{"id":16,"date":"2026-03-21T06:01:33","date_gmt":"2026-03-20T23:01:33","guid":{"rendered":"https:\/\/ivi.vn\/blog\/huong-dan-ssl-lets-encrypt\/"},"modified":"2026-08-24T16:00:20","modified_gmt":"2026-08-24T09:00:20","slug":"huong-dan-ssl-lets-encrypt","status":"publish","type":"post","link":"https:\/\/ivi.vn\/blog\/huong-dan-ssl-lets-encrypt\/","title":{"rendered":"H\u01b0\u1edbng d\u1eabn l\u1ea5y ch\u1ee9ng ch\u1ec9 SSL Let&#8217;s Encrypt"},"content":{"rendered":"<p>Ch\u1ee9ng ch\u1ec9 SSL gi\u1edd kh\u00f4ng c\u00f2n l\u00e0 h\u1ea1ng m\u1ee5c &#8220;n\u00ean c\u00f3&#8221;. Tr\u00ecnh duy\u1ec7t g\u1eafn nh\u00e3n c\u1ea3nh b\u00e1o cho trang kh\u00f4ng m\u00e3 ho\u00e1, bi\u1ec3u m\u1eabu b\u1ecb ch\u1eb7n, v\u00e0 m\u1ecdi t\u00ednh n\u0103ng hi\u1ec7n \u0111\u1ea1i c\u1ee7a tr\u00ecnh duy\u1ec7t \u0111\u1ec1u y\u00eau c\u1ea7u k\u1ebft n\u1ed1i an to\u00e0n. Let&#8217;s Encrypt c\u1ea5p ch\u1ee9ng ch\u1ec9 mi\u1ec5n ph\u00ed, t\u1ef1 \u0111\u1ed9ng, nh\u01b0ng ch\u1ec9 t\u1ef1 \u0111\u1ed9ng khi b\u1ea1n c\u1ea5u h\u00ecnh \u0111\u00fang ngay t\u1eeb \u0111\u1ea7u.<\/p>\n<p>B\u00e0i n\u00e0y gi\u1ea3i th\u00edch c\u01a1 ch\u1ebf \u0111\u1eb1ng sau \u2014 giao th\u1ee9c ACME, c\u00e1c ki\u1ec3u x\u00e1c minh, chu k\u1ef3 90 ng\u00e0y \u2014 r\u1ed3i m\u1edbi t\u1edbi thao t\u00e1c. Hi\u1ec3u c\u01a1 ch\u1ebf l\u00e0 c\u00e1ch duy nh\u1ea5t \u0111\u1ec3 x\u1eed l\u00fd \u0111\u01b0\u1ee3c l\u00fac gia h\u1ea1n t\u1ef1 \u0111\u1ed9ng im l\u1eb7ng th\u1ea5t b\u1ea1i l\u00fac 2 gi\u1edd s\u00e1ng.<\/p>\n<h2>ACME: ch\u1ee9ng ch\u1ec9 \u0111\u01b0\u1ee3c c\u1ea5p b\u1eb1ng c\u00e1ch n\u00e0o<\/h2>\n<p>Let&#8217;s Encrypt l\u00e0 m\u1ed9t t\u1ed5 ch\u1ee9c c\u1ea5p ch\u1ee9ng ch\u1ec9 ho\u1ea1t \u0111\u1ed9ng ho\u00e0n to\u00e0n t\u1ef1 \u0111\u1ed9ng qua giao th\u1ee9c <strong>ACME<\/strong> (Automatic Certificate Management Environment). Kh\u00f4ng c\u00f3 bi\u1ec3u m\u1eabu \u0111\u1ec3 \u0111i\u1ec1n, kh\u00f4ng c\u00f3 nh\u00e2n vi\u00ean duy\u1ec7t. Tr\u00ecnh t\u1ef1 lu\u00f4n l\u00e0:<\/p>\n<ol>\n<li>Ph\u1ea7n m\u1ec1m tr\u00ean m\u00e1y b\u1ea1n (ACME client) t\u1ea1o m\u1ed9t c\u1eb7p kho\u00e1 t\u00e0i kho\u1ea3n v\u00e0 \u0111\u0103ng k\u00fd v\u1edbi t\u1ed5 ch\u1ee9c c\u1ea5p ch\u1ee9ng ch\u1ec9.<\/li>\n<li>B\u1ea1n y\u00eau c\u1ea7u ch\u1ee9ng ch\u1ec9 cho m\u1ed9t danh s\u00e1ch t\u00ean mi\u1ec1n.