[Linux] Let’s Encrypt 와일드카드 인증서 설치(Certbot, Feat. Cloudflare)

~]# python3 --version
Python 3.9.18

~]# snap install certbot-dns-cloudflare
error: cannot perform the following tasks:
- Run hook prepare-plug-plugin of snap "certbot" (run hook "prepare-plug-plugin":
-----
Only connect this interface if you trust the plugin author to have root on the system.
Run `snap set certbot trust-plugin-with-root=ok` to acknowledge this and then run this command again to perform the connection.
If that doesn't work, you may need to remove all certbot-dns-* plugins from the system, then try installing the certbot snap again.

# 플러그인이 루트 권한을 필요로 하기 때문에, 설치 전에 신뢰를 확인해야 한다는 내용을 확인 했습니다.
# 신뢰(trust)를 확인하는 명령어 실행 후 다시 진행합니다.

~]# snap set certbot trust-plugin-with-root=ok
~]# snap install certbot-dns-cloudflare
certbot-dns-cloudflare 3.3.0 from Certbot Project (certbot-eff✓) installed

###v 퍄일 예시 ##
# 도메인 1의 Cloudflare API token
dns_cloudflare_api_token_domain1 = 0123456789abcdef0123456789abcdef01234567

# 도메인 2의 Cloudflare API token
dns_cloudflare_api_token_domain2 = 89abcdef0123456789abcdef0123456789abcdef01

~]# cd ~/
~]# mkdir .secrets/certbot
~]# vi .secrets/certbot/cloudflare.ini
dns_cloudflare_api_token_domain1 = 0123456789abcdef0123456789abcdef01234567

#여러 도메인을 한 서버에서 사용할 때 # 
dns_cloudflare_email = myemail@구글.com
dns_cloudflare_api_key = 0123456789abcdef0123456789abcdef01234567

# 자격증명 입력 후 저장하고 나가기 > 파일 권한 설정 # 
chmod 600 .secrets/certbot/cloudflare.ini

certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini \
  -d example.com \
  -d "*.example.com"
  
  # 두 개의 다른 도메인 한꺼번에 받기 # 
  certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini \
  -d domain1.com \
  -d "*.domain.com" \
  -d domain2.com \
  -d "*.domain2.com"
# 자동 갱신 테스트 #
certbot renew --dry-run
# ssl.conf 설정하기 # 
<VirtualHost *:443>
    ServerName mydomain.com
    ServerAlias *.mydomain.com www.mydomain.com
    DocumentRoot /home/myhost/www
    SuexecUserGroup myhost nobody
   <Directory /home/myhost/www>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
  </Directory>
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/mydomain.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/mydomain.com/chain.pem
SSLCACertificateFile /etc/letsencrypt/live/mydomain.com/fullchain.pem
</VirtualHost>
## 아파치 재시작 # 
systemctl restart httpd