web-dev-qa-db-ja.com

Let's Encrypt certbotの `enhance`コマンドは正確には何ですか？

暗号化してみましょうcertbotサブコマンドenhanceには、説明「既存の構成にセキュリティ強化を追加する」があります。

certbotのCLIヘルプファイル で見つけることができる唯一の追加情報は次のとおりです。

拡張：既存の構成にセキュリティー拡張機能を追加することにより、TLS構成を強化するのに役立ちます。

それでも、既存の構成にどのエンチャントが追加されるかは明確ではありません。どのファイルが変更されるかなど...私は特にUbuntu + Apache HTTPサーバー（--Apacheオプションを使用）での設定に興味があります。

lets-encryptcertbot
4
Maris B.

私もそれを見つけることができなかったので、 source （および another doc ）を見て、次のように述べています：

security:
  Security parameters & server settings

  --rsa-key-size N      Size of the RSA key. (default: 2048)
  --must-staple         Adds the OCSP Must Staple extension to the
                        certificate. Autoconfigures OCSP Stapling for
                        supported setups (Apache version >= 2.3.3 ). (default:
                        False)
  --redirect            Automatically redirect all HTTP traffic to HTTPS for
                        the newly authenticated vhost. (default: Ask)
  --no-redirect         Do not automatically redirect all HTTP traffic to
                        HTTPS for the newly authenticated vhost. (default:
                        Ask)
  --hsts                Add the Strict-Transport-Security header to every HTTP
                        response. Forcing browser to always use SSL for the
                        domain. Defends against SSL Stripping. (default: None)
  --uir                 Add the "Content-Security-Policy: upgrade-insecure-
                        requests" header to every HTTP response. Forcing the
                        browser to use https:// for every http:// resource.
                        (default: None)
  --staple-ocsp         Enables OCSP Stapling. A valid OCSP response is
                        stapled to the certificate that the server offers
                        during TLS. (default: None)
  --strict-permissions  Require that all configuration files are owned by the
                        current user; only needed if your config is somewhere
                        unsafe like /tmp/ (default: False)

私のテスト環境で試してみました：

certbot --authenticator webroot --installer Apache

[...]
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel):2

Enabled Apache rewrite module
Redirecting vhost in /etc/Apache2/sites-enabled/example.conf to ssl vhost in /etc/Apache2/sites-enabled/example.ssl.conf

-------------------------------------------------------------------------------
Congratulations! You have successfully enabled https://example.com and https://www.example.com

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=example.com



certbot enhance --hsts

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator None, Installer Apache

Which certificate would you like to use to enhance your configuration?
-------------------------------------------------------------------------------
1: example.com
-------------------------------------------------------------------------------
Press 1 [enter] to confirm the selection (press 'c' to cancel):

Which domain names would you like to enable the selected enhancements for?
-------------------------------------------------------------------------------
1: example.com
2: www.example.com
-------------------------------------------------------------------------------
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):

Adding Strict-Transport-Security header to ssl vhost in /etc/Apache2/sites-enabled/example.ssl.conf



certbot enhance --uir

Plugins selected: Authenticator None, Installer Apache

Which certificate would you like to use to enhance your configuration?
-------------------------------------------------------------------------------
1: example.com
-------------------------------------------------------------------------------
Press 1 [enter] to confirm the selection (press 'c' to cancel):

Which domain names would you like to enable the selected enhancements for?
-------------------------------------------------------------------------------
1: example.com
2: www.example.com
-------------------------------------------------------------------------------
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):

Adding Upgrade-Insecure-Requests header to ssl vhost in /etc/Apache2/sites-enabled/example.ssl.conf

あなたは残りのオプションを推測することができます（それらすべてを試したわけではありませんでした）。

サイト対応のssl.confに次の行を追加しました。

Include /etc/letsencrypt/options-ssl-Apache.conf
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
Header always set Strict-Transport-Security "max-age=31536000"
Header always set Content-Security-Policy upgrade-insecure-requests

私のサイトで有効になっている非ssl.confのこれら：

RewriteEngine on
RewriteCond %{SERVER_NAME} =www.example.com [OR]
RewriteCond %{SERVER_NAME} =example.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
4
Lenniey