<\/li>\n<li>T\u1ed5 ch\u1ee9c c\u1ea5p ch\u1ee9ng ch\u1ec9 tr\u1ea3 v\u1ec1 c\u00e1c <strong>th\u1eed th\u00e1ch<\/strong> (challenge) \u2014 m\u1ed7i t\u00ean mi\u1ec1n m\u1ed9t th\u1eed th\u00e1ch \u2014 \u0111\u1ec3 ch\u1ee9ng minh b\u1ea1n c\u00f3 quy\u1ec1n ki\u1ec3m so\u00e1t t\u00ean mi\u1ec1n \u0111\u00f3.<\/li>\n<li>Client \u0111\u00e1p \u1ee9ng th\u1eed th\u00e1ch, r\u1ed3i b\u00e1o \u0111\u00e3 s\u1eb5n s\u00e0ng.<\/li>\n<li>M\u00e1y ch\u1ee7 c\u1ee7a t\u1ed5 ch\u1ee9c c\u1ea5p ch\u1ee9ng ch\u1ec9 \u0111i ki\u1ec3m tra t\u1eeb nhi\u1ec1u \u0111i\u1ec3m m\u1ea1ng kh\u00e1c nhau. \u0110\u1ea1t th\u00ec k\u00fd v\u00e0 tr\u1ea3 v\u1ec1 ch\u1ee9ng ch\u1ec9.<\/li>\n<\/ol>\n<p>\u0110i\u1ec3m m\u1ea5u ch\u1ed1t: <strong>x\u00e1c minh l\u00e0 quy\u1ec1n ki\u1ec3m so\u00e1t t\u00ean mi\u1ec1n, kh\u00f4ng ph\u1ea3i danh t\u00ednh doanh nghi\u1ec7p<\/strong>. \u0110\u00e2y l\u00e0 ch\u1ee9ng ch\u1ec9 lo\u1ea1i DV. N\u00f3 m\u00e3 ho\u00e1 \u0111\u01b0\u1eddng truy\u1ec1n v\u00e0 x\u00e1c nh\u1eadn b\u1ea1n \u0111ang n\u00f3i chuy\u1ec7n \u0111\u00fang v\u1edbi t\u00ean mi\u1ec1n \u0111\u00f3, ch\u1ee9 kh\u00f4ng ch\u1ee9ng th\u1ef1c c\u00f4ng ty ph\u00eda sau l\u00e0 ai.<\/p>\n<h2>HTTP-01 v\u00e0 DNS-01: ch\u1ecdn ki\u1ec3u x\u00e1c minh n\u00e0o<\/h2>\n<table>\n<thead>\n<tr>\n<th><\/th>\n<th>HTTP-01<\/th>\n<th>DNS-01<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>B\u1ea1n ph\u1ea3i l\u00e0m g\u00ec<\/td>\n<td>\u0110\u1eb7t m\u1ed9t t\u1ec7p t\u1ea1m t\u1ea1i <code>\/.well-known\/acme-challenge\/<\/code><\/td>\n<td>T\u1ea1o b\u1ea3n ghi TXT t\u00ean <code>_acme-challenge<\/code><\/td>\n<\/tr>\n<tr>\n<td>\u0110i\u1ec1u ki\u1ec7n<\/td>\n<td>M\u00e1y ch\u1ee7 ph\u1ea3i m\u1edf c\u1ed5ng 80 v\u00e0 truy c\u1eadp \u0111\u01b0\u1ee3c t\u1eeb Internet<\/td>\n<td>C\u00f3 quy\u1ec1n s\u1eeda DNS, t\u1ed1t nh\u1ea5t l\u00e0 s\u1eeda \u0111\u01b0\u1ee3c b\u1eb1ng API<\/td>\n<\/tr>\n<tr>\n<td>C\u1ea5p \u0111\u01b0\u1ee3c ch\u1ee9ng ch\u1ec9 k\u00fd t\u1ef1 \u0111\u1ea1i di\u1ec7n<\/td>\n<td>Kh\u00f4ng<\/td>\n<td>C\u00f3<\/td>\n<\/tr>\n<tr>\n<td>D\u00f9ng \u0111\u01b0\u1ee3c khi m\u00e1y ch\u1ee7 n\u1eb1m sau t\u01b0\u1eddng l\u1eeda<\/td>\n<td>Kh\u00f4ng<\/td>\n<td>C\u00f3<\/td>\n<\/tr>\n<tr>\n<td>\u0110\u1ed9 kh\u00f3 t\u1ef1 \u0111\u1ed9ng ho\u00e1<\/td>\n<td>R\u1ea5t d\u1ec5, client l\u00e0m h\u1ebft<\/td>\n<td>C\u1ea7n tr\u00ecnh c\u1eafm t\u01b0\u01a1ng \u1ee9ng v\u1edbi n\u01a1i qu\u1ea3n l\u00fd DNS<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>C\u00f2n m\u1ed9t ki\u1ec3u th\u1ee9 ba l\u00e0 <strong>TLS-ALPN-01<\/strong>, x\u00e1c minh ngay trong qu\u00e1 tr\u00ecnh b\u1eaft tay TLS tr\u00ean c\u1ed5ng 443. N\u00f3 h\u1eefu \u00edch khi c\u1ed5ng 80 b\u1ecb ch\u1eb7n ho\u00e0n to\u00e0n, nh\u01b0ng c\u1ea7n ph\u1ea7n m\u1ec1m m\u00e1y ch\u1ee7 h\u1ed7 tr\u1ee3 v\u00e0 \u00edt khi c\u1ea7n t\u1edbi trong t\u00ecnh hu\u1ed1ng th\u00f4ng th\u01b0\u1eddng.<\/p>\n<p>Quy t\u1eafc ch\u1ecdn cho g\u1ecdn:<\/p>\n<ul>\n<li>Website b\u00ecnh th\u01b0\u1eddng, c\u00f3 IP c\u00f4ng khai, m\u1edf c\u1ed5ng 80: d\u00f9ng <strong>HTTP-01<\/strong>.<\/li>\n<li>C\u1ea7n ch\u1ee9ng ch\u1ec9 k\u00fd t\u1ef1 \u0111\u1ea1i di\u1ec7n d\u1ea1ng <code>*.tenmien.com<\/code>: <strong>b\u1eaft bu\u1ed9c DNS-01<\/strong>, kh\u00f4ng c\u00f3 ngo\u1ea1i l\u1ec7.<\/li>\n<li>M\u00e1y ch\u1ee7 n\u1ed9i b\u1ed9, m\u00f4i tr\u01b0\u1eddng th\u1eed nghi\u1ec7m, ho\u1eb7c mu\u1ed1n c\u1ea5p ch\u1ee9ng ch\u1ec9 tr\u01b0\u1edbc khi tr\u1ecf t\u00ean mi\u1ec1n: <strong>DNS-01<\/strong>.<\/li>\n<\/ul>\n<p>L\u01b0u \u00fd v\u1ec1 ch\u1ee9ng ch\u1ec9 k\u00fd t\u1ef1 \u0111\u1ea1i di\u1ec7n: <code>*.tenmien.com<\/code> ch\u1ec9 ph\u1ee7 m\u1ed9t c\u1ea5p t\u00ean mi\u1ec1n con. N\u00f3 bao <code>blog.tenmien.com<\/code> nh\u01b0ng kh\u00f4ng bao <code>a.b.tenmien.com<\/code>, v\u00e0 c\u0169ng kh\u00f4ng bao ch\u00ednh <code>tenmien.com<\/code> \u2014 mu\u1ed1n \u0111\u1ee7 th\u00ec ph\u1ea3i li\u1ec7t k\u00ea c\u1ea3 hai trong c\u00f9ng m\u1ed9t ch\u1ee9ng ch\u1ec9.<\/p>\n<h2>C\u00e1ch nhanh nh\u1ea5t: hosting c\u00f3 s\u1eb5n c\u01a1 ch\u1ebf c\u1ea5p t\u1ef1 \u0111\u1ed9ng<\/h2>\n<p>N\u1ebfu b\u1ea1n d\u00f9ng hosting chia s\u1ebb v\u1edbi cPanel ho\u1eb7c b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n t\u01b0\u01a1ng \u0111\u01b0\u01a1ng, g\u1ea7n nh\u01b0 ch\u1eafc ch\u1eafn \u0111\u00e3 c\u00f3 s\u1eb5n t\u00ednh n\u0103ng c\u1ea5p ch\u1ee9ng ch\u1ec9 t\u1ef1 \u0111\u1ed9ng. V\u00e0o m\u1ee5c <code>SSL\/TLS Status<\/code>, ch\u1ecdn t\u00ean mi\u1ec1n, ch\u1ea1y l\u1ec7nh c\u1ea5p t\u1ef1 \u0111\u1ed9ng. To\u00e0n b\u1ed9 ph\u1ea7n gia h\u1ea1n do m\u00e1y ch\u1ee7 lo.