これはハマった。
AWSでは未だLetsencryptは対応していないので
むりやり–debugをつけて対応すればいいのですが、
最近はつけなくていいようになりました。
今回一から導入までハマった様子をご覧頂きたい。
■environment
・EC2
・nginx 1.12.1
・Domain adachin.test.com
・Documentroot /usr/share/nginx/html
とりあえず導入なのでベーシックは外し、443と80portはフルで開放する。
■git clone Letsencrypt
・clone
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
/etc# git clone https://github.com/letsencrypt/letsencrypt Cloning into 'letsencrypt'... remote: Counting objects: 49768, done. remote: Compressing objects: 100% (75/75), done. remote: Total 49768 (delta 63), reused 57 (delta 33), pack-reused 49660 Receiving objects: 100% (49768/49768), 15.43 MiB | 1.75 MiB/s, done. Resolving deltas: 100% (35600/35600), done. /etc# cd letsencrypt /etc/letsencrypt# ls AUTHORS.md ISSUE_TEMPLATE.md certbot-auto certbot-dns-google docs setup.cfg CHANGELOG.md LICENSE.txt certbot-compatibility-test certbot-dns-luadns examples setup.py CHANGES.rst MANIFEST.in certbot-dns-cloudflare certbot-dns-nsone letsencrypt-auto tests CONTRIBUTING.md README.rst certbot-dns-cloudxns certbot-dns-rfc2136 letsencrypt-auto-source tools Dockerfile acme certbot-dns-digitalocean certbot-dns-route53 letshelp-certbot tox.cover.sh Dockerfile-dev certbot certbot-dns-dnsimple certbot-nginx linter_plugin.py tox.ini Dockerfile-old certbot-apache certbot-dns-dnsmadeeasy docker-compose.yml readthedocs.org.requirements.txt |
・letsencrypt-auto
|
1 2 3 4 5 6 |
/etc/letsencrypt# ./letsencrypt-auto certonly --webroot -w /usr/share/nginx/html -d adachin.test.com --email adachin@gmail.com FATAL: Amazon Linux support is very experimental at present... if you would like to work on improving it, please ensure you have backups and then run this script again with the --debug flag! Alternatively, you can install OS dependencies yourself and run this script again with --no-bootstrap. |
これこれ。
–no-bootstrapつけてやってみる。
|
1 2 3 4 5 6 7 8 9 10 11 12 |
/etc/letsencrypt# ./letsencrypt-auto certonly --webroot -w /usr/share/nginx/html -d adachin.test.com --email adachin@gmail.com --no-bootstrap Creating virtual environment... Installing Python packages... Installation succeeded. Traceback (most recent call last): File "/opt/eff.org/certbot/venv/bin/letsencrypt", line 7, in <module> from certbot.main import main File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/certbot/main.py", line 7, in <module> import zope.component File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/zope/component/__init__.py", line 16, in <module> from zope.interface import Interface ImportError: No module named interface |
こんなエラーわからないｗ
あえて–debugつけてやってみた。
|
1 2 3 4 5 6 7 8 9 10 |
/etc/letsencrypt# ./letsencrypt-auto certonly --webroot -w /usr/share/nginx/html -d adachin.test.com --email adachin@gmail.com --no-bootstrap --debug Error: couldn't get currently installed version for /opt/eff.org/certbot/venv/bin/letsencrypt: Traceback (most recent call last): File "/opt/eff.org/certbot/venv/bin/letsencrypt", line 7, in <module> from certbot.main import main File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/certbot/main.py", line 7, in <module> import zope.component File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/zope/component/__init__.py", line 16, in <module> from zope.interface import Interface ImportError: No module named interface |
特にエラーは変わらない。
なので
PYTHON_INSTALL_LAYOUT 環境変数を削除してみる。
(PYTHON_INSTALL_LAYOUT=amznこんなの入ってたので)
|
1 2 3 4 |
# env | grep PYTHON_INSTALL_LAYOUT PYTHON_INSTALL_LAYOUT=amzn # unset PYTHON_INSTALL_LAYOUT |
もう一度実行。
|
1 2 3 4 5 6 7 8 9 |
/etc/letsencrypt# ./letsencrypt-auto certonly --webroot -w /usr/share/nginx/html -d adachin.test.com --email adachin@gmail.com --no-bootstrap Error: couldn't get currently installed version for /opt/eff.org/certbot/venv/bin/letsencrypt: Traceback (most recent call last): File "/opt/eff.org/certbot/venv/bin/letsencrypt", line 7, in <module> from certbot.main import main File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/certbot/main.py", line 7, in <module> import zope.component File "/opt/eff.org/certbot/venv/local/lib/python2.7/dist-packages/zope/component/__init__.py", line 16, in <module> from zope.interface import Interface |
また特にエラー変わらない。
一旦/opt/eff.org配下消して環境変数消してcertbot-autoコマンドでやってみよう！
ダメならブチ切れ！ｗ
|
1 2 3 4 5 6 7 8 9 |
# rm -rf /opt/eff.org/ # unset PYTHON_INSTALL_LAYOUT /etc/letsencrypt# ./certbot-auto certonly --webroot -w /usr/share/nginx/html -d adachin.test.com --email adachin@gmail.com --no-bootstrap Creating virtual environment... Installing Python packages... Installation succeeded. ebroot does not exist or is not a directory |
挙動変わった！
とりあえずebrootディレクトリを作ってみる。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
/etc/letsencrypt# mkdir ebroot /etc/letsencrypt# ./certbot-auto certonly --webroot -w /usr/share/nginx/html -d adachin.test.com --email adachin@gmail.com --no-bootstrap Saving debug log to /var/log/letsencrypt/letsencrypt.log Failed to find executable apachectl in expanded PATH: /sbin:/bin:/usr/sbin:/usr/bin:/opt/aws/bin:/usr/local/bin:/usr/local/sbin How would you like to authenticate with the ACME CA? ------------------------------------------------------------------------------- 1: Nginx Web Server plugin - Alpha (nginx) 2: Spin up a temporary webserver (standalone) 3: Place files in webroot directory (webroot) ------------------------------------------------------------------------------- Select the appropriate number [1-3] then [enter] (press 'c' to cancel): 2 Plugins selected: Authenticator standalone, Installer None Obtaining a new certificate Performing the following challenges: tls-sni-01 challenge for adachin.test.com Waiting for verification... Cleaning up challenges IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: ~省略~ |
ｷﾀ━━━━(ﾟ∀ﾟ)━━━━!!
■まとめ
とりあえずEC2の場合はletsencrypt-autoではなくcertbot-autoの方がいいのかもしれない。(どっちでもOK)
重要なのはPythonの環境変数削除すればOKなはず。
ダメなら/opt/eff.org配下を削除してPythonの環境変数削除する。
これでもダメなら以下のようにpip関連をバージョンアップしてみよう。
|
1 2 3 |
# pip install --upgrade pip # pip install cryptography --upgrade # pip install pyopenssl |
早くAWSも神対応してくれ….
参考
https://cupse.net/ec2_ssl_update_error/
https://blog.vtryo.me/infra-engneering/amazonlinux-letsencrypt-error
0件のコメント