{"id":6700,"date":"2025-02-18T19:01:51","date_gmt":"2025-02-18T18:01:51","guid":{"rendered":"https:\/\/olivier.hoarau.site\/?p=6700"},"modified":"2025-02-18T19:01:51","modified_gmt":"2025-02-18T18:01:51","slug":"installer-un-certificat-lets-encrypt-sur-un-serveur-lamp","status":"publish","type":"post","link":"https:\/\/olivier.hoarau.org\/?p=6700","title":{"rendered":"Installer un certificat Let’s Encrypt sur un serveur LAMP"},"content":{"rendered":"\n

Dans la suite de mon post pour pouvoir visualiser les cam\u00e9ras de vid\u00e9osurveillance avec zmNinja sur un mobile<\/a>, je me basais sur un serveur LAMP<\/a> (Linux+Apache+MariaDB+PHP<\/strong>) personnel accessible sur internet avec une adresse fixe fournie par No-IP<\/a>. Or jusqu’\u00e0 pr\u00e9sent j’utilisais un certificat autosign\u00e9 pour chiffrer la connexion avec SSL<\/strong> et \u00e7a me g\u00e9n\u00e9rait une exception avec le navigateur qu’il faut accepter.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Il se trouve que certains navigateurs refusent qu’on puisse accepter le risque et exige un certificat reconnu par une autorit\u00e9 qualifi\u00e9e. Je suis donc pass\u00e9 par Let’s Encrypt <\/a>pour b\u00e9n\u00e9ficier d’un certificat valide.<\/p>\n\n\n\n\n\n\n\n

Pour ma mageia je me suis repos\u00e9 sur cette page<\/a>, on installera tout d’abord le package lib64augeas-devel<\/strong> et on tapera ensuite en tant que root les commandes successives :<\/p>\n\n\n\n

python3 -m venv \/opt\/certbot\/\n\/opt\/certbot\/bin\/pip install --upgrade pip<\/pre><\/div>\n\n\n\n
Voil\u00e0 le r\u00e9sultat :<\/p>\n\n\n\n
Requirement already satisfied: pip in \/opt\/certbot\/lib\/python3.10\/site-packages (23.0.1)\nCollecting pip\n  Downloading pip-25.0-py3-none-any.whl (1.8 MB)\n     \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 1.8\/1.8 MB 6.9 MB\/s eta 0:00:00\nInstalling collected packages: pip\n  Attempting uninstall: pip\n    Found existing installation: pip 23.0.1\n    Uninstalling pip-23.0.1:\n      Successfully uninstalled pip-23.0.1\nSuccessfully installed pip-25.0<\/pre><\/div>\n\n\n\n
puis on tape :<\/p>\n\n\n\n
\/opt\/certbot\/bin\/pip install certbot certbot-apache<\/pre><\/div>\n\n\n\n
Voil\u00e0 le r\u00e9sultat (extrait) :<\/p>\n\n\n\n
Collecting certbot\n  Downloading certbot-3.1.0-py3-none-any.whl.metadata (7.9 kB)\nCollecting certbot-apache\n  Downloading certbot_apache-3.1.0-py3-none-any.whl.metadata (1.3 kB)\nCollecting acme>=3.1.0 (from certbot)\n  Downloading acme-3.1.0-py3-none-any.whl.metadata (1.3 kB)\nCollecting ConfigArgParse>=1.5.3 (from certbot)\n  Downloading ConfigArgParse-1.7-py3-none-any.whl.metadata (23 kB)\n\n(...)\n\nDownloading urllib3-2.3.0-py3-none-any.whl (128 kB)\nUsing cached pycparser-2.22-py3-none-any.whl (117 kB)\nBuilding wheels for collected packages: python-augeas\n  Building wheel for python-augeas (pyproject.toml) ... done\n  Created wheel for python-augeas: filename=python_augeas-1.1.0-py3-none-any.whl size=21254 sha256=36a415257635e6d1f8c6d86e979e3942a1cff4d0582e8d7be3a55aa7be9dfa71\n  Stored in directory: \/root\/.cache\/pip\/wheels\/b6\/10\/67\/b10ab09e701005d015b7be1488a552f221f5e065645c6f39ee\nSuccessfully built python-augeas\nInstalling collected packages: pytz, pyrfc3339, parsedatetime, urllib3, typing-extensions, pycparser, idna, distro, configobj, ConfigArgParse, charset-normalizer, certifi, requests, cf\nfi, python-augeas, cryptography, PyOpenSSL, josepy, acme, certbot, certbot-apache\nSuccessfully installed ConfigArgParse-1.7 PyOpenSSL-25.0.0 acme-3.1.0 certbot-3.1.0 certbot-apache-3.1.0 certifi-2025.1.31 cffi-1.17.1 charset-normalizer-3.4.1 configobj-5.0.9 cryptogr<\/pre><\/div>\n\n\n\n
