Lighttpd 網頁伺服器 SSL 憑證申請(Let's Encrypt)

1. 加入 Debian 8 "Jessie" Backports 套件庫

# vim /etc/apt/sources.list

deb http://httpredir.debian.org/debian jessie-backports main contrib non-free

2. 安裝 letsencrypt 套件

# apt-get install certbot

3. 申請 SSL 憑證

# certbot certonly --webroot -w /var/www/html -d mydomain.com

4. 混合 privkey.pem 與 cert.pem 成為 ssl.pem

cd /etc/letsencrypt/live/mydomain.com/
cat privkey.pem cert.pem > ssl.pem

(註)產生的 PEM 檔存在 /etc/letsencrypt/live/mydomain.com/ 下面

5. 啟用 lighttpd SSL 功能

# vim /etc/lighttpd/conf-enabled/10-ssl.conf

$SERVER["socket"] == ":443" {
  ssl.engine = "enable"
  ssl.pemfile = "/etc/letsencrypt/live/domain.com/ssl.pem"
  ssl.ca-file =  "/etc/letsencrypt/live/domain.com/fullchain.pem"
  ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM:AES128+EECDH:AES128+EDH"
  
  ssl.honor-cipher-order = "enable"  
  ssl.use-sslv2 = "disable"
  ssl.use-sslv3 = "disable"  
  
  # Using command "openssl dhparam -out dhparam.pem 4096" 
  # to generate a prime for Diffie-Hellman key exchange.
  ssl.dh-file = "/etc/ssl/certs/dhparam.pem"
  ssl.ec-curve = "secp384r1"  
}

從 lighttpd 1.4.46 起 mod_openssl 成為獨立模組，改為下列設定
# apt-get install lighttpd-mod-openssl

# minimal configuration
server.modules += ("mod_openssl")
$SERVER["socket"] == ":443" {
  # main site SSL
  ssl.engine = "enable"
  ssl.pemfile = "/path/site1/fullchain.pem"
  ssl.privkey = "/path/site1/privkey.pem"
  
  # site2 if need
  $HTTP["host"] == "site2.example.com" {
    ssl.pemfile = "/path/site2/fullchain.pem"
    ssl.privkey = "/path/site2/privkey.pem"
  }  
}

6. 重新續約憑證

由於 Let's Encrypt 發出的憑證僅有 90 天效期，需定期更新以維持憑證效力。
# certbot renew
# cat privkey.pem cert.pem > ssl.pem (路徑 /etc/letsencrypt/live/mydomain.com/)
# /etc/init.d/lighttpd force-reload

7. 線上SSL檢測工具

• Qualys SSL Labs 

Lighttpd SSL 加密連線設定

使用 OpenSSL 製作憑證

1. 產生 Private Key
# openssl genrsa -out private.key 1024

2. 使用私鑰產出 Certificate Signing Request(CSR)
# openssl req -new -key private.key -out server.csr

3. 產生 SSL Certificate(CRT)
# openssl x509 -req -days 365 -in server.csr -signkey private.key -out server.crt

4. 把 Private Key 與 CRT 倒在一起，成為 PEM 檔案
# cat private.key server.crt > server.pem

修改 Lighttpd 連線設定

1. 把檔案都丟到 /etc/lighttpd/ssl/ 下面
# cp * /etc/lighttpd/ssl/

2. 更改檔案擁有者
# chown -R www-data:www-data /etc/lighttpd/ssl/*

3. 設定 lighttpd 的 SSL 模組
# vim /etc/lighttpd/conf-enabled10-ssl.conf

$SERVER["socket"] == "0.0.0.0:443" {
ssl.engine = "enable"
ssl.pemfile = "/etc/lighttpd/ssl/server.pem"
}

4. 重新啟動 lighttpd
憑證只有在 lighttpd 啟動時會載入一次，所以當有新憑證產生，記得重新啟動。
# /etc/init.d/lighttpd restart

lighttpd rewrite rule for wordpress 3

新版的 Wordpress 3 架構，讓原有的 rewrite rule 無法正常運作。所以要改成下列：

$HTTP["host"] == "www.site.com" {
  url.rewrite-final = (
 
    # Exclude some directories from rewriting
    "^/(wp-admin|wp-includes|wp-content|gallery2)/(.*)" => "$0",
 
    # Exclude .php files at root from rewriting
    "^/(.*.php)" => "$0",
    "^/sitemap.xml" => "$0" ,
 
    # Handle permalinks and feeds
    "^/(.*)$" => "/index.php/$1"
  )
}