[Certbot] 무료 SSL인증서 발급 + 자동(강제)갱신 (Nginx 호스트 환경)

// 패키지 목록 업데이트
sudo apt update

// 설치
sudo apt install nginx -y

// 확인
sudo systemctl status nginx

// 설치
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt install -y nodejs

// 버전 확인
node -v

cd {프로젝트}

// 빌드
npm run build

// 백그라운드 실행 (로그없이)
nohup npm start > /dev/null 2>&1 &

// certbot-test-app.conf
upstream certbot-test-app {
    server 127.0.0.1:3000;
}

server {
    listen 80;
    server_name {도메인};

    location / {
        proxy_pass http://certbot-test-app;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

// 설정 파일 문법 검사
sudo nginx -t

// nginx 중단 없이 설정 재적용
sudo nginx -s reload

upstream certbot-test-app {
    server 127.0.0.1:3000;
}

server {
    listen 80;
    server_name {도메인};

    location /.well-known/acme-challenge/ {
        root /var/www/{도메인}/html;
    }

    location / {
        proxy_pass http://certbot-test-app;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

echo "hello certbot" | sudo tee \
/var/www/{도메인}/html/.well-known/acme-challenge/test

// ex
echo "hello certbot" | sudo tee \
/var/www/test.hwaneehwanee.app/html/.well-known/acme-challenge/test

#!/bin/bash

if [ $# -ne 1 ]; then
  echo "사용법: $0 <DOMAIN>"
  exit 1
fi

DOMAIN=$1

WEBROOT="/var/www/$DOMAIN/html"
EMAIL="{이메일주소}"

if [ ! -d "$WEBROOT" ]; then
  echo "WEBROOT 경로 없음: $WEBROOT"
  exit 1
fi

sudo certbot certonly \
  --webroot \
  -w "$WEBROOT" \
  -d "$DOMAIN" \
  --non-interactive \
  --agree-tos \
  -m "$EMAIL"

if [ $? -eq 0 ]; then
  echo "인증서 발급 성공"

  echo ""
  echo "인증서 경로"
  echo "/etc/letsencrypt/live/$DOMAIN/fullchain.pem"
  echo "/etc/letsencrypt/live/$DOMAIN/privkey.pem"
else
  echo "인증서 발급 실패"
  exit 1
fi

sudo openssl x509 \
  -in /etc/letsencrypt/live/{도메인}/fullchain.pem \
  -text -noout

// ex
sudo openssl x509 \
  -in /etc/letsencrypt/live/test.hwaneehwanee.app/fullchain.pem \
  -text -noout

sudo openssl x509 \
  -in /etc/letsencrypt/live/{도메인}/fullchain.pem \
  -noout -dates

// ex
sudo openssl x509 \
  -in /etc/letsencrypt/live/test.hwaneehwanee.app/fullchain.pem \
  -noout -dates

upstream certbot-test-app {
    server 127.0.0.1:3000;
}

# HTTP → HTTPS 리다이렉트
server {
    listen 80;
    server_name {도메인};

    return 301 https://$host$request_uri;
}

# HTTPS 서비스
server {
    listen 443 ssl http2;
    server_name {도메인};

    ssl_certificate /etc/letsencrypt/live/{도메인}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/{도메인}/privkey.pem;

    location / {
        proxy_pass http://certbot-test-app;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

#!/bin/bash

set -e

# -------------------------
# 사용법 체크
# -------------------------
if [ $# -ne 1 ]; then
  echo "사용법: $0 <DOMAIN>"
  echo "예: $0 home.onecall1.co.kr"
  exit 1
fi

DOMAIN=$1

EMAIL="{이메일주소}"
WEBROOT="/var/www/$DOMAIN/html"

echo "======================================"
echo "Certbot FORCE RENEW START"
echo "DOMAIN: $DOMAIN"
echo "WEBROOT: $WEBROOT"
echo "======================================"

# -------------------------
# webroot 확인
# -------------------------
if [ ! -d "$WEBROOT" ]; then
  echo "WEBROOT 경로 없음: $WEBROOT"
  exit 1
fi

# -------------------------
# certbot 실행 (강제 재발급)
# -------------------------
echo ""
echo "Running certbot (force renewal)..."
echo ""

sudo certbot certonly \
  --webroot \
  -w "$WEBROOT" \
  -d "$DOMAIN" \
  --force-renewal \
  --non-interactive \
  --agree-tos \
  -m "$EMAIL"

# -------------------------
# nginx reload
# -------------------------
echo ""
echo "Reloading nginx..."
echo ""

sudo nginx -t
sudo systemctl reload nginx

echo ""
echo "======================================"
echo "Certbot 재발급 완료!"
echo "DOMAIN: $DOMAIN"
echo "======================================"