もう一度実行してみると，今度は，
$ certbot-auto renew --dry-run Requesting to rerun /usr/local/bin/certbot-auto with root privileges... Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/www.labohyt.net.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Cert not due for renewal, but simulating renewal for dry run Plugins selected: Authenticator apache, Installer apache Renewing an existing certificate Performing the following challenges: http-01 challenge for www.labohyt.net Waiting for verification... Cleaning up challenges - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - new certificate deployed with reload of apache server; fullchain is /etc/letsencrypt/live/www.labohyt.net/fullchain.pem - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ** DRY RUN: simulating 'certbot renew' close to cert expiry ** (The test certificates below have not been saved.) Congratulations, all renewals succeeded. The following certs have been renewed: /etc/letsencrypt/live/www.labohyt.net/fullchain.pem (success) ** DRY RUN: simulating 'certbot renew' close to cert expiry ** (The test certificates above have not been saved.) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
と今度は大丈夫そう．
しかし，結構手間が掛かってしまいました．この辺りキチンと理解しながら使ってないってのはやはり少しまずいなぁ……と思ったのですが，まぁ，今回は設定できたっぽいので，しばらくはしのげるかなと思っています．
以上！
