主页 / ubuntu / 问题

问题[letsencrypt](ubuntu)

Martin Hope
TyForHelpDude
Asked: 2020-06-02 04:08:38 +0800 CST
  • 0

通过以下命令安装 certbot 服务；

$ sudo add-apt-repository ppa:certbot/certbot
$ sudo apt-get update
$ sudo apt-get install certbot

然后运行以下命令生成 tls 证书，但收到错误消息，如何修复？

root@sunucu:~# sudo certbot certonly --standalone --preferred-challenges http \ --deploy-hook "systemctl restart coturn" \ -d mydomain.com
usage:
  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

Certbot can obtain and install HTTPS/TLS/SSL certificates.  By default,
it will attempt to use a webserver both for obtaining and installing the
certificate.
certbot: error: unrecognized arguments:  --deploy-hook systemctl restart coturn                                    -d mydomain.com

它的 ubuntu 18.04 版本（仿生）

server letsencrypt
Martin Hope
kram
Asked: 2020-05-01 22:26:41 +0800 CST
  • 0

我有运行 Ubuntu 18.04 的 Amazon AWS，我需要安装 Lets encrypt，所以我尝试了以下命令，当我安装 python3-certbot-apache 时，它​​给出了未满足依赖项的错误。你能帮我么

我已经运行了以下命令：

  • sudo apt-get update sudo apt-get install software-properties-common
  • sudo add-apt-repository universe
  • sudo add-apt-repository ppa:certbot/certbot
  • sudo apt-get install python3-certbot-apache--该命令失败

我在这里给出了命令和输出

sudo apt-get update

Hit:1 http://ppa.launchpad.net/certbot/certbot/ubuntu bionic InRelease

Hit:2 http://archive.ubuntu.com/ubuntu bionic InRelease                        

Hit:3 http://ppa.launchpad.net/ondrej/php/ubuntu bionic InRelease        

Reading package lists... Done

sudo apt-get install software-properties-common

Reading package lists... Done

Building dependency tree       

Reading state information... Done

software-properties-common is already the newest version (0.96.24.32.12).

0 upgraded, 0 newly installed, 0 to remove and 47 not upgraded.

sudo add-apt-repository universe

'universe' 分发组件已为所有来源启用。

sudo add-apt-repository ppa:certbot/certbot


 This is the PPA for packages prepared by Debian Let's Encrypt Team and backported for Ubuntu.

Note: Packages are only provided for currently supported Ubuntu releases.

More info: https://launchpad.net/~certbot/+archive/ubuntu/certbot

Press [ENTER] to continue or Ctrl-c to cancel adding it.

Hit:1 http://ppa.launchpad.net/certbot/certbot/ubuntu bionic InRelease

Hit:2 http://archive.ubuntu.com/ubuntu bionic InRelease                        

Hit:3 http://ppa.launchpad.net/ondrej/php/ubuntu bionic InRelease        

Reading package lists... Done

sudo apt-get install python3-certbot-apache

Reading package lists... Done

Building dependency tree       

Reading state information... Done

Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.

The following information may help to resolve the situation:

The following packages have unmet dependencies:

 python3-certbot-apache :

 - Depends: certbot (>= 0.26.0~) but it is not going to be installed
 - Depends: python3-acme (>= 0.25.0~) but it is not going to be installed
 - Depends: python3-augeas but it is not going to be installed
 - Depends: python3-certbot (>= 0.26.0~) but it is not going to be installed
 - Depends: python3-mock but it is not going to be installed

E: Unable to correct problems, you have held broken packages.
dependencies apache2 letsencrypt 18.04
Martin Hope
mtleis
Asked: 2019-12-26 05:52:13 +0800 CST
  • 0

使用certbotLet'sEncrypt 时，我无法tleis.nl为chess.tleis.nl. 但我仍然无法获得基本域的安全访问tleis.nl。

我有以下内容：

  • 操作系统：Ubuntu 服务器 18.04
  • Nginx：1.15.5

我的网站文件位于：

/var/www/tleis.nl

在文件中/etc/nginx/sites-available/tleis.nl：

server {
  root /var/www/tleis.nl; 
  index index.html index.htm; 
  server_name tleis.nl www.tleis.nl; 
  location / { 
     try_files $uri $uri/ =404;
  }
}