On cr\u00e9e ensuite les liens suivants :<\/p>\n\n\n\n
ln -s \/opt\/certbot\/bin\/certbot \/usr\/bin\/certbot\nln -s \/usr\/local\/apache2\/bin\/httpd \/usr\/local\/sbin\nln -s \/usr\/local\/apache2\/bin\/apachectl \/usr\/local\/bin<\/pre><\/div>\n\n\n\n

j’ai cr\u00e9\u00e9 le r\u00e9pertoire\u00a0 \/etc\/httpd\/conf.d<\/strong> et avant d’aller plus loin le fichier de configuration d’Apache httpd.conf<\/strong> doit \u00eatre configur\u00e9 pour qu’il existe bien un h\u00f4te virtuel sur le port 80 avec l’adresse visible d’internet :<\/p>\n\n\n\n
<VirtualHost 192.168.13.11:80>\nServerName adresseperso.ddns.net\nDocumentRoot \/usr\/local\/apache2\/htdocs\nErrorLog logs\/ddns-error_log\nTransferLog logs\/ddns-access_log\n<\/VirtualHost><\/pre><\/div>\n\n\n\n
On tape ensuite :<\/p>\n\n\n\n
certbot --apache --apache-server-root \/usr\/local\/apache2<\/pre><\/div>\n\n\n\n
Voil\u00e0 le r\u00e9sultat :<\/p>\n\n\n\n
Saving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\nEnter email address (used for urgent renewal and security notices)\n (Enter 'c' to cancel): olivier.hoarau@funix.org\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nPlease read the Terms of Service at\nhttps:\/\/letsencrypt.org\/documents\/LE-SA-v1.4-April-3-2024.pdf. You must agree in\norder to register with the ACME server. Do you agree?\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n(Y)es\/(N)o: Y\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nWould you be willing, once your first certificate is successfully issued, to\nshare your email address with the Electronic Frontier Foundation, a founding\npartner of the Let's Encrypt project and the non-profit organization that\ndevelops Certbot? We'd like to send you email about our work encrypting the web,\nEFF news, campaigns, and ways to support digital freedom.\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n(Y)es\/(N)o: N\nAccount registered.\n\nWhich names would you like to activate HTTPS for?\nWe recommend selecting either all domains, or all domains in a VirtualHost\/server block.\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n1: adresseperso.ddns.net\n2: funix-mana.kervao.fr\n3: hoarau-mana.kervao.fr\n4: sql-mana.kervao.fr\n5: mana.kervao.fr\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nSelect the appropriate numbers separated by commas and\/or spaces, or leave input\nblank to select all options shown (Enter 'c' to cancel): 1\nRequesting a certificate for adresseperso.ddns.net\n\nSuccessfully received certificate.\nCertificate is saved at: \/etc\/letsencrypt\/live\/adresseperso.ddns.net\/fullchain.pem\nKey is saved at:         \/etc\/letsencrypt\/live\/adresseperso.ddns.net\/privkey.pem\nThis certificate expires on 2025-05-09.\nThese files will be updated when the certificate renews.\n\nDeploying certificate\nSuccessfully deployed certificate for adresseperso.ddns.net to \/usr\/local\/apache2\/conf\/httpd-le-ssl.conf\nCongratulations! You have successfully enabled HTTPS on https:\/\/adresseperso.ddns.net\n\nNEXT STEPS:\n- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functional\nity. See https:\/\/certbot.org\/renewal-setup for instructions.\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nIf you like Certbot, please consider supporting our work by:\n * Donating to ISRG \/ Let's Encrypt:   https:\/\/letsencrypt.org\/donate\n * Donating to EFF:                    https:\/\/eff.org\/donate-le\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -<\/pre><\/div>\n\n\n\n
