Page Comparison

Certbot 설치에 실패할 경우 다음 작업을 수행 후 진행하십시오.

• 방화벽 해제

• 80, 443 포트 미사용

# certbot, python3-certbot-apache 설치
apt install -y certbot python3-certbot-apache

# 인증서(apache용)만 발급
certbot certonly --apache -d docs.mantech.co.kr

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): user@mantech.co.kr

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.
Requesting a certificate for docs.mantech.co.kr

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/docs.mantech.co.kr/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/docs.mantech.co.kr/privkey.pem
This certificate expires on 2022-08-24.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
...

ls /etc/letsencrypt/live/docs.mantech.co.kr/

# 갱신 가능 여부 확인
certbot renew --dry-run

# crontab으로 자동 갱신 설정
crontab -e

# 매월 1일 05시에 갱신
0 5 1 * * certbot renew

• 기존 데이터 복사로 인해 /3rabbitz/keystore.p12 파일이 있다면 삭제 후 인증서를 생성하십시오.

• 이때 입력한 비밀번호를 기억하여 이후에 server.xml 파일 설정 시 입력하십시오.

keytool -genkey -alias tomcat -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore keystore.p12 -validity 3650

새 비밀번호 다시 입력: 
이름과 성을 입력하십시오.
  [Unknown]:  
조직 단위 이름을 입력하십시오.
  [Unknown]:  
조직 이름을 입력하십시오.
  [Unknown]:  
구/군/시 이름을 입력하십시오?
  [Unknown]:  
시/도 이름을 입력하십시오.
  [Unknown]:  
이 조직의 두 자리 국가 코드를 입력하십시오.
  [Unknown]:  
CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown이(가) 맞습니까?
  [아니오]:  yes

openssl pkcs12 -export -in /etc/letsencrypt/live/docs.mantech.co.kr/fullchain.pem -inkey /etc/letsencrypt/live/docs.mantech.co.kr/privkey.pem -out /3rabbitz/keystore.p12 -name tomcat -CAfile /etc/letsencrypt/live/docs.mantech.co.kr/chain.pem -caname root

vi /3rabbitz/tomcat/conf/server.xml

...

<Server port="5791" shutdown="SHUTDOWN">

  <Service name="Catalina">
          <!--
    <Connector port="8009" protocol="AJP/1.3" address="0.0.0.0" secretRequired="false" redirectPort="8443" URIEncoding="UTF-8" maxPostSize="-1" Server="3Rabbitz" />
    <Connector port="1975" protocol="HTTP/1.1"
          connectionTimeout="20000" redirectPort="8443" URIEncoding="UTF-8" maxPostSize="-1" Server="3Rabbitz" />
          -->

    <Connector port="80" protocol="HTTP/1.1" relaxedQueryChars="^`\|{}[]"
    connectionTimeout="20000" redirectPort="443" URIEncoding="UTF-8"
    maxPostSize="-1" Server="3Rabbitz" />

    <Connector port="443" protocol="HTTP/1.1" relaxedQueryChars="^`\|{}[]"
    connectionTimeout="20000" URIEncoding="UTF-8"
    maxPostSize="-1" Server="3Rabbitz"
    SSLEnabled="true" scheme="https" secure="true"
    clientAuth="false" sslProtocol="TLS"
            keystoreFile="/3rabbitz/keystore.p12"
    keystorePass="roqkf2xla"
    keystoreType="PKCS12" />

    <Engine name="Catalina" defaultHost="localhost">
      <Host name="localhost" appBase="/" unpackWARs="true"
        autoDeploy="false" deployOnStartup="false" createDirs="false">
...

vi /3rabbitz/tomcat/conf/web.xml

...
<web-app>
...
 <security-constraint>
        <web-resource-collection>
            <web-resource-name>All Requests</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>
</web-app>