{"id":10062,"date":"2025-03-08T13:41:38","date_gmt":"2025-03-08T04:41:38","guid":{"rendered":"https:\/\/www.skyer9.pe.kr\/wordpress\/?p=10062"},"modified":"2025-07-18T14:27:29","modified_gmt":"2025-07-18T05:27:29","slug":"lets-encrypt-%eb%ac%b4%eb%a3%8c-%ec%9d%b8%ec%a6%9d%ec%84%9c-%eb%b0%9c%ea%b8%89%eb%b0%9b%ea%b8%b0","status":"publish","type":"post","link":"https:\/\/www.skyer9.pe.kr\/wordpress\/?p=10062","title":{"rendered":"Let’s Encrypt \ubb34\ub8cc \uc778\uc99d\uc11c \ubc1c\uae09\ubc1b\uae30"},"content":{"rendered":"

Let’s Encrypt \ubb34\ub8cc \uc778\uc99d\uc11c \ubc1c\uae09\ubc1b\uae30<\/h1>\n

Let’s Encrypt \ub97c \uc774\uc6a9\ud574 \ubb34\ub8cc\ub85c \uc778\uc99d\uc11c(https) \ub97c \ubc1c\uae09\ubc1b\ub294 \ubc29\ubc95\uc744 \uc124\uba85\ud569\ub2c8\ub2e4.<\/p>\n

\uc544\ub798 \ub0b4\uc6a9\uc740 nginx \ub97c \uc774\uc6a9\ud558\ub294 \ubc29\ubc95\uc785\ub2c8\ub2e4.<\/p>\n

Wildcard \uc778\uc99d\uc11c \ubc1c\uae09\ubc1b\uae30\ub294 \uc138\uac00\uc9c0\ub97c \uc8fc\uc758\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n

    \n
  1. \ub3c4\uba54\uc778 \uc815\ubcf4\uac00 \ubc18\uc601\ub41c \uac83\uc744 \uae30\ub2e4\ub824\uc57c \ud569\ub2c8\ub2e4.<\/li>\n
  2. \uc778\uc99d\uc11c \uac31\uc2e0\uc740 \ub2e8\uc21c\ud788 \ud06c\ub860\ud0ed \ub4f1\ub85d\ub9cc\uc73c\ub85c \uc791\ub3d9\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.<\/li>\n
  3. DNS \ud638\ucd9c API \ub97c \uc81c\uacf5\ud558\uc9c0 \uc54a\ub294 \uc5c5\uccb4\uc5d0 \ub3c4\uba54\uc778\uc744 \ub9e1\uae30\uace0 \uc788\ub2e4\uba74 \uc790\ub3d9\uac31\uc2e0\uc774 \ub418\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4. (\ub9e4 90\uc77c \ub9c8\ub2e4 \uc218\ub3d9\uac31\uc2e0)<\/li>\n<\/ol>\n

