<p>출처1 :&nbsp;<a href="https://github.com/acmesh-official/acme.sh/wiki/dnsapi#10-use-amazon-route53-domain-api" target="_blank">https://github.com/acmesh-official/acme.sh/wiki/dnsapi#10-use-amazon-route53-domain-api</a></p><p>출처2 : <a href="https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Amazon-Route53-API" target="_blank">https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Amazon-Route53-API</a></p><p><br></p><p><br></p><p>DSM 7.x를 기준으로 작성된 글</p><p><br></p><h3>아래 글을 먼저 읽고 다음 cmd를 확인해보자.</h3><p><a href="https://hvy.kr/post/9" target="_blank">https://hvy.kr/post/9</a><br></p><p><br></p><p><br></p><div style="color: rgb(212, 212, 212); background-color: rgb(30, 30, 30); font-family: Consolas, &quot;Courier New&quot;, monospace; font-size: 14px; line-height: 19px; white-space: pre;"><br><div><span style="color: #6a9955;">###acme 설치</span></div><div><span style="color: #6a9955;">## 설치</span></div><div><span style="color: #6a9955;"># ROOT 계정으로 설치</span></div><div>sudo -i</div><div><span style="color: #dcdcaa;">cd</span> ~</div><div>wget https://github.com/acmesh-official/acme.sh/archive/master.tar.gz</div><div>tar xvf master.tar.gz</div><div><span style="color: #dcdcaa;">cd</span> acme.sh-master/</div><div>./acme.sh --install --nocron --accountemail <span style="color: #ce9178;">"knw1234@gmail.com"</span></div><br><div><span style="color: #6a9955;"># ssh 다시 붙으면 acme.sh 명령어를 아무곳에서나 사용가능</span></div><br><br><div><span style="color: #6a9955;">## 인증서 발급</span></div><div><span style="color: #6a9955;"># AWS ROUTE53을 사용중이라서 다음과 같이 설정함</span></div><div><span style="color: #6a9955;"># https://github.com/acmesh-official/acme.sh/wiki/dnsapi#10-use-amazon-route53-domain-api</span></div><div><span style="color: #6a9955;"># https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Amazon-Route53-API</span></div><br><div><span style="color: #6a9955;"># route53 수정용 계정 생성 및 권한 추가</span></div><div>{</div><div>&nbsp; &nbsp; <span style="color: #ce9178;">"Version"</span>: <span style="color: #ce9178;">"2012-10-17"</span>,</div><div>&nbsp; &nbsp; <span style="color: #ce9178;">"Statement"</span>: [</div><div>&nbsp; &nbsp; &nbsp; &nbsp; {</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #ce9178;">"Effect"</span>: <span style="color: #ce9178;">"Allow"</span>,</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #ce9178;">"Action"</span>: [</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #ce9178;">"route53:GetHostedZone"</span>,</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #ce9178;">"route53:ListHostedZones"</span>,</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #ce9178;">"route53:ListHostedZonesByName"</span>,</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #ce9178;">"route53:GetHostedZoneCount"</span>,</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #ce9178;">"route53:ChangeResourceRecordSets"</span>,</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #ce9178;">"route53:ListResourceRecordSets"</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ],</div><div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #ce9178;">"Resource"</span>: <span style="color: #ce9178;">"*"</span></div><div>&nbsp; &nbsp; &nbsp; &nbsp; }</div><div>&nbsp; &nbsp; ]</div><div>}</div><br><div><span style="color: #6a9955;"># 생성한 계정의 key를 환경변수로 등록</span></div><div><span style="color: #569cd6;">export</span> &nbsp;AWS_ACCESS_KEY_ID=XXXXXXXXXXXXXXXX</div><div><span style="color: #569cd6;">export</span> &nbsp;AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXXX</div><div><span style="color: #569cd6;">export</span> &nbsp;AWS_DNS_SLOWRATE=1</div><br><div><span style="color: #6a9955;"># 인증서 발급(시간이 생각보다 꽤나 걸린다 5분?)