■ centosのバージョン確認
cat /etc/redhat-release

■ mod_sslが入っていない場合はインストールする
$ yum -y install mod_ssl

■ Software Collectionを更新
$ yum install centos-release-scl-rh
$ python --version
$ yum install rh-python37
$ vi /etc/profile.d/python37.sh

#!/bin/bash
 
source /opt/rh/rh-python36/enable
export X_SCLS="`scl enable rh-python36 'echo $X_SCLS'`"

■ profileを読み込む（~/.bashrcなどでもよい）
$ source ~/.profile

■ pipをupdate
$ pip install -U pip virtualenv cryptography
(もし/opt/eff.org/certbot/が既にあれば削除して再作成)
$ rm -r /opt/eff.org/certbot/

■ certbotをインストール
$ curl https://dl.eff.org/certbot-auto -o /usr/bin/certbot-auto
curl: (35) SSL connect error

■ どこでつまづいているのかエラー内容を確認
$ curl -L --verbose https://dl.eff.org/certbot-auto -o /usr/bin/certbot-auto

* About to connect() to dl.eff.org port 443 (#0)
*   Trying 151.101.108.201... connected
* Connected to dl.eff.org (151.101.108.201) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12190
* Closing connection #0
* SSL connect error

curl: (35) SSL connect error

■ curlをアップデート
$ yum update curl
$ yum update nss
■ certbotの依存関係を処理するのに使われるパッケージをアップデート
$ yum update libcurl

■ certbotをインストール（再）
$ curl https://dl.eff.org/certbot-auto -o /usr/bin/certbot-auto

■ certbot-autoに実行権限を与える
$ chmod 700 /usr/bin/certbot-auto

■ certbot-autoを動かすと依存パッケージが勝手にインストールされる
$ certbot-auto --version

■ certbot-autoをインストール
$ certbot-auto --version
Bootstrapping dependencies for RedHat-based OSes... (you can skip this with --no-bootstrap)
yum is /usr/bin/yum
yum is hashed (/usr/bin/yum)
Failed to set locale, defaulting to C
Loaded plugins: fastestmirror, priorities, refresh-packagekit, security
Setting up Install Process
...(中略)...
Error: Package: python-devel-2.6.6-66.el6_8.x86_64 (updates)
           Requires: python-libs(x86-64) = 2.6.6-66.el6_8
           Installed: python-libs-2.6.6-68.el6_10.x86_64 (@sl-security)
               python-libs(x86-64) = 2.6.6-68.el6_10
           Available: python-libs-2.6.6-64.el6.x86_64 (base)
               python-libs(x86-64) = 2.6.6-64.el6
           Available: python-libs-2.6.6-66.el6_8.x86_64 (updates)
               python-libs(x86-64) = 2.6.6-66.el6_8
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest
Could not install OS dependencies. Aborting bootstrap!

$ certbot-auto --version --no-bootstrap
certbot 1.9.0

■ 認証用ファイルを設置するディレクトリを作成する
mkdir /var/www/certbot/(任意のドメイン名など)

■ Apacheのバーチャルホスト設定ファイルに追記する
vi /etc/httpd/conf.d/(任意のドメイン).conf

<VirtualHost *:80>
    DocumentRoot /var/www/(ドキュメントルートのディレクトリパス)
    ServerName (設定対象のドメイン名)
...
 
    # for Let's Encrypt
    Alias /.well-known /var/www/certbot/(任意のドメイン名)/.well-known
 
    <Directory /var/www/certbot/(任意のドメイン名)>
        Require all granted
    </Directory>
</VirtualHost>

■ バーチャルホストファイル構成例
example.com.conf　←ポート80の設定用
example.com.ssl.conf　←ポート443(SSL)の設定用
example.com.ssl.conf_200320  (バックアップなどは拡張子をconfから変更することで読み込まれなくなる)