现在，如果我这样做：

sudo certbot --nginx -d tleis.nl

然后我收到一条消息tleis.nl is unauthorized：

The following errors were reported by the server:
Domain: tleis.nl
Type: unauthorized

如果我将此站点复制到chess.tleis.nl例如：

sudo cp -r /var/www/tleis.nl /var/www/chess.tleis.nl
sudo cp /etc/nginx/sites-available/tleis.nl /etc/nginx/sites-available/chess.tleis.nl
sudo ln -s /etc/nginx/sites-available/chess.tleis.nl /etc/nginx/sites-enabled/chess.tleis.nl
sudo nginx -t
udo certbot --nginx -d chess.tleis.nl

然后我将 chess.tleis.nl 的内容更改为指向新站点。例如，“根”设置为 /var/www/chess.tleis.nl；和 server_name chess.tleis.nl；

运行命令sudo certbot --nginx -d chess.tleis.nl' works perfectly and as a resulthttps://chess.tleis.nl ` 现在可以访问了！

chess.tleis.nl 只是一个示例，说明我可以获得任何子域的证书（我还将它复制到许多其他子域并为每个子域生成单独的证书而没有问题，例如：python.tleis.nl和 ds.tleis.nl)。但仍然无法获得根“tleis.nl”的证书。

任何提示我接下来应该去哪里看？

server dns nginx letsencrypt
Martin Hope
Donovan_DMC
Asked: 2019-05-26 20:49:41 +0800 CST
  • 1

我一直在通过 nginx 代理为自己运行一个 api，直到今天我重新颁发了它的证书时，我还没有遇到任何问题。证书来自 Let's Encrypt，我制作了我给 nginx捆绑的客户端、中间证书和根证书的文件。

我可以在浏览器中没有警告的情况下很好地访问 api，但是在节点中，我得到了UNABLE_TO_VERIFY_LEAF_SIGNATURE，在 python 中，Cannot connect to host api.furry.bot:443 ssl:None [[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)]

用于 ssl 的 Nginx 配置：

##
# SSL Settings
##

ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
ssl_certificate     /etc/ssl/main.chained.crt;
ssl_certificate_key /etc/ssl/main.key;
ssl_ciphers         HIGH:!aNULL:!MD5;

密钥与链中第一个证书匹配，文件为结构化
服务器证书
中间证书
根证书

我无法让它正常工作，我不想只是在我的节点应用程序中禁用 ssl 验证，也无法正确编辑 python 实现，我感觉它没有获得中间证书和根证书正确，但我不知道。

nginx 代理的服务器是 node express 服务器和一个烧瓶服务器（与此无关）。

相关站点的配置是（所有其他配置基本相同，当然减去 default_server）：

server {
    listen 443 default_server ssl;
    listen [::]:443 default_server ipv6only=on ssl;
    server_name furry.bot *.furry.bot;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
     }
}

ssl 完全在 nginx 端，幕后的一切都是 http。

此错误仅出现在它们通常运行的 Ubuntu 服务器上，它运行良好，在我的本地 Windows 笔记本电脑上没有错误。

（不要这样做。）
我暂时把

process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0;

虽然我知道这是一个坏主意，但我目前没有任何其他选择。

server ssl nginx letsencrypt
Martin Hope
T.Todua
Asked: 2019-05-12 06:33:35 +0800 CST
  • 13

我试过了

sudo apt-get remove python-certbot-apache
sudo apt-get purge --auto-remove python-certbot-apache
sudo apt-get remove  python3-certbot-apache
sudo apt-get purge --auto-remove python3-certbot-apache

但是当我运行命令时certbot它仍然被识别。我怎样才能完全删除它，因此，键入该命令就像任何无法识别的命令一样。

letsencrypt
Martin Hope
ckapilla
Asked: 2019-05-08 15:24:25 +0800 CST
  • 3

我找到了关于

  • 如何在 Linux 上为 NGINX 安装 LetsEncrypt（有效）
  • 如何在 Windows 上安装 LetsEncrypt for SQL Server（它依赖于 GUI 工具，所以没用），以及
  • 如何在 Linux 上为 SQL Server 安装其他证书

但我在 Linux 上找不到有关 LetsEncrypt for SQL Server 的任何信息。无论我尝试什么，我都会收到此错误消息：
Error: 49940, Severity: 16, State: 1.Unable to open one or more of the user-specified certificate file(s). Verify that the certificate file(s) exist with read permissions for the user and group running SQL Server.