Il va cr\u00e9er le fichier \/usr\/local\/apache2\/conf\/httpd-le-ssl.conf <\/strong>qui contiendra :<\/p>\n\n\n\n
<IfModule mod_ssl.c>\n<VirtualHost 192.168.13.11:443>\nServerName adresseperso.ddns.net\nDocumentRoot \/usr\/local\/apache2\/htdocs\nErrorLog logs\/ddns-error_log\nTransferLog logs\/ddns-access_log\n\nSSLCertificateFile \/etc\/letsencrypt\/live\/adresseperso.ddns.net\/fullchain.pem\nSSLCertificateKeyFile \/etc\/letsencrypt\/live\/adresseperso.ddns.net\/privkey.pem\nInclude \/etc\/letsencrypt\/options-ssl-apache.conf\n<\/VirtualHost>\n<\/IfModule><\/pre><\/div>\n\n\n\n
et il modifiera le fichier \/usr\/local\/apache2\/conf\/httpd.conf<\/strong> qui contiendra :<\/p>\n\n\n\n
LoadModule ssl_module modules\/mod_ssl.so\n\n(...)\n\n# Secure (SSL\/TLS) connections\nInclude conf\/extra\/httpd-ssl.conf\n#\n# Note: The following must must be present to support\n#       starting without SSL on platforms with no \/dev\/random equivalent\n#       but a statically compiled-in mod_ssl.\n#\n<IfModule ssl_module>\nSSLRandomSeed startup builtin\nSSLRandomSeed connect builtin\n<\/IfModule>\n\n(...)\n\n<VirtualHost 192.168.13.11:80>\nServerName adresseperso.ddns.net\nDocumentRoot \/usr\/local\/apache2\/htdocs\nErrorLog logs\/ddns-error_log\nTransferLog logs\/ddns-access_log\nRewriteEngine on\nRewriteCond %{SERVER_NAME} =adresseperso.ddns.net\nRewriteRule ^ https:\/\/%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]\n<\/VirtualHost>\n\n(...)\n\nInclude \/usr\/local\/apache2\/conf\/httpd-le-ssl.conf<\/pre><\/div>\n\n\n\n
Tous les fichiers de configuration de let’s encrypt<\/strong> se retrouvent sous \/etc\/letsencrypt<\/strong>, les certificats sont sous \/etc\/letsencrypt\/live\/adresseperso.ddns.net<\/strong>. Maintenant le certicat a une dur\u00e9e de vie limit\u00e9e et il est possible de le renouveler automatiquement, tout est indiqu\u00e9 ici<\/a>. Il suffit de taper simplement la commande suivante en tant que root dans un terminal :<\/p>\n\n\n\n
SLEEPTIME=$(awk 'BEGIN{srand(); print int(rand()*(3600+1))}'); echo \"0 0,12 * * * root sleep $SLEEPTIME && certbot renew -q\" | sudo tee -a \/etc\/crontab > \/dev\/null<\/pre><\/div>\n\n\n\n
Voil\u00e0 le contenu de mon fichier \/etc\/crontab<\/strong> :<\/p>\n\n\n\n
SHELL=\/bin\/bash\nPATH=\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\nMAILTO=root\nHOME=\/\n\n# run-parts\n01 * * * * root nice -n 19 run-parts --report \/etc\/cron.hourly\n02 4 * * * root nice -n 19 run-parts --report \/etc\/cron.daily\n22 4 * * 0 root nice -n 19 run-parts --report \/etc\/cron.weekly\n42 4 1 * * root nice -n 19 run-parts --report \/etc\/cron.monthly\n0 0,12 * * * root sleep 2501 && certbot renew -q<\/pre><\/div>\n\n\n\n
On relance crond<\/strong> avec la commande systemctl restart crond<\/strong><\/p>\n\n\n\n
A noter qu’il est important de v\u00e9rifier que cerbot<\/strong> est bien \u00e0 jour, pour ce faire il faut taper au moins tous les mois la commande suivante :<\/p>\n\n\n\n
\/opt\/certbot\/bin\/pip install --upgrade certbot certbot-apache<\/pre><\/div>\n\n\n\n
Voil\u00e0 le r\u00e9sultat (extrait) :<\/p>\n\n\n\n
