SSL/TLS証明書設定手順 | SSL/TLS

1. サーバーで秘密鍵・公開鍵を作成（秘密鍵の拡張子は .key や .pem にする場合が多い）
2. 上記で作成した鍵に対してCSR（証明書署名要求）を作成（拡張子は .csr や .pem にする場合が多い）
3. 認証局（CA：Certificate Authority）にCSRを送りデジタル署名を受ける
4. 認証局から証明書を受け取る（拡張子は .crt や .pem が多い）

※ 中間認証局が証明書を発行する場合は、ルート認証局が中間認証局を認証して発行される「中間証明書」も必要。 ※ サーバー証明書と中間証明書が結合された状態（fullchain.pem など）で配布・作成される場合もある。

前提

• Ubuntu 18.04
• Server version: Apache/2.4.29 (Ubuntu)

関連ファイル

• サーバ秘密鍵： /etc/ssl/example.com/privkey.pem
• 中間証明書： /etc/ssl/example.com/chain.pem
• 証明書： /etc/ssl/example.com/cert.pem
• 結合証明書（推奨）： /etc/ssl/example.com/fullchain.pem

※ ディレクトリは任意だが /etc/ssl や /etc/ssl/certs / /etc/ssl/private に配置するのが慣習。

Apacheの設定

SSL関連ディレクティブ

• SSLEngine
• SSLCertificateKeyFile: 秘密鍵
• SSLCertificateFile: SSL証明書（Apache 2.4.8以降は中間証明書を含めた fullchain.pem の指定を推奨）
• SSLCertificateChainFile: 中間証明書（※Apache 2.4.8以降は非推奨）

confファイルを設置・編集

/etc/apache2/sites-available/example.com-ssl.conf を作成・編集。

<VirtualHost *:443>
        ServerAdmin webmaster@example.com
        ServerName example.com
        DocumentRoot /var/www/html/example.com/public

        ErrorLog ${APACHE_LOG_DIR}/example.com-error.log
        CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined

        SSLEngine on

        SSLCertificateKeyFile /etc/ssl/example.com/privkey.pem
        SSLCertificateFile    /etc/ssl/example.com/fullchain.pem
</VirtualHost>

HTTPSサイトを有効化

# 1. SSLモジュールの有効化（未有効の場合）
$ sudo a2enmod ssl

# 2. 設定ファイルの有効化
$ cd /etc/apache2/sites-available
$ sudo a2ensite example.com-ssl.conf

# 3. 構文チェック
$ sudo apache2ctl configtest

# 4. Apacheの再読み込み
$ sudo systemctl reload apache2

注意（Certbot 利用時）

Certbot（Let’s Encrypt）を利用する場合、以下のファイルが自動作成・適用されます。

• /etc/apache2/sites-available/example.com-le-ssl.conf
• /etc/letsencrypt/options-ssl-apache.conf

/etc/letsencrypt/options-ssl-apache.conf 内で SSLEngine on やセキュリティ推奨設定が自動的に記述されます。

Apache SSL conf 設定例

SSL 版

Let’s Encrypt を Certbot を使用して設定した場合に以下のファイルが自動で生成されました。

• /etc/apache2/sites-enabled/example.com-le-ssl.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>
        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        #ServerName www.example.com

        ServerAdmin webmaster@localhost
        ServerName example.com
        DocumentRoot /var/www/html/example.com/current/public

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf


        SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem <-- Certbotによって自動で設定
        SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem <-- Certbotによって自動で設定
        Include /etc/letsencrypt/options-ssl-apache.conf <-- Certbotによって自動で設定
</VirtualHost>

</IfModule>

参考までに HTTP 版

<VirtualHost *:80>
        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        #ServerName www.example.com

        ServerAdmin webmaster@localhost
        ServerName example.com
        DocumentRoot /var/www/html/example.com/current/public

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf
        RewriteEngine on
        RewriteCond %{SERVER_NAME} =example.com
        RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>