</span></div><div>acme.sh --issue --dns dns_aws -d hvy.kr -d <span style="color: #ce9178;">'*.hvy.kr'</span></div><br><div><span style="color: #6a9955;">## 인증서 복사</span></div><div><span style="color: #6a9955;"># 아래 명령어에서 나온 게 default 값(파이썬에 들어가 있음)</span></div><div>cat /usr/syno/etc/certificate/_archive/DEFAULT</div><div><span style="color: #6a9955;"># 기본 인증서는 default 값을 베이스로 한다(파이썬에 들어가 있음)</span></div><div>/usr/syno/etc/certificate/_archive/{default}/cert.pem</div><br><br><div><span style="color: #6a9955;"># 파이썬으로 인증서 복사</span></div><div><div style="font-family: D2Coding, Consolas, &quot;Courier New&quot;, monospace, Menlo, Monaco, &quot;Courier New&quot;, monospace; font-size: 13px; line-height: 20px;"><div>cat &lt;&lt;EOF &gt; /certificate_copy.py</div><div><span style="color: #569cd6;">import</span> <span style="color: #569cd6;">shutil</span></div><div><span style="color: #569cd6;">import</span> <span style="color: #569cd6;">json</span></div><div><span style="color: #569cd6;">import</span> <span style="color: #569cd6;">os</span></div><br><div>originBase = <span style="color: #ce9178;">"/root/.acme.sh/hvy.kr/"</span></div><div>targetBase = <span style="color: #ce9178;">"/usr/syno/etc/certificate/"</span></div><br><br><div><span style="color: #569cd6;">def</span> <span style="color: #dcdcaa;">getDefaultDir</span>():</div><div>    defaultDir = <span style="color: #ce9178;">""</span></div><div>    with open(<span style="color: #ce9178;">"/usr/syno/etc/certificate/_archive/DEFAULT"</span>, <span style="color: #ce9178;">'r'</span>) as defaultPosition:</div><div>        defaultDir = defaultPosition.read().splitlines()[<span style="color: #b5cea8;">0</span>]</div><div>    <span style="color: #c586c0;">return</span> defaultDir</div><br><br><div><span style="color: #569cd6;">def</span> <span style="color: #dcdcaa;">copyDefault</span>():</div><div>    # 기본 인증서 교체</div><div>    targetPath = os.path.join(targetBase, <span style="color: #ce9178;">"_archive"</span>, getDefaultDir())</div><div>    shutil.copy(os.path.join(originBase, <span style="color: #ce9178;">"hvy.kr.cer"</span>), os.path.join(targetPath, <span style="color: #ce9178;">"cert.pem"</span>))</div><div>    shutil.copy(os.path.join(originBase, <span style="color: #ce9178;">"ca.cer"</span>), os.path.join(targetPath, <span style="color: #ce9178;">"chain.pem"</span>))</div><div>    shutil.copy(os.path.join(originBase, <span style="color: #ce9178;">"fullchain.cer"</span>), os.path.join(targetPath, <span style="color: #ce9178;">"fullchain.pem"</span>))</div><div>    shutil.copy(os.path.join(originBase, <span style="color: #ce9178;">"hvy.kr.key"</span>), os.path.join(targetPath, <span style="color: #ce9178;">"privkey.pem"</span>))</div><br><br><div><span style="color: #569cd6;">def</span> <span style="color: #dcdcaa;">copyService</span>():</div><div>    # 서비스용 인증서 교체</div><div>    certificateInfo = <span style="color: #ce9178;">""</span></div><div>    with open(<span style="color: #ce9178;">"/usr/syno/etc/certificate/_archive/INFO"</span>, <span style="color: #ce9178;">'r'</span>) as infoFile:</div><div>        certificateInfo = json.load(infoFile)</div><br><div>    # <span style="color: #4ec9b0;">The</span> contents of cat <span style="color: #d16969;">/usr/</span>syno<span style="color: #d16969;">/etc/</span>certificate<span style="color: #d16969;">/_archive/</span><span style="color: #9cdcfe;">DEFAULT</span> </div><div>    # should be in place of <span style="color: #4ec9b0;">XyiB0H</span></div><div>    localCertificate = certificateInfo.get(<span style="color: #ce9178;">"XyiB0H"</span>)</div><div>    services = localCertificate.get(<span style="color: #ce9178;">"services"</span>)</div><br><div>    <span style="color: #c586c0;">for</span> service in services:</div><br><div>        <span style="color: #c586c0;">if</span> service.get(<span style="color: #ce9178;">"subscriber"</span>) != <span style="color: #ce9178;">"ReverseProxy"</span> :</div><div>            <span style="color: #c586c0;">continue</span></div><div>        </div><div>        <span style="color: #dcdcaa;">print</span>(service)</div><br><div>        path = os.path.join(targetBase, service.get(<span style="color: #ce9178;">"subscriber"</span>), service.get(<span style="color: #ce9178;">"service"</span>))</div><div>        <span style="color: #dcdcaa;">print</span>(<span style="color: #ce9178;">"target : "</span> + path)</div><div>        shutil.copy(os.path.join(originBase, <span style="color: #ce9178;">"hvy.kr.cer"</span>), os.path.join(path, <span style="color: #ce9178;">"cert.pem"</span>))</div><div>        shutil.copy(os.path.join(originBase, <span style="color: #ce9178;">"ca.cer"</span>), os.path.join(path, <span style="color: #ce9178;">"chain.pem"</span>))</div><div>        shutil.copy(os.path.join(originBase, <span style="color: #ce9178;">"fullchain.cer"</span>), os.path.join(path, <span style="color: #ce9178;">"fullchain.pem"</span>))</div><div>        shutil.copy(os.path.join(originBase, <span style="color: #ce9178;">"hvy.kr.key"</span>), os.path.join(path, <span style="color: #ce9178;">"privkey.pem"</span>))</div><br><br><div><span style="color: #c586c0;">if</span> __name__ == <span style="color: #ce9178;">'__main__'</span>:</div><div>    copyDefault()</div><div>    copyService()</div><div>    <span style="color: #dcdcaa;">print</span>(<span style="color: #ce9178;">"copy complete!!"</span>)</div><div>EOF</div><div><br></div><div><br></div></div></div><div>/bin/python /root/certificate_copy.py</div><br><div><span style="color: #6a9955;"># nginx 서비스 재시작(DSM 6.x)</span></div><div>/usr/syno/sbin/synoservicectl --reload nginx</div><br><div><span style="color: #6a9955;"># nginx 서비스 재시작(DSM 7.x)</span></div><div>systemctl restart nginx</div><br><br><div><span style="color: #6a9955;">#===================================================================================================================</span></div><div><span style="color: #6a9955;">### 자동 갱신</span></div><div><span style="color: #6a9955;">## 시놀로지 작업 스케줄러에 등록한다</span></div><div><span style="color: #569cd6;">export</span> &nbsp;AWS_ACCESS_KEY_ID=XXXXXXXXXXXXXXXX</div><div><span style="color: #569cd6;">export</span> &nbsp;AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXXX</div><div><span style="color: #569cd6;">export</span> &nbsp;AWS_DNS_SLOWRATE=1</div><br><div><span style="color: #6a9955;">#인증서 재발급</span></div><div>/root/.acme.sh/acme.sh --issue --force --dns dns_aws -d hvy.kr -d <span style="color: #ce9178;">'*.hvy.kr'</span></div><br><div><span style="color: #6a9955;"># 복사</span></div><div>/bin/python /root/certificate_copy.py</div><br><div><span style="color: #6a9955;"># 재시작</span></div><div>/bin/systemctl restart nginx</div><br></div><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p>

시놀로지 Let's Encrypt 인증서 등록하기 synology (AWS Route53 사용)