J'ai installé Let's Encrypt sur mon petit serveur Ubuntu, et je l'utilise sur tous les sites non-IDN qui s'y trouvent. Il a l'option de rediriger automatiquement les sites HTTP vers HTTPS. J'ai sélectionné cette option.
Le démon Let's Encrypt a ajouté trois lignes à chaque conf de domaine, et a créé un nouveau domain-le-ssl.conf pour chaque domaine.
Voici timothy.green.name.conf :
<VirtualHost *:80>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
ServerName timothy.green.name
ServerAdmin webmaster@timothy.green.name
DocumentRoot /var/www/vhosts/timothy.green.name/web
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
RewriteEngine on
RewriteCond %{SERVER_NAME} =timothy.green.name
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]
</VirtualHost>J'ai créé ce fichier, mais le démon Let's Encrypt a ajouté les règles de réécriture à la fin. Il a également créé le nouveau fichier timothy.green.name-le-ssl.conf qui se lit comme suit :
<IfModule mod_ssl.c>
<VirtualHost *:443>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
ServerName timothy.green.name
ServerAdmin webmaster@timothy.green.name
DocumentRoot /var/www/vhosts/timothy.green.name/web
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
RewriteEngine on
RewriteCond %{SERVER_NAME} =timothy.green.name
# Some rewrite rules in this file were were disabled on your HTTPS site,
# because they have the potential to create redirection loops.
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]
SSLCertificateFile /etc/letsencrypt/live/myh2g2.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/myh2g2.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
</IfModule>Tout cela semble correct. Et mod_rewrite est en place :
$ a2enmod rewrite
Module rewrite already enabledEt pourtant, alors que https://timothy.green.name fonctionne bien, http://timothy.green.name me donne un site Apache par défaut. Qu'est-ce qui peut bien se passer ici ? Je répète que je n'ai pas ajouté ces règles de réécriture moi-même : le démon Let's Encrypt s'en est chargé. Je suppose donc que la syntaxe est correcte.