# apachectl -t
CentOS7
# systemctl reload httpd
CentOS6
# service httpd reload

■ 証明書を取得する
# time /usr/bin/certbot-auto certonly \
    --webroot \
    -w /var/www/certbot/sample.domain.jp \
    -d sample.domain.jp \
    --preferred-challenges http \
    -m <登録するメールアドレス>

■ メールアドレスを登録しない場合（--register-unsafely-without-email）
# time /usr/bin/certbot-auto certonly \
    --webroot \
    -w /var/www/certbot/sample.domain.jp \
    -d sample.domain.jp \
    --preferred-challenges http \
    --register-unsafely-without-email

■ 取得テストをする場合（--dry-run）
# time /usr/bin/certbot-auto certonly \
    --webroot \
    -w /var/www/certbot/sample.domain.jp \
    -d sample.domain.jp \
    --preferred-challenges http \
    --register-unsafely-without-email \
    --dry-run

■ 一つの証明書で複数ドメインを認証する場合（適宜、-w,-dを増やす）
# time /usr/bin/certbot-auto certonly \
    --webroot \
    -w /var/www/certbot/sample.domain.jp \
    -d sample.domain.jp \
    -w /var/www/certbot/sample2.domain.jp \
    -d sample2.domain.jp \
    -w /var/www/certbot/www/sample.domain.jp \
    -d www.sample.domain.jp \
    --preferred-challenges http \
    --register-unsafely-without-email

#!/bin/bash
time /usr/bin/certbot-auto certonly \
    --webroot \
    -w /var/www/certbot/sample.domain.jp \
    -d sample.domain.jp \
    --preferred-challenges http \
    --register-unsafely-without-email \
    --dry-run

■ --dry-runで実行
# bash get_sslcert.sh
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for sample.domain.jp
Using the webroot path /var/www/certbot/sample.domain.jp for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - The dry run was successful.

real    0m7.321s
user    0m2.797s
sys     0m0.286s

■ 本番実行（--dry-runをコメントアウト）
# bash get_sslcert.sh
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Registering without email!

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: a　　　←利用規約に同意
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for sample.domain.jp
Using the webroot path /var/www/certbot/sample.domain.jp for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/sample.domain.jp/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/sample.domain.jp/privkey.pem
   Your cert will expire on 2021-02-03. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le


real    0m11.163s
user    0m3.463s
sys     0m0.325s

# ls -l /etc/letsencrypt/live/sample.domain.jp/

■ SSL用のバーチャルホスト設定を作成
# vi /etc/httpd/conf.d/sample.domain.jp.ssl.conf

<VirtualHost *:443>
    DocumentRoot /var/www/sample.domain.jp/public_html
    ServerName sample.domain.jp
...
    <Directory /var/www/certbot/sample.domain.jp>
        Require all granted
    </Directory>
...(↑ここまでは適宜既存の設定に合わせて設定）
...(↓ここの３行が証明書の場所を指定している)
    SSLCertificateFile /etc/letsencrypt/live/sample.domain.jp/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/sample.domain.jp/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/sample.domain.jp/chain.pem
...
</VirtualHost>

# apachectl -t
# service restart httpd

RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

#!/bin/bash

CERTBOT_CMD=/usr/bin/certbot-auto
WEBSERVER_RESTART_CMD="service httpd restart"

echo "===== Update SSL Certfile ====="
echo "`date` Update SSL Certfile start"

# 証明書の更新
${CERTBOT_CMD} renew \
  --post-hook "${WEBSERVER_RESTART_CMD}" \
  --dry-run

LE_STATUS=$?

# 証明書の取得に失敗したときはメールで通知
if [ "$LE_STATUS" != 0 ]; then
    echo "Update SSL Certfile failed"
fi

echo "`date` Update SSL Certfile end"

# EOF

■ update_sslcert.shに実行権限を付与
# chmod 755 /root/bin/update_sslcert.sh ←設置した場所によってパスは適宜

0 5 * * 0 root PATH="/sbin:$PATH" /root/work/update_sslcert.sh 1>> /var/log/update_sslcert.log 2>&1