看来这应该是可能的，任何人都可以提供一些提示吗？[编辑]
我已验证这两个 LetsEncrypt 文件具有适当的权限。我复制并重命名了它们，它们由 /var/opt/mssql/mssql.conf 的网络部分中的 tlscert 和 tlskey 键指向。

[network]
tlscert = /etc/ssl/certs/mssql.pem
tlskey = /etc/ssl/private/mssql.key
tlsprotocols = 1.2
forceencryption = 1

我不清楚的一件事是 .pem 格式的 Letsencrypt 私钥是否需要提取到 .key 文件中，所以我两种方式都试过了。无论哪种方式，我都会遇到相同的错误。
这些错误显示在 mssql/log/errorlog 文件中。
这是要求的结果

ls -l  /etc/ssl/certs/mssql.pem:
-rw------- 1 mssql mssql 3586 May  3 22:20 /etc/ssl/certs/mssql.pem
ls -l  /etc/ssl/private/mssql.key
-rw------- 1 mssql mssql 1679 May  3 22:42 /etc/ssl/private/mssql.key

mssql.pem 最初是 fullchain.pem 和 mssql.key 最初是 privkey.pem，它们是 Nginx 所需的文件并且适用于它。

server letsencrypt sql
Martin Hope
Aleksey
Asked: 2019-04-26 02:05:27 +0800 CST
  • 0

我使用 3rd 方模块从源代码编译 Nginx。删除旧的 Nginx 并编译新的安装。很好，但是当你删除旧的 Nginx 时，certbot 脚本将自动被删除。

Nginx 编译安装后。当尝试通过命令“sudo apt install python3-certbot-nginx”安装 nginx certbot 时。它尝试使用 certbot 从存储库安装 Nginx。帮我解决这个问题。

如何在编译的 Nginx 上设置 certbot 而不依赖于从存储库安装 Nginx？

ssl nginx letsencrypt
Martin Hope
Lippai Zoltan
Asked: 2019-01-29 02:43:01 +0800 CST
  • 5

我以前在 Ubuntu 上安装过 Certbot，但我相信这个包还不能用于这个发行版，所以我相信我是从一个预构建的包中安装的（也许，我真的不确定）。无论如何，现在我已经安装了 certbot 0.26.1：

certbot --version
certbot 0.26.1

我尝试使用此处的指南安装它： https ://certbot.eff.org/lets-encrypt/ubuntubionic-nginx

以下是当前系统的一些输出：

apt-get install python-certbot-nginx 
python-certbot-nginx is already the newest version (0.28.0-1+ubuntu18.04.1+certbot+3).


certbot --version
certbot 0.26.1

which certbot
/usr/bin/certbot

dpkg-query -L python-certbot-nginx 
/.
/usr
/usr/share
/usr/share/doc
/usr/share/doc/python-certbot-nginx
/usr/share/doc/python-certbot-nginx/changelog.Debian.gz
/usr/share/doc/python-certbot-nginx/copyright

所以在我看来，“python-certbot-nginx”包没有安装任何二进制文件。我在这里做错了吗？我有一些完全不同的软件包可以升级（例如 MySQL、PHP），但我只能在这个星期天升级这些。但我相信这与我的问题完全无关。谢谢！

server apt nginx letsencrypt 18.04
Martin Hope
nyluje
Asked: 2019-01-20 01:19:41 +0800 CST
  • 2