    certbot \uc124\uce58<\/h2>\n
    sudo apt install -y certbot python3-certbot-nginx<\/code><\/pre>\n
    Nginx \uc124\uc815 (80\ud3ec\ud2b8)<\/h2>\n
    sudo vi \/etc\/nginx\/sites-available\/example.com\n--------------\nserver {\n    listen 80;         # IPv4 \uc5f0\uacb0\uc744 \uc218\uc2e0\n    listen [::]:80;    # IPv6 \uc5f0\uacb0\uc744 \uc218\uc2e0\n\n    root \/var\/www\/html;\n\n    server_name example.com www.example.com;\n}<\/code><\/pre>\n
    # \ud14c\uc2a4\ud2b8\nsudo nginx -t\nnginx: the configuration file \/etc\/nginx\/nginx.conf syntax is ok\nnginx: configuration file \/etc\/nginx\/nginx.conf test is successful\n\n## \uc7ac\uc2dc\uc791\nsudo service nginx restart<\/code><\/pre>\n
    \uc778\uc99d\uc11c \ubc1c\uae09\ubc1b\uae30 (https)<\/h2>\n
    # sudo certbot --nginx -d example.com -d www.example.com\nsudo certbot --nginx -d example.com<\/code><\/pre>\n
    \uc544\ub798\uc640 \uac19\uc740 \uba54\uc2dc\uc9c0\uac00 \ub098\uc624\uba74 \uc131\uacf5\uc785\ub2c8\ub2e4.<\/p>\n
    Congratulations! You have successfully enabled https:\/\/example.com and https:\/\/www.example.com \n\n-------------------------------------------------------------------------------------\nIMPORTANT NOTES:\n\nCongratulations! Your certificate and chain have been saved at:\n\/etc\/letsencrypt\/live\/example.com\/fullchain.pem \nYour key file has been saved at:\n\/etc\/letsencrypt\/live\/example.com\/\/privkey.pem\nYour cert will expire on 2017-12-12.<\/code><\/pre>\n
    sudo vi \/etc\/nginx\/sites-available\/example.com<\/code><\/pre>\n
    server {\n    listen 80;         # IPv4 \uc5f0\uacb0\uc744 \uc218\uc2e0\n    listen [::]:80;    # IPv6 \uc5f0\uacb0\uc744 \uc218\uc2e0\n\n    root \/var\/www\/html;\n\n    server_name  example.com www.example.com;\n\n    listen 443 ssl; # managed by Certbot\n\n    # RSA certificate\n    ssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem; # managed by Certbot\n    ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem; # managed by Certbot\n\n    include \/etc\/letsencrypt\/options-ssl-nginx.conf; # managed by Certbot\n\n    # http \ud1b5\uc2e0\uc744 https \ub85c \ub9ac\ub2e4\uc774\ub809\ud2b8\n    if ($scheme != "https") {\n        return 301 https:\/\/$host$request_uri;\n    } # managed by Certbot\n}<\/code><\/pre>\n
    \uc778\uc99d\uc11c \uc790\ub3d9\uac31\uc2e0<\/h2>\n
    \uc0c8\ub85c \ubc1c\uae09\ubc1b\uc740 \uc778\uc99d\uc11c\ub294 90\uc77c\uc758 \uc720\ud6a8\uae30\uac04\ub9cc \uac00\uc9d1\ub2c8\ub2e4.<\/p>\n
    \uc778\uc99d\uc11c\uac00 \ub9cc\ub8cc\ub418\uc9c0 \uc54a\uc73c\ub824\uba74 \uc778\uc99d\uc11c\ub97c \uac31\uc2e0\ud574\uc8fc\uc5b4\uc57c \ud569\ub2c8\ub2e4.<\/p>\n
    # \ub8e8\ud2b8\ub85c \uc774\ub3d9\nsudo su -\n\ncrontab -e<\/code><\/pre>\n
    \uc77c\ubc18\uc801\uc73c\ub85c \uccab\ubc88\uc9f8 \uba85\ub839\uc774 \uc791\ub3d9\ud569\ub2c8\ub2e4.
    \n\ud558\uc9c0\ub9cc \uc624\ub958\uac00 \ubc1c\uc0dd\uc2dc --nginx<\/code> \uc635\uc158\uc744 \ucd94\uac00\ud574\uc11c nginx \uc784\uc744 \uba85\uc2dc\ud574 \uc90d\ub2c8\ub2e4.<\/p>\n
    30 4 * * 0 \/usr\/bin\/certbot renew --renew-hook="systemctl reload nginx"\n# \uc218\ub3d9 \uac31\uc2e0\n# 30 4 * * 0 \/usr\/bin\/certbot --nginx renew --renew-hook="systemctl reload nginx"<\/code><\/pre>\n
    Wildcard \uc778\uc99d\uc11c \ubc1c\uae09\ubc1b\uae30<\/h2>\n
    Let’s Encrypt \uc5d0\uc11c\ub294 *.example.com \uacfc \uac19\uc774 \uc640\uc77c\ub4dc\uce74\ub4dc \uc778\uc99d\uc11c\ub3c4 \ubc1c\uae09\ud574 \uc90d\ub2c8\ub2e4.<\/p>\n
