Let's EncryptでサイトをSSL対応にし証明書を自動更新する

$ cd ~
$ wget https://dl.eff.org/certbot-auto
$ sudo cp certbot-auto /usr/bin/certbot-auto
$ sudo chmod 700 /usr/bin/certbot-auto
$ sudo chown root:root /usr/bin/certbot-auto

$ cd ~
$ sudo apt-get install git
$ git clone https://github.com/certbot/certbot
$ sudo cp ./certbot/certbot-auto /usr/bin/certbot-auto
$ sudo chmod 700 /usr/bin/certbot-auto
$ sudo chown root:root /usr/bin/certbot-auto

$ sudo ufw allow 443/tcp
$ sudo ufw status
To                         Action      From
--                         ------      ----
443/tcp                    ALLOW       Anywhere
443/tcp (v6)               ALLOW       Anywhere (v6)

$ sudo certbot-auto -h
　　（略）
  --apache          Use the Apache plugin for authentication & installation
  --standalone      Run a standalone webserver for authentication
  --nginx           Use the Nginx plugin for authentication & installation
  --webroot         Place files in a server's webroot folder for authentication
  --manual          Obtain certs interactively, or using shell script hooks
　　（略）

$ sudo certbot-auto certonly --standalone

Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel):[ご自身のメールアドレスを入力してください]

-------------------------------------------------------------------------------
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf. You must agree
in order to register with the ACME server at
https://acme-v01.api.letsencrypt.org/directory
-------------------------------------------------------------------------------
(A)gree/(C)ancel: A


-------------------------------------------------------------------------------
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about EFF and
our work to encrypt the web, protect its users and defend digital rights.
-------------------------------------------------------------------------------
(Y)es/(N)o: N # 心が狭くて恐縮です

Please enter in your domain name(s) (comma and/or space separated)  (Enter 'c'
to cancel):[ご自身のサイトのドメインをサブドメイン含めて]

Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for wwld.jp
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/0000_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pem

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/wwld.jp/fullchain.pem. Your cert will expire
   on 2017-05-29. To obtain a new or tweaked version of this
   certificate in the future, simply run certbot-auto again. To
   non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

$ sudo ls -al /etc/letsencrypt/live/[domain]/
total 12
drwxr-xr-x 2 root root 4096 Feb 28 19:07 .
drwx------ 3 root root 4096 Feb 28 19:07 ..
lrwxrwxrwx 1 root root   31 Feb 28 19:07 cert.pem -> ../../archive/[domain]/cert1.pem
lrwxrwxrwx 1 root root   32 Feb 28 19:07 chain.pem -> ../../archive/[domain]/chain1.pem
lrwxrwxrwx 1 root root   36 Feb 28 19:07 fullchain.pem -> ../../archive/[domain]/fullchain1.pem
lrwxrwxrwx 1 root root   34 Feb 28 19:07 privkey.pem -> ../../archive/[domain]/privkey1.pem
-rw-r--r-- 1 root root  543 Feb 28 19:07 README

Failed authorization procedure. wwld.jp (tls-sni-01): urn:acme:error:connection :: 
The server could not connect to the client to verify the domain :: Failed to connect to xxx.xxx.xxx.xxx:443 for TLS-SNI-01 challenge

$ sudo vim /etc/nginx/sites-available/wwld.jp

# 既存のhttpの記述（まだ触れない）
server {
        listen       80;
        server_name  wwld.jp;
        ...
}

# 新規に追加したhttpsの記述
server {
        listen                443;
        server_name           wwld.jp;
        ssl                   on;
        ssl_certificate       /etc/letsencrypt/live/wwld.jp/fullchain.pem;
        ssl_certificate_key   /etc/letsencrypt/live/wwld.jp/privkey.pem;
        root                  /type/your/site/dir;
        access_log            /type/your/log/path.log;
        index                 index.html;

        location / {
                try_files $uri $uri/ =404;
        }
}

$ sudo service nginx configtest
$ sudo service nginx reload

server {
        listen       80;
        server_name  wwld.jp;
		# リダイレクトの設定を追加
        return  301 https://wwld.jp$request_uri;
}

server {
        listen                443;
        server_name           wwld.jp;
        ssl                   on;
        ssl_certificate       /etc/letsencrypt/live/wwld.jp/fullchain.pem;
        ssl_certificate_key   /etc/letsencrypt/live/wwld.jp/privkey.pem;
        root                  /type/your/site/dir;
        access_log            /type/your/log/path.log;
        index                 index.html;

        location / {
                try_files $uri $uri/ =404;
        }
}

$ sudo service nginx configtest
$ sudo service nginx reload

$ sudo crontab -e 
0 1 * * 0 certbot-auto renew --post-hook "service nginx reload" 1 > /dev/null 2 > /dev/null