remix

$ cat /etc/redhat-release
CentOS release 6.9 (Final)

$ uname -r
2.6.32-696.10.1.el6.i686

$ httpd -v
Server version: Apache/2.2.15 (Unix)
Server built:   Jun 19 2018 15:47:03

example.com

/home/taro/web/example.com/document

https://letsencrypt.jp/usage/

https://letsencrypt.jp/usage/install-certbot.html

　CentOS 6 なので EPEL(Extra Packages for Enterprise Linux)リポジトリを導入

$ sudo yum install epel-release
　：
インストール:
  epel-release.noarch 0:6-8

完了しました!

　Certbotクライアントを取得

$ wget https://dl.eff.org/certbot-auto

　実行権付与

$ chmod a+x certbot-auto
$ ll
　：
-rwxrwxr-x  1 taro apache     63234  6月 21 06:21 2018 certbot-auto
　：

　テスト実行

$ ./certbot-auto
Requesting to rerun ./certbot-auto with root privileges...
Bootstrapping dependencies for RedHat-based OSes that will use Python3... (you can skip this with --no-bootstrap)
　：
Creating virtual environment...
Installing Python packages...
Installation succeeded.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): ★メールアドレス

-------------------------------------------------------------------------------
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v01.api.letsencrypt.org/directory
-------------------------------------------------------------------------------
(A)gree/(C)ancel: C	★キャンセルし先にSSL/TLS サーバ証明書の取得
Unable to register an account with ACME server

　ドキュメントルートに

/.well-known/acme-challenge/t***************************b-X***o-6*****I

のようなファイルが作られ該当ドメインにアクセスされるので、http・https ポート開放はもちろん、.htaccess によるリライトやリダイレクトを無効に。
　複数ドメインでもの一つずつSSL証明書を取得したほうが無難。

$ ./certbot-auto certonly --webroot -w /home/taro/web/example.com/document -d example.com -d www.example.com

Requesting to rerun ./certbot-auto with root privileges...
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for example.com
http-01 challenge for www.example.com
Using the webroot path /home/taro/web/example.com/document for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/example.com/privkey.pem
   Your cert will expire on 2018-10-07. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

　下記に生成された

/etc/letsencrypt/live/example.com/cert.pem (サーバ証明書(公開鍵))
/etc/letsencrypt/live/example.com/chain.pem (中間証明書)
/etc/letsencrypt/live/example.com/fullchain.pem (サーバ証明書と中間証明書の結合ファイル)
/etc/letsencrypt/live/example.com/privkey.pem (秘密鍵)

パスを ssl.conf に設定

$ sudo diff /etc/httpd/conf.d/ssl.conf.org /etc/httpd/conf.d/ssl.conf
72a73
> NameVirtualHost *:443
74c75
< <VirtualHost _default_:443>
---
> <VirtualHost *:443>
77,78c78,80
< #DocumentRoot "/var/www/html"
< #ServerName www.example.com:443
---
> DocumentRoot "/home/taro/web/example.com/document"
> ServerName example.com
> ServerAlias www.example.com
82c84
< ErrorLog logs/ssl_error_log
---
> ErrorLog /home/taro/web/example.com/logs/ssl_error_log
105c107,108
< SSLCertificateFile /etc/pki/tls/certs/localhost.crt
---
> SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem
112c115,116
< SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
---
> SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
121c125,126
< #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
---
> SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem
183,185c188,196
< <Directory "/var/www/cgi-bin">
<     SSLOptions +StdEnvVars
< </Directory>
---
> Alias /cgi /home/taro/web/example.com/appli/cgi
> <Location "/cgi">
>       SSLOptions +StdEnvVars
>       Options FollowSymLinks ExecCGI
>       AddHandler cgi-script .cgi
>       Order allow,deny
>       Allow from all
> </Location>
>
218,219c229
< CustomLog logs/ssl_request_log \
<           "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
---
> CustomLog /home/taro/web/example.com/logs/ssl_access_log combined

以下、他ドメインのブロックが続く

　設定ファイルのテスト(証明書の読み取りにルート権限必要)

$ sudo apachectl configtest

　Webサーバを再起動して完了。

$ sudo service httpd restart