<\/p>\n<p>\u0110i\u1ec1u ki\u1ec7n \u0111\u1ec3 n\u00f3 ch\u1ea1y \u0111\u01b0\u1ee3c, v\u00e0 c\u0169ng l\u00e0 ba l\u00fd do ph\u1ed5 bi\u1ebfn khi\u1ebfn n\u00f3 th\u1ea5t b\u1ea1i:<\/p>\n<ul>\n<li>T\u00ean mi\u1ec1n ph\u1ea3i \u0111ang ph\u00e2n gi\u1ea3i v\u1ec1 \u0111\u00fang IP m\u00e1y ch\u1ee7 \u0111\u00f3. Ch\u01b0a tr\u1ecf xong th\u00ec th\u1eed th\u00e1ch kh\u00f4ng th\u1ec3 \u0111\u1ea1t. Xem <a href=\"\/blog\/huong-dan-tro-ten-mien-hosting-cpanel\/\">H\u01b0\u1edbng d\u1eabn tr\u1ecf t\u00ean mi\u1ec1n v\u1ec1 Hosting cPanel<\/a> tr\u01b0\u1edbc khi b\u1ea5m c\u1ea5p ch\u1ee9ng ch\u1ec9.<\/li>\n<li>\u0110\u01b0\u1eddng d\u1eabn <code>\/.well-known\/acme-challenge\/<\/code> ph\u1ea3i truy c\u1eadp \u0111\u01b0\u1ee3c. M\u1ed9t quy t\u1eafc chuy\u1ec3n h\u01b0\u1edbng &#8220;b\u1eaft t\u1ea5t c\u1ea3&#8221; trong <code>.htaccess<\/code> ho\u1eb7c m\u1ed9t tr\u00ecnh c\u1eafm b\u1ea3o m\u1eadt ch\u1eb7n th\u01b0 m\u1ee5c \u1ea9n l\u00e0 \u0111\u1ee7 \u0111\u1ec3 ph\u00e1 h\u1ecfng b\u01b0\u1edbc n\u00e0y.<\/li>\n<li>T\u00ean mi\u1ec1n con n\u00e0o kh\u00f4ng ph\u00e2n gi\u1ea3i v\u1ec1 m\u00e1y ch\u1ee7 th\u00ec ph\u1ea3i lo\u1ea1i kh\u1ecfi danh s\u00e1ch, v\u00ec m\u1ed9t t\u00ean h\u1ecfng l\u00e0m h\u1ecfng c\u1ea3 y\u00eau c\u1ea7u.<\/li>\n<\/ul>\n<h2>C\u1ea5p b\u1eb1ng certbot tr\u00ean m\u00e1y ch\u1ee7 t\u1ef1 qu\u1ea3n<\/h2>\n<p>Certbot l\u00e0 client ch\u00ednh th\u1ee9c, ph\u1ed5 bi\u1ebfn nh\u1ea5t tr\u00ean Linux. Hai ki\u1ec3u d\u00f9ng:<\/p>\n<pre>\n# Ki\u1ec3u 1: certbot t\u1ef1 s\u1eeda c\u1ea5u h\u00ecnh m\u00e1y ch\u1ee7 web\nsudo certbot --nginx -d tenmien.com -d www.tenmien.com\n# Ki\u1ec3u 2: ch\u1ec9 l\u1ea5y ch\u1ee9ng ch\u1ec9, b\u1ea1n t\u1ef1 khai b\u00e1o trong c\u1ea5u h\u00ecnh\nsudo certbot certonly --webroot -w \/var\/www\/tenmien.com\/public \n     -d tenmien.com -d www.tenmien.com\n# Th\u1eed nghi\u1ec7m tr\u01b0\u1edbc b\u1eb1ng m\u00f4i tr\u01b0\u1eddng staging \u0111\u1ec3 kh\u00f4ng \u0111\u1ee5ng gi\u1edbi h\u1ea1n c\u1ea5p ph\u00e1t\nsudo certbot certonly --staging --webroot -w \/var\/www\/tenmien.com\/public -d tenmien.com\n# Xem c\u00e1c ch\u1ee9ng ch\u1ec9 \u0111ang c\u00f3 v\u00e0 ng\u00e0y h\u1ebft h\u1ea1n\nsudo certbot certificates\n<\/pre>\n<p>Ch\u1ee9ng ch\u1ec9 \u0111\u01b0\u1ee3c l\u01b0u \u1edf <code>\/etc\/letsencrypt\/live\/tenmien.com\/<\/code>. Trong c\u1ea5u h\u00ecnh m\u00e1y ch\u1ee7 web h\u00e3y tr\u1ecf t\u1edbi <code>fullchain.pem<\/code> (ch\u1ee9ng ch\u1ec9 c\u1ee7a b\u1ea1n k\u00e8m