Webサーバー無しでLet’s EncryptのSSL証明書を発行(DNS認証)

[root@TEST-VM-01 ~]# dnf -y install epel-release
Last metadata expiration check: 0:05:01 ago on Sat 10 Feb 2024 06:30:10 AM UTC.
Dependencies resolved.
================================================================================
Package Architecture Version Repository Size
================================================================================
Installing:
epel-release noarch 8-18.el8 extras 24 k

Transaction Summary
================================================================================
Install 1 Package

～(以下略)～

[root@TEST-VM-01 ~]# dnf –enablerepo=epel -y install snapd
Last metadata expiration check: 0:06:54 ago on Sat 10 Feb 2024 06:39:18 AM UTC.
Dependencies resolved.
================================================================================
Package Architecture Version Repository Size
================================================================================
Installing:
snapd x86_64 2.61.1-0.el8 epel 18 M
Installing dependencies:
bash-completion noarch 1:2.7-5.el8 baseos 272 k
libpkgconf x86_64 1.4.2-1.el8 baseos 34 k
pkgconf x86_64 1.4.2-1.el8 baseos 37 k
pkgconf-m4 noarch 1.4.2-1.el8 baseos 16 k
pkgconf-pkg-config x86_64 1.4.2-1.el8 baseos 14 k
snap-confine x86_64 2.61.1-0.el8 epel 3.8 M
snapd-selinux noarch 2.61.1-0.el8 epel 560 k

Transaction Summary
================================================================================
Install 8 Packages

～(以下略)～

[root@TEST-VM-01 ~]# ln -s /var/lib/snapd/snap /snap　
[root@TEST-VM-01 ~]# echo 'export PATH=$PATH:/var/lib/snapd/snap/bin’ > /etc/profile.d/snap.sh
[root@TEST-VM-01 ~]# systemctl enable –now snapd.service snapd.socket
Created symlink /etc/systemd/system/multi-user.target.wants/snapd.service → /usr/lib/systemd/system/snapd.service.
Created symlink /etc/systemd/system/sockets.target.wants/snapd.socket → /usr/lib/systemd/system/snapd.socket.

[root@TEST-VM-01 ~]# snap install certbot –classic
Warning: /var/lib/snapd/snap/bin was not found in your $PATH. If you’ve not
restarted your session since you installed snapd, try doing that.
Please see https://forum.snapcraft.io/t/9469 for more details.

certbot 2.8.0 from Certbot Project (certbot-eff?) installed
[root@TEST-VM-01 ~]# snap list
Name Version Rev Tracking Publisher Notes
certbot 2.8.0 3566 latest/stable certbot-eff? classic　#certbot
core 16-2.60.4 16202 latest/stable canonical? core
core20 20231123 2105 latest/stable canonical? base

[root@TEST-VM-01 ~]# certbot certonly –manual -d www.example.com –preferred-challenges dns
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for www.example.com

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Please deploy a DNS TXT record under the name:

_acme-challenge.www.example.com.　#TXTレコードの名前

with the following value:

nIDG1NUDpaV—————xp-0pq10rgiPDPM96_lDc　#TXTレコードに設定する値

Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.www.example.com.
Look for one or more bolded line(s) below the line ';ANSWER’. It should show the
value(s) you’ve just added.

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Press Enter to Continue

Press Enter to Continue　#DNSにTXTレコード設定後再開する

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/www.example.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/www.example.com/privkey.pem
This certificate expires on 2024-05-10.
These files will be updated when the certificate renews.

NEXT STEPS:
– This certificate will not be renewed automatically. Autorenewal of –manual certificates requires the use of an authentication hook script (–manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate’s expiry date.

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

[root@TEST-VM-01 ~]# ls -l /etc/letsencrypt/live/www.example.com/
total 4
lrwxrwxrwx. 1 root root 45 Feb 10 00:40 cert.pem -> ../../archive/www.example.com/cert1.pem
lrwxrwxrwx. 1 root root 46 Feb 10 00:40 chain.pem -> ../../archive/www.example.com/chain1.pem
lrwxrwxrwx. 1 root root 50 Feb 10 00:40 fullchain.pem -> ../../archive/www.example.com/fullchain1.pem
lrwxrwxrwx. 1 root root 48 Feb 10 00:40 privkey.pem -> ../../archive/www.example.com/privkey1.pem
-rw-r–r–. 1 root root 692 Feb 10 00:40 README

[root@TEST-VM-01 ~]# cd /etc/letsencrypt/live/www.example.com/
[root@TEST-VM-01 www.example.com]# openssl pkcs12 -export -inkey privkey.pem -in cert.pem -out example.pfx
Enter Export Password:
Verifying – Enter Export Password:
[root@TEST-VM-01 www.example.com]# ls -l |grep pfx
-rw——-. 1 root root 1.6K Feb 10 00:55 example.pfx