我想更新certbot以应对以下主题： 如何停止将 TLS-SNI-01 与 Certbot 一起使用

升级前：certbot --version返回：certbot 0.26.1

按照How to stop using TLS-SNI-01 with Certbot中的说明，我想更新到 0.28 以上的版本。

我已经查看了如何升级ubuntu我已经执行：

apt-get install –only-upgrade python-certbot-apache

它返回：

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libapache2-mod-php7.0 php7.0-cli php7.0-common php7.0-json php7.0-opcache
  php7.0-readline python-acme python-augeas python-certbot python-cffi-backend
  python-chardet python-configargparse python-configobj python-cryptography
  python-dialog python-dnspython python-enum34 python-funcsigs python-idna
  python-ipaddress python-mock python-ndg-httpsclient python-openssl
  python-parsedatetime python-pbr python-pyasn1 python-requests python-rfc3339
  python-six python-tz python-urllib3 python-zope.component python-zope.event
  python-zope.hookable python-zope.interface
Use 'sudo apt autoremove' to remove them.
The following packages will be upgraded:
  python-certbot-apache
1 upgraded, 0 newly installed, 0 to remove and 270 not upgraded.
Need to get 3872 B of archives.
After this operation, 3072 B of additional disk space will be used.
Get:1 http://ppa.launchpad.net/certbot/certbot/ubuntu xenial/main amd64 python-certbot-apache all 0.28.0-1+ubuntu16.04.1+certbot+3 [3872 B]
Fetched 3872 B in 0s (28.3 kB/s)
(Reading database ... 38437 files and directories currently installed.)
Preparing to unpack .../python-certbot-apache_0.28.0-1+ubuntu16.04.1+certbot+3_all.deb ...
Unpacking python-certbot-apache (0.28.0-1+ubuntu16.04.1+certbot+3) over (0.25.0-2+ubuntu16.04.1+certbot+1) ...
Setting up python-certbot-apache (0.28.0-1+ubuntu16.04.1+certbot+3) ...

所以看起来更新成功了。

同样，当我这样做时，certbot --version它仍然会返回：certbot 0.26.1

updates apt apache2 16.04 letsencrypt
Martin Hope
mathieulbt
Asked: 2018-08-14 06:48:58 +0800 CST
  • 0

我有一个 18.04 的 Ubuntu 服务器和一个通过 Let's Encrypt 认证的 Drupal 8 站点。

# sudo certbot --apache -d mydomaine.com -d www.mydomaine.com  --rsa-key-size 4096
# sudo nano /etc/apache2/sites-available/www.mydomaine.com-le-ssl.conf

这是内容：

<IfModule mod_ssl.c>
   <VirtualHost 00.00.00.000:443 [0000:0000:000:0000::000]:443>

      ServerAdmin [email protected]
      ServerName mydomaine.com
      ServerAlias www.mydomaine.com
      DocumentRoot /var/www/www.mydomaine.com/web/

      <Directory /var/www/www.mydomaine.com/web>
         Options FollowSymLinks MultiViews
         AllowOverride All
         Require all granted
      </Directory>

      <FilesMatch \.php$>
         SetHandler "proxy:unix:/var/run/php/php7.2-fpm.sock|fcgi://localhost/"
      </FilesMatch>

      ErrorLog ${APACHE_LOG_DIR}/error.log
      CustomLog ${APACHE_LOG_DIR}/access.log combined

      Include /etc/letsencrypt/options-ssl-apache.conf
      SSLCertificateFile /etc/letsencrypt/live/mydomaine.com/fullchain.pem
      SSLCertificateKeyFile /etc/letsencrypt/live/mydomaine.com/privkey.pem

      Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
      Header always set X-Content-Type-Options "nosniff"
      Header always set X-XSS-Protection "1; mode=block"
      Header always set X-Frame-Options "SAMEORIGIN"
      Header always set X-Download-Options "noopen"
      Header always set X-Permitted-Cross-Domain-Policies "none"
      Header always set Content-Security-Policy "default-src https: data: wss: 'unsafe-inline' 'unsafe-eval'"
      Header set Set-Cookie HttpOnly;Secure

   </VirtualHost>
</IfModule>

我应该在 options-ssl-apache 中移动标题吗？

# sudo nano /etc/letsencrypt/options-ssl-apache.conf

这是内容：

# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file.

SSLEngine on

# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3
SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
SSLHonorCipherOrder     on
SSLCompression          off

SSLOptions +StrictRequire

# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common

#CustomLog /var/log/apache2/access.log vhost_combined
#LogLevel warn
#ErrorLog /var/log/apache2/error.log

# Always ensure Cookies have "Secure" set (JAH 2012/1)
#Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"
security server apache2 letsencrypt 18.04