HTTP๋ฅผ https๋ก ๋ฆฌ๋๋ ์
ํ๋ฉด ์ ์ธ์ฆ์๋ฅผ ๊ฐ์ ธ์ค๋ ๋ฐ ์คํจํฉ๋๋ค.
nginx.conf์ ํฌํธ 80์์ HTTP ์์ฒญ์ ๋ฆฌ๋๋ ์
ํ๋ ค๊ณ ํ์ต๋๋ค.
server {
listen 80;
server_name _;
location /.well-known/acme-challenge/ {
content_by_lua_block {
auto_ssl:challenge_server()
}
}
return 301 https://$host$request_uri;
}
๋ค์๊ณผ ๊ฐ์ ์ค๋ฅ๊ฐ ํ์๋ฉ๋๋ค.
Processing five.fortunekit.com
+ Creating new directory /etc/resty-auto-ssl/letsencrypt/certs/five.fortunekit.com ...
+ Signing domains...
+ Generating private key...
+ Generating signing request...
+ Requesting new certificate order from CA...
+ Received 1 authorizations URLs from the CA
+ Handling authorization for five.fortunekit.com
+ 1 pending challenge(s)
+ Deploying challenge tokens...
deploy_challenge
+ Responding to challenge for five.fortunekit.com authorization...
invalid_challenge
Invalid challenge: DOMAIN=five.fortunekit.com RESPONSE={
"type": "http-01",
"status": "invalid",
"error": {
"type": "urn:ietf:params:acme:error:connection",
"detail": "Fetching https://five.fortunekit.com/.well-known/acme-challenge/geyhMh-KOQTyNQRDIurMja32h3Xjd4nmiE9UkFBn15w: Timeout after connect (your server may be slow or overloaded)",
"status": 400
},
"url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/4699231438/-vRiFQ",
"token": "geyhMh-KOQTyNQRDIurMja32h3Xjd4nmiE9UkFBn15w",
"validationRecord": [
{
"url": "http://five.fortunekit.com/.well-known/acme-challenge/geyhMh-KOQTyNQRDIurMja32h3Xjd4nmiE9UkFBn15w",
"hostname": "five.fortunekit.com",
"port": "80",
"addressesResolved": [
"35.154.129.216"
],
"addressUsed": "35.154.129.216"
},
{
"url": "https://five.fortunekit.com/.well-known/acme-challenge/geyhMh-KOQTyNQRDIurMja32h3Xjd4nmiE9UkFBn15w",
"hostname": "five.fortunekit.com",
"port": "443",
"addressesResolved": [
"35.154.129.216"
],
"addressUsed": "35.154.129.216"
}
]
}
err: Can't load ./.rnd into RNG
140653820678592:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=./.rnd
, context: ssl_certificate_by_lua*, client: 106.210.248.44, server: 0.0.0.0:443
2020/05/20 10:36:17 [error] 4144#4144: *4 [lua] ssl_certificate.lua:97: issue_cert(): auto-ssl: issuing new certificate failed: dehydrated failure, context: ssl_certificate_by_lua*, client: 106.210.248.44, server: 0.0.0.0:443
2020/05/20 10:36:17 [error] 4144#4144: *4 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for five.fortunekit.com - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua*, client: 106.210.248.44, server: 0.0.0.0:443
2020/05/20 10:36:35 [error] 4144#4144: *12 [lua] ssl_certificate.lua:68: issue_cert(): auto-ssl: failed to obtain lock: timeout, context: ssl_certificate_by_lua*, client: 66.133.109.36, server: 0.0.0.0:443
2020/05/20 10:36:35 [error] 4144#4144: *12 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for five.fortunekit.com - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua*, client: 66.133.109.36, server: 0.0.0.0:443
2020/05/20 10:36:36 [error] 4144#4144: *16 [lua] ssl_certificate.lua:68: issue_cert(): auto-ssl: failed to obtain lock: timeout, context: ssl_certificate_by_lua*, client: 34.209.232.166, server: 0.0.0.0:443
๊ทธ๊ฒ์ ๋ค์๊ณผ ๊ฐ์ 429 ์ค๋ฅ๋ก ์ด์ด์ง๋๋ค.
{
"type": "urn:ietf:params:acme:error:rateLimited",
"detail": "Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/rate-limits/",
"status": 429
}
๋๋ ๊ฐ์ ๋ฌธ์ ๊ฐ ์์๋ค. ๊ทธ๋ฌ๋ nginx๊ฐ location
๋ธ๋ก์ ์ ํํ๋ ๋ฐฉ๋ฒ์ ์ดํด๋ณด์ง ์์ผ๋ฉด ์๋ฃจ์
์ด ๋ช
ํํ์ง ์์ต๋๋ค.
ํด๊ฒฐ์ฑ :
# wildcard HTTP server for domains
server {
listen 80;
server_name _;
# Endpoint used for performing domain verification with Let's Encrypt.
location /.well-known/acme-challenge/ {
content_by_lua_block {
auto_ssl:challenge_server()
}
}
location / {
return 301 https://$host$request_uri;
}
์ด๊ฒ์ด ์๋ํ๊ณ ์์ ๊ฐ ์๋ํ์ง ์๋ ์ด์ : ์๋ฒ ๋ฃจํธ์ return ๋ฌธ์ด ์์ผ๋ฏ๋ก nginx๊ฐ ์ด๋ฅผ ๋ณด๊ณ ๋จผ์ ์์น๋ฅผ ์ผ์น์ํค๋ ๋์ 301์ ์ง์ ๋ฐํํฉ๋๋ค. ๋ฐ๋ผ์ ์๋ฒ์ ๋ฃจํธ์์ return
๋ฅผ ์ฌ์ฉํ์ง ๋ง์ญ์์ค. ํญ์.
์ง๊ธ ์๋ ์ค์ ๋๋ค. ์ ๋ง ๊ฐ์ฌํฉ๋๋ค :)
๊ฐ์ฅ ์ ์ฉํ ๋๊ธ
๋๋ ๊ฐ์ ๋ฌธ์ ๊ฐ ์์๋ค. ๊ทธ๋ฌ๋ nginx๊ฐ
location
๋ธ๋ก์ ์ ํํ๋ ๋ฐฉ๋ฒ์ ์ดํด๋ณด์ง ์์ผ๋ฉด ์๋ฃจ์ ์ด ๋ช ํํ์ง ์์ต๋๋ค.ํด๊ฒฐ์ฑ :
์ด๊ฒ์ด ์๋ํ๊ณ ์์ ๊ฐ ์๋ํ์ง ์๋ ์ด์ : ์๋ฒ ๋ฃจํธ์ return ๋ฌธ์ด ์์ผ๋ฏ๋ก nginx๊ฐ ์ด๋ฅผ ๋ณด๊ณ ๋จผ์ ์์น๋ฅผ ์ผ์น์ํค๋ ๋์ 301์ ์ง์ ๋ฐํํฉ๋๋ค. ๋ฐ๋ผ์ ์๋ฒ์ ๋ฃจํธ์์
return
๋ฅผ ์ฌ์ฉํ์ง ๋ง์ญ์์ค. ํญ์.