\n\nRequirement already satisfied: certbot in \/opt\/certbot\/lib\/python3.10\/site-packages (3.1.0)\nRequirement already satisfied: certbot-apache in \/opt\/certbot\/lib\/python3.10\/site-packages (3.1.0)\nRequirement already satisfied: acme>=3.1.0 in \/opt\/certbot\/lib\/python3.10\/site-packages (from certbot) (3.1.0)\nRequirement already satisfied: ConfigArgParse>=1.5.3 in \/opt\/certbot\/lib\/python3.10\/site-packages (from certbot) (1.7)\n\n(...)\n\nRequirement already satisfied: typing-extensions>=4.9 in \/opt\/certbot\/lib\/python3.10\/site-packages (from PyOpenSSL!=23.1.0,>=17.5.0->acme>=3.1.0->certbot) (4.12.2)\nRequirement already satisfied: charset-normalizer<4,>=2 in \/opt\/certbot\/lib\/python3.10\/site-packages (from requests>=2.20.0->acme>=3.1.0->certbot) (3.4.1)\nRequirement already satisfied: idna<4,>=2.5 in \/opt\/certbot\/lib\/python3.10\/site-packages (from requests>=2.20.0->acme>=3.1.0->certbot) (3.10)\nRequirement already satisfied: urllib3<3,>=1.21.1 in \/opt\/certbot\/lib\/python3.10\/site-packages (from requests>=2.20.0->acme>=3.1.0->certbot) (2.3.0)\nRequirement already satisfied: certifi>=2017.4.17 in \/opt\/certbot\/lib\/python3.10\/site-packages (from requests>=2.20.0->acme>=3.1.0->certbot) (2025.1.31)<\/pre><\/div>\n\n\n\n
le plus simple est de cr\u00e9er le fichier \/etc\/cron.monthly\/certbot-update <\/strong>qui contiendra :<\/p>\n\n\n\n
#!\/bin\/bash\n\/opt\/certbot\/bin\/pip install --upgrade certbot certbot-apache<\/pre><\/div>\n\n\n\n
qui fera \u00e7a en t\u00e2che de fond.<\/p>\n","protected":false},"excerpt":{"rendered":"
L’article d\u00e9crit le processus d’installation d’un certificat SSL valide pour un serveur LAMP afin d’\u00e9viter les probl\u00e8mes li\u00e9s aux certificats autosign\u00e9s avec les navigateurs. L’auteur utilise certbot de Let’s Encrypt, explique les commandes n\u00e9cessaires, la configuration d’Apache, et \u00e9voque l’automatisation du renouvellement du certificat via cron.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false,"_share_on_mastodon":"0"},"categories":[5],"tags":[],"class_list":["post-6700","post","type-post","status-publish","format-standard","hentry","category-logiciels-libres"],"share_on_mastodon":{"url":"https:\/\/mastodon.social\/@funix\/114026198611970662","error":""},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/peOjJ-1K4","jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/olivier.hoarau.org\/index.php?rest_route=\/wp\/v2\/posts\/6700","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/olivier.hoarau.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/olivier.hoarau.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/olivier.hoarau.org\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/olivier.hoarau.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6700"}],"version-history":[{"count":1,"href":"https:\/\/olivier.hoarau.org\/index.php?rest_route=\/wp\/v2\/posts\/6700\/revisions"}],"predecessor-version":[{"id":6701,"href":"https:\/\/olivier.hoarau.org\/index.php?rest_route=\/wp\/v2\/posts\/6700\/revisions\/6701"}],"wp:attachment":[{"href":"https:\/\/olivier.hoarau.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6700"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/olivier.hoarau.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6700"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/olivier.hoarau.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6700"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}