{"id":10044,"date":"2017-01-17T01:37:29","date_gmt":"2017-01-16T16:37:29","guid":{"rendered":"http:\/\/www.skyarch.net\/blog\/?p=10044"},"modified":"2021-11-02T17:32:20","modified_gmt":"2021-11-02T08:32:20","slug":"nginx-lets-encrypt%e3%81%a7http2alpn%e3%82%92%e6%a7%8b%e7%af%89","status":"publish","type":"post","link":"https:\/\/www.skyarch.net\/blog\/nginx-lets-encrypt%e3%81%a7http2alpn%e3%82%92%e6%a7%8b%e7%af%89\/","title":{"rendered":"nginx + Let&#8217;s Encrypt\u3067HTTP2(ALPN)\u3092\u69cb\u7bc9"},"content":{"rendered":"<h2>\u306f\u3058\u3081\u306b<\/h2>\n<p>\u3053\u3093\u306b\u3061\u306f\u3002kenji\u3067\u3059\u3002<\/p>\n<p>Cent7.3\u3001nginx1.10.2\u3001php-fpm7.1<br \/>\n\u3068\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3092\u3057\u3066\u304d\u307e\u3057\u305f\u3002<br \/>\n\u4eca\u56de\u306f\u30b4\u30fc\u30eb\u76ee\u6a19\u3067\u3042\u308bHTTP2\u306e\u8a2d\u5b9a\u306b\u5165\u3063\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p>SSL\u8a3c\u660e\u66f8\u304c\u5fc5\u8981\u306b\u306a\u308b\u306e\u3067\u3059\u304c\u3001SSL\u8a3c\u660e\u66f8\u306f<br \/>\nLet's Encrypt \u88fd\u306e\u3082\u306e\u3092\u5229\u7528\u3057\u307e\u3059\u3002<\/p>\n<p>Let's Encrypt\u306b\u3064\u3044\u3066\u306f\u4ee5\u4e0b\u306e\u30b5\u30a4\u30c8\u3092\u53c2\u8003\u306b\u304a\u9858\u3044\u3057\u307e\u3059<br \/>\n<a href=\"https:\/\/letsencrypt.jp\/\" target=\"_blank\" rel=\"noopener\">https:\/\/letsencrypt.jp\/<\/a><\/p>\n<ul>\n<li><a href=\"#overview\">\u6982\u8981<\/a><\/li>\n<li><a href=\"#env\">\u5b9f\u884c\u74b0\u5883<\/a><\/li>\n<li><a href=\"#install1\">\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u65b9\u6cd5<\/a><br \/>\n-- <a href=\"#install2\">certbot\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/a><br \/>\n-- <a href=\"#install3\">certbot\u306b\u3066\u8a3c\u660e\u66f8\u53d6\u5f97<\/a><\/li>\n<li><a href=\"#install4\">nginx\u306bssl\u8a2d\u5b9a<\/a><\/li>\n<li><a href=\"#install5\">nginx\u518d\u8d77\u52d5<\/a><\/li>\n<li><a href=\"#install6\">\u52d5\u4f5c\u78ba\u8a8d<\/a><\/li>\n<li><a href=\"#install7\">\u307e\u3068\u3081<\/a><\/li>\n<\/ul>\n<h2 id=\"overview\">\u6982\u8981<\/h2>\n<p>Cent7.3\u3001nginx1.10.2\u3001php-fpm7.1\u306e\u74b0\u5883\u306b\u3066SSL\u3092\u6709\u52b9\u306b\u3057\u307e\u3059\u3002<br \/>\nLet's Encrypt\u306e\u5229\u7528\u306b\u3042\u305f\u308a\u3001\u72ec\u81ea\u30c9\u30e1\u30a4\u30f3\u304c\u5fc5\u9808\u3068\u306a\u308a\u307e\u3059\u3002<\/p>\n<h2 id=\"env\">\u5b9f\u884c\u74b0\u5883<\/h2>\n<p>Cent7.3<br \/>\nnginx1.10.2<br \/>\nphp-fpm7.1<br \/>\n\u72ec\u81ea\u30c9\u30e1\u30a4\u30f3<\/p>\n<h2 id=\"install1\">\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u65b9\u6cd5<\/h2>\n<p>\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3092\u3057\u3066\u3044\u304f\u306e\u3067\u3059\u304c\u3001Let's Encrypt \u81ea\u4f53\u306e\u52d5\u4f5c\u3092\u3055\u305b\u308b\u306b\u3042\u305f\u308a\u3001certbot\u304c\u5fc5\u8981\u306b\u306a\u308a\u307e\u3059\u3002<br \/>\n\u3053\u3061\u3089\u3092\u307e\u305a\u306f\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<h3 id=\"install2\">certbot\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/h3>\n<p>yum\u306b\u3066certbot\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059<br \/>\n(epel\u30ea\u30dd\u30b8\u30c8\u30ea\u306f\u524d\u56de\u306ephp-fpm\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u6642\u306b\u5229\u7528\u53ef\u80fd\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002)<\/p>\n<pre>\nyum install --enablerepo=epel certbot \n<\/pre>\n<h3 id=\"install3\">certbot\u306b\u3066\u8a3c\u660e\u66f8\u53d6\u5f97<\/h3>\n<p>certbot\u30b3\u30de\u30f3\u30c9\u304c\u5229\u7528\u53ef\u80fd\u306b\u306a\u3063\u305f\u306e\u3067\u3001certbot\u7d4c\u7531\u3067SSL\u8a3c\u660e\u66f8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<br \/>\n\u203b-d\u306b\u7d9a\u304f\u90e8\u5206\u306f\u5229\u7528\u53ef\u80fd\u306aSSL\u306b\u5229\u7528\u3059\u308b\u30c9\u30e1\u30a4\u30f3\u540d\u3092\u5165\u529b\u3057\u3066\u304f\u3060\u3055\u3044<br \/>\n\u3000\u3053\u3053\u3067\u306ftestssl.skyarch.net\u3068\u3057\u307e\u3059\u3002<br \/>\n\u3000\u307e\u305f\u3001\u30c9\u30e1\u30a4\u30f3\u540d\u306b\u306f\u65e2\u306bA\u30ec\u30b3\u30fc\u30c9\u3092\u8a2d\u5b9a\u6e08\u307f\u306e\u3082\u306e\u3068\u3057\u307e\u3059\u3002<\/p>\n<pre>\ncertbot certonly --webroot --webroot-path \/usr\/share\/nginx\/html -d testssl.skyarch.net\n\n\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3092\u805e\u304b\u308c\u305f\u5834\u5408\u306f\u3001\u5229\u7528\u53ef\u80fd\u306a\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3092\u5165\u529b\u3059\u308b\u3002\n\"Congratulations!\"\u304c\u8868\u793a\u3055\u308c\u308c\u3070\u6b63\u5e38\u7d42\u4e86\n<\/pre>\n<h2 id=\"install4\">nginx\u306bssl\u8a2d\u5b9a<\/h2>\n<p>nginx\u306bSSL\u8a2d\u5b9a\u3092\u5b9f\u65bd\u3057\u307e\u3059\u3002<br \/>\n\u4ee5\u4e0b\u3092\u5b9f\u884c\u3002<br \/>\n\u203b\u8a2d\u5b9a\u3059\u308b\u30c9\u30e1\u30a4\u30f3\u3092testssl.skyarch.net\u3068\u3057\u307e\u3059\u3002<br \/>\n\u3000\u5b9f\u969b\u306b\u5229\u7528\u3059\u308b\u5834\u5408\u306f\u8aad\u307f\u66ff\u3048\u3066\u4e0b\u3055\u3044\u3002<\/p>\n<pre>\nmkdir \/etc\/nginx\/ssl\nopenssl dhparam 2048 -out \/etc\/nginx\/ssl\/dhparam.pem\n\ncat &gt; \/etc\/nginx\/conf.d\/ssl.conf &lt;&lt; EOF\nserver {\n    listen       443 ssl http2;\n    server_name  testssl.skyarch.net;\n    ssl_certificate     \/etc\/letsencrypt\/live\/testssl.skyarch.net\/fullchain.pem;\n    ssl_certificate_key \/etc\/letsencrypt\/live\/testssl.skyarch.net\/privkey.pem;\n    ssl_trusted_certificate \/etc\/letsencrypt\/live\/testssl.skyarch.net\/fullchain.pem;\n\n    ssl_session_timeout 1d;\n    ssl_session_cache shared:SSL:50m;\n    ssl_session_tickets off;\n    ssl_dhparam \/etc\/nginx\/ssl\/dhparam.pem;\n    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;\n    ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';\n    ssl_prefer_server_ciphers on;\n    add_header Strict-Transport-Security max-age=15768000;\n    ssl_stapling