    \uc778\uc99d\uc11c \uc0c1\ud0dc \ud655\uc778<\/h3>\n
    sudo certbot certificates\nSaving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nFound the following certs:\n  Certificate Name: test1.example.com\n    Domains: test1.example.com\n    Expiry Date: 2025-06-02 01:38:23+00:00 (VALID: 89 days)\n    Certificate Path: \/etc\/letsencrypt\/live\/test1.example.com\/fullchain.pem\n    Private Key Path: \/etc\/letsencrypt\/live\/test1.example.com\/privkey.pem\n  Certificate Name: example.com\n    Domains: *.example.com example.com\n    Expiry Date: 2022-10-27 05:30:32+00:00 (INVALID: EXPIRED)\n    Certificate Path: \/etc\/letsencrypt\/live\/example.com\/fullchain.pem\n    Private Key Path: \/etc\/letsencrypt\/live\/example.com\/privkey.pem\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -<\/code><\/pre>\n
    \uae30\uc874 \uc11c\ube0c\ub3c4\uba54\uc778 \uc778\uc99d\uc11c \uc0ad\uc81c \ud6c4 \uc640\uc77c\ub4dc \uc778\uc99d\uc11c \ubc1c\uae09<\/h3>\n
    # \uae30\uc874 \uc11c\ube0c\ub3c4\uba54\uc778 \uc778\uc99d\uc11c \uc0ad\uc81c\nsudo certbot delete --cert-name test1.example.com\n\n# Then, renew the wildcard certificate\nsudo certbot certonly --manual --preferred-challenges=dns --server https:\/\/acme-v02.api.letsencrypt.org\/directory --domain "*.example.com" --domain "example.com"<\/code><\/pre>\n
    \uc640\uc77c\ub4dc \uc778\uc99d\uc11c\ub97c \ubc1c\uae09\ubc1b\uae30 \uc704\ud574\uc11c\ub294 \ub3c4\uba54\uc778\uc758 \uc18c\uc720\uc790\uc784\uc744 \uc778\uc99d\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n
    DNS \uc11c\ubc84\uc5d0 _acme-challenge.example.com \uac19\uc740 \uc11c\ube0c\ub3c4\uba54\uc778\uc744 \uc0dd\uc131\ud558\ub77c\ub294 \ubb38\uad6c\uac00 \ub098\uc624\uba74,
    \n_acme-challenge \uc11c\ube0c\ub3c4\uba54\uc778\uc744 TXT \ud0c0\uc785\uc73c\ub85c \uc0dd\uc131\ud558\uace0 \uc544\ub798 \ubb38\uc790\uc5f4\uc744 \uc785\ub825\ud574 \uc90d\ub2c8\ub2e4.
    \n\ub3c4\uba54\uc778 \uc815\ubcf4 \ubcc0\uacbd\uc774 \ubc18\uc601\ub418\uae30\ub97c \uae30\ub2e4\ub824(1~10 \ubd84, DNS \uc11c\ubc84\uc124\uc815\uc5d0\uc11c \uacb0\uc815\ub428) \uc5d4\ud130\ub97c \uc785\ub825\ud574 \uc8fc\uba74 \ub429\ub2c8\ub2e4.<\/p>\n
    https:\/\/toolbox.googleapps.com\/apps\/dig\/#TXT\/_acme-challenge.example.com<\/a><\/p>\n
    \ubc18\ub4dc\uc2dc \ub3c4\uba54\uc778\uc815\ubcf4\uac00 \uc0dd\uc131\ub41c \uac83\uc744 \ud655\uc778\ud55c \ud6c4 \uc5d4\ud130\ub97c \uc785\ub825\ud558\uc138\uc694.<\/font><\/p>\n
    Please deploy a DNS TXT record under the name\n_acme-challenge.example.com with the following value:\n\n3WLmAnTEXo8v7BXXXXXXXXXXXXXXXXXX\n\nBefore continuing, verify the record is deployed.<\/code><\/pre>\n
    \uc544\ub798 \uc0ac\uc9c4\uc740 AWS Route53 \uc744 \uc774\uc6a9\ud574 \uc11c\ube0c\ub3c4\uba54\uc778\uc744 \uc0dd\uc131\ud558\ub294 \ubc29\ubc95\uc785\ub2c8\ub2e4.<\/p>\n
    \"\"<\/a><\/p>\n
    Wildcard \uc778\uc99d\uc11c \uc790\ub3d9\uac31\uc2e0 (AWS Route53)<\/h3>\n
    Wildcard \uc778\uc99d\uc11c \uc790\ub3d9\uac31\uc2e0\uc740 \uc704 \ud06c\ub860\ud0ed\uc5d0 \ub4f1\ub85d\ud55c \uba85\ub839\uc73c\ub85c \uc790\ub3d9\uac31\uc2e0\uc774 \uc774\ub8e8\uc5b4\uc9c0\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.<\/font><\/p>\n
    \ub9e4 \uac31\uc2e0\uc2dc\ub9c8\ub2e4 \ub3c4\uba54\uc778 \uc18c\uc720\uad8c \ud655\uc778\uc744 \uc704\ud55c \ub2e8\uacc4\ub97c \uac70\uccd0\uc57c \ud569\ub2c8\ub2e4.<\/p>\n
    \uc544\ub798 \uc124\uba85\uc740 AWS Route53 \uc744 \uae30\uc900\uc73c\ub85c \uc124\uba85\ud569\ub2c8\ub2e4.<\/p>\n
    \uac1c\uc694<\/h4>\n