ubuntu lampSSL證書安裝

Installing SSL Certificates for Ubuntu LAMP (Linux, Apache, MySQL, PHP)

This guide walks through the process of installing an SSL certificate on an Ubuntu server running the LAMP stack (Apache as the web server). SSL/TLS encryption is essential for securing data transmitted between your website and users.

1. Prepare for SSL Installation

Before configuring Apache, obtain an SSL certificate from a trusted Certificate Authority (CA). You can use a free CA like Let’s Encrypt or purchase a commercial certificate. After applying for the certificate, you’ll receive the following files:

• Certificate file: Ends with .crt (e.g., your_domain.crt).
• Private key file: Ends with .key (e.g., your_domain.key).
• Certificate chain file (optional but recommended): Ends with .ca-bundle or .chain.crt (e.g., your_domain.ca-bundle). These files validate your certificate’s authenticity.

Save these files in secure directories on your server—for example, /etc/ssl/certs/ for certificates and /etc/ssl/private/ for the private key. Restrict access to the private key to prevent unauthorized use:

sudo chmod 600 /etc/ssl/private/your_domain.key

2. Install Apache and Enable SSL Module

Ensure Apache is installed on your Ubuntu system. If not, install it using:

sudo apt update
sudo apt install apache2

The mod_ssl module is required to enable HTTPS functionality in Apache. Enable it with:

sudo a2enmod ssl

Restart Apache to apply changes:

sudo systemctl restart apache2

3. Configure Apache Virtual Host for HTTPS

Edit your Apache virtual host configuration to enable SSL. For a single site, modify the default HTTPS virtual host file (located at /etc/apache2/sites-available/default-ssl.conf) or create a new file for your domain.

Add the following block to configure HTTPS (replace placeholders with your actual domain and file paths):

<VirtualHost *:443>
    ServerName www.yourdomain.com
    DocumentRoot /var/www/html

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/your_domain.crt
    SSLCertificateKeyFile /etc/ssl/private/your_domain.key
    SSLCertificateChainFile /etc/ssl/certs/your_domain.ca-bundle  # Optional but recommended

    # Recommended SSL Protocols and Ciphers (for security)
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES128-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
</VirtualHost>

If you’re using name-based virtual hosts, ensure the <VirtualHost *:443> block is included for each domain.

4. Enable the SSL Site and Restart Apache

Enable the SSL site configuration using the a2ensite command (replace default-ssl with your custom config file name if needed):

sudo a2ensite default-ssl

Check for syntax errors in the Apache configuration:

sudo apache2ctl configtest

If the test returns Syntax OK, restart Apache to apply the SSL configuration:

sudo systemctl restart apache2

5. Verify SSL Installation

Open a web browser and navigate to https://yourdomain.com. Look for a lock icon in the address bar, indicating that the connection is secure. Click the lock to view certificate details (e.g., issuer, validity period).

For a more thorough check, use an online tool like SSL Labs’ SSL Server Test to verify protocol support, cipher strength, and configuration errors.

6. Set Up Automatic Certificate Renewal (Optional but Recommended)

If you used Let’s Encrypt (free certificates), set up automatic renewal to avoid expiration. Let’s Encrypt certificates are valid for 90 days, so regular renewal is critical.

Enable the Certbot renewal timer:

sudo systemctl enable certbot.timer
sudo systemctl start certbot.timer

Test the renewal process manually to ensure it works:

sudo certbot renew --dry-run

This command simulates a renewal and checks for errors. If successful, Certbot will automatically renew your certificates before they expire.

By following these steps, you’ll successfully install and configure an SSL certificate on your Ubuntu LAMP server, enabling secure HTTPS connections for your website.