on;\n    ssl_stapling_verify on;\n\n\n    location \/ {\n        root   \/usr\/share\/nginx\/html;\n        index  index.html index.htm;\n\n    location ~ \\.php$ {\n        fastcgi_pass  localhost:9000;\n        fastcgi_param SCRIPT_FILENAME\n                      $document_root$fastcgi_script_name;\n        include       fastcgi_params;\n    }\n\n    }\n\n    error_page   500 502 503 504  \/50x.html;\n    location = \/50x.html {\n        root   \/usr\/share\/nginx\/html;\n    }\n\n}\nEOT\n<\/pre>\n<h2 id=\"install5\">nginx\u518d\u8d77\u52d5<\/h2>\n<p>nginx\u306econf\u3092\u5909\u66f4\u3057\u3066\u3044\u308b\u305f\u3081\u3001ngix\u306e\u518d\u8d77\u52d5\u3092\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u3002<br \/>\n\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u306b\u3066nginx\u3092\u8d77\u52d5\u3055\u305b\u308b<\/p>\n<pre>\n\u69cb\u6587\u30c1\u30a7\u30c3\u30af\nnginx -t\n\uff08\u30a8\u30e9\u30fc\u304c\u7121\u3044\u3053\u3068\u3092\u78ba\u8a8d\uff09\n\n\u8d77\u52d5\nsystemctl restart nginx\n\n\u8d77\u52d5\u78ba\u8a8d\nps auxfww|grep nginx\n<\/pre>\n<h2 id=\"install6\">\u52d5\u4f5c\u78ba\u8a8d<\/h2>\n<p>\u4ee5\u4e0b\u306e\u30b5\u30a4\u30c8\u304b\u3089\u52d5\u4f5c\u78ba\u8a8d\u304c\u3067\u304d\u307e\u3059\u3002<br \/>\n<a href=\"https:\/\/tools.keycdn.com\/http2-test\" target=\"_blank\" rel=\"noopener\">https:\/\/tools.keycdn.com\/http2-test<\/a><\/p>\n<p>\u81ea\u30c9\u30e1\u30a4\u30f3\u3092\u5165\u529b\u3057\u3066\u300ctest\u300d\u3092\u30af\u30ea\u30c3\u30af<br \/>\n\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u753b\u9762\u304c\u51fa\u308c\u3070\u3001\u6b63\u5e38\u306b\u8a2d\u5b9a\u3067\u304d\u3066\u3044\u307e\u3059\uff01<\/p>\n<div id=\"attachment_10049\" style=\"width: 310px\" class=\"wp-caption alignnone\"><a href=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2017\/01\/http2-result.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-10049\" src=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2017\/01\/http2-result-300x115.png\" alt=\"http2-result\" width=\"300\" height=\"115\" class=\"size-medium wp-image-10049\" srcset=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2017\/01\/http2-result-300x115.png 300w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2017\/01\/http2-result-768x295.png 768w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2017\/01\/http2-result-728x279.png 728w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2017\/01\/http2-result.png 956w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-10049\" class=\"wp-caption-text\">http2-result<\/p><\/div>\n<h2 id=\"install7\">\u307e\u3068\u3081<\/h2>\n<p>\u3044\u304b\u304c\u3067\u3057\u305f\u3067\u3057\u3087\u3046\u304b\u3002<br \/>\n4\u90e8\u306b\u6e21\u308a\u3001CentOS7.3\u3001nginx1.10.2\u3001php7.1\u3001SSL\u8a2d\u5b9a\u3068\u5b9f\u65bd\u3057\u3066\u304d\u307e\u3057\u305f\u3002<br \/>\n\u8ffd\u52a0\u3067RDS\u306e\u5229\u7528\u3084\u3001mysql\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306a\u3069\u3092\u5b9f\u65bd\u3059\u308b\u3053\u3068\u3067\u3001\u9ad8\u901f\u304b\u3064\u5b89\u5168\u306awordpress\u74b0\u5883\u306e\u69cb\u7bc9\u3082\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059\u3002<br \/>\n\uff08php\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u6642\u306b\u65e2\u306bphp-mysql\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u6e08\u307f\u3067\u3059\uff09<\/p>\n<p>CentOS5\u7cfb\u3067\u7a3c\u50cd\u3057\u3066\u3044\u3066\u30ea\u30d7\u30ec\u30fc\u30b9\u304c\u8fd1\u3044\uff01\u3057\u304b\u3057\u8106\u5f31\u6027\u3084\u6697\u53f7\u5316\u304c\u5fc3\u914d\u3001<br \/>\niOS\u3067\u30a2\u30d7\u30ea\u63d0\u4f9b\u3057\u3066\u3044\u308b\u304b\u3089\u3001SSL\u5bfe\u5fdc\u3092\u8003\u3048\u306a\u3044\u3068\u30fb\u30fb<br \/>\n\u306a\u3069\u306a\u3069\u3001\u305c\u3072\u672c\u4ef6\u3092\u53c2\u8003\u306b\u9802\u3051\u308b\u3068\u5b09\u3057\u304f\u601d\u3044\u307e\u3059\u3002<\/p>\n<p>\u3088\u308a\u9032\u3093\u3060\u5bfe\u5fdc\u3084\u30d0\u30fc\u30c1\u30e3\u30eb\u30db\u30b9\u30c8\u5bfe\u5fdc\u3001\u30ad\u30e3\u30c3\u30b7\u30e5\u8a2d\u5b9a\u3001\u5727\u7e2e\u8ee2\u9001\u8a2d\u5b9a\u306a\u3069\u3082\u53ef\u80fd\u3067\u3059\u306e\u3067\u3001\u4e0d\u660e\u306a\u70b9\u3042\u308c\u3070\u305c\u3072\u304a\u6c17\u8efd\u306b\u3054\u9023\u7d61\u304f\u3060\u3055\u3044<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u306f\u3058\u3081\u306b \u3053\u3093\u306b\u3061\u306f\u3002kenji\u3067\u3059\u3002 Cent7.3\u3001nginx1.10.2\u3001php-fpm7.1 \u3068\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3092\u3057\u3066\u304d\u307e\u3057\u305f\u3002 \u4eca\u56de\u306f\u30b4\u30fc\u30eb\u76ee\u6a19\u3067\u3042\u308bHTTP2\u306e\u8a2d\u5b9a\u306b\u5165\u3063\u3066\u3044\u304d\u307e\u3059\u3002 SSL\u8a3c\u660e\u66f8\u304c\u5fc5\u8981\u306b\u306a\u308b\u306e\u3067&#8230;<\/p>\n","protected":false},"author":43,"featured_media":3974,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_locale":"ja","_original_post":"10044","footnotes":""},"categories":[34],"tags":[192,99,104,49,89,87],"class_list":{"0":"post-10044","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-web","8":"tag-centos","9":"tag-http2","10":"tag-linux","11":"tag-nginx","12":"tag-openssl","13":"tag-ssl","14":"ja"},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts\/10044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/users\/43"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/comments?post=10044"}],"version-history":[{"count":13,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts\/10044\/revisions"}],"predecessor-version":[{"id":21115,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts\/10044\/revisions\/21115"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/media\/3974"}],"wp:attachment":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/media?parent=10044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/categories?post=10044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/tags?post=10044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}