chu\u1ed7i trung gian) v\u00e0 <code>privkey.pem<\/code> (kho\u00e1 ri\u00eang). D\u00f9ng nh\u1ea7m <code>cert.pem<\/code> thay cho <code>fullchain.pem<\/code> l\u00e0 l\u1ed7i kinh \u0111i\u1ec3n: tr\u00ecnh duy\u1ec7t m\u00e1y t\u00ednh v\u1eabn xanh, nh\u01b0ng m\u1ed9t s\u1ed1 \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng v\u00e0 c\u00f4ng c\u1ee5 d\u00f2ng l\u1ec7nh b\u00e1o chu\u1ed7i ch\u1ee9ng ch\u1ec9 kh\u00f4ng \u0111\u1ea7y \u0111\u1ee7.<\/p>\n<p>Lu\u00f4n tr\u1ecf t\u1edbi \u0111\u01b0\u1eddng d\u1eabn trong th\u01b0 m\u1ee5c <code>live\/<\/code>, \u0111\u1eebng tr\u1ecf v\u00e0o t\u1ec7p trong <code>archive\/<\/code>. Th\u01b0 m\u1ee5c <code>live\/<\/code> l\u00e0 c\u00e1c li\u00ean k\u1ebft lu\u00f4n ch\u1ec9 v\u00e0o b\u1ea3n m\u1edbi nh\u1ea5t, n\u00ean sau khi gia h\u1ea1n b\u1ea1n kh\u00f4ng ph\u1ea3i s\u1eeda c\u1ea5u h\u00ecnh.<\/p>\n<h2>acme.sh khi c\u1ea7n DNS-01 t\u1ef1 \u0111\u1ed9ng<\/h2>\n<p>acme.sh l\u00e0 client vi\u1ebft b\u1eb1ng shell, kh\u00f4ng ph\u1ee5 thu\u1ed9c m\u00f4i tr\u01b0\u1eddng ng\u00f4n ng\u1eef kh\u00e1c, v\u00e0 m\u1ea1nh nh\u1ea5t \u1edf ch\u1ed7 h\u1ed7 tr\u1ee3 r\u1ea5t nhi\u1ec1u nh\u00e0 qu\u1ea3n l\u00fd DNS qua API \u2014 ngh\u0129a l\u00e0 n\u00f3 t\u1ef1 t\u1ea1o v\u00e0 t\u1ef1 xo\u00e1 b\u1ea3n ghi TXT gi\u00fap b\u1ea1n.<\/p>\n<pre>\n# C\u1ea5p ch\u1ee9ng ch\u1ec9 k\u00fd t\u1ef1 \u0111\u1ea1i di\u1ec7n b\u1eb1ng DNS-01 (thay dns_xxx b\u1eb1ng tr\u00ecnh c\u1eafm t\u01b0\u01a1ng \u1ee9ng)\nacme.sh --issue --dns dns_xxx -d tenmien.com -d '*.tenmien.com'\n# C\u00e0i ch\u1ee9ng ch\u1ec9 v\u00e0o \u0111\u00fang ch\u1ed7 v\u00e0 n\u1ea1p l\u1ea1i d\u1ecbch v\u1ee5 sau m\u1ed7i l\u1ea7n gia h\u1ea1n\nacme.sh --install-cert -d tenmien.com \n  --key-file       \/etc\/ssl\/tenmien\/privkey.pem \n  --fullchain-file \/etc\/ssl\/tenmien\/fullchain.pem \n  --reloadcmd      \"systemctl reload nginx\"\n<\/pre>\n<p>N\u1ebfu n\u01a1i qu\u1ea3n l\u00fd DNS c\u1ee7a b\u1ea1n kh\u00f4ng c\u00f3 API, v\u1eabn c\u00f3 ch\u1ebf \u0111\u1ed9 t\u1ea1o b\u1ea3n ghi TXT th\u1ee7 c\u00f4ng \u2014 nh\u01b0ng khi \u0111\u00f3 b\u1ea1n ph\u1ea3i l\u00e0m l\u1ea1i b\u1eb1ng tay \u1edf m\u1ed7i k\u1ef3 gia h\u1ea1n. V\u1edbi ch\u1ee9ng ch\u1ec9 90 ng\u00e0y, c\u00e1ch th\u1ee7 c\u00f4ng ch\u1ec9 n\u00ean d\u00f9ng m\u1ed9t l\u1ea7n cho t\u00ecnh hu\u1ed1ng \u0111\u1eb7c bi\u1ec7t.<\/p>\n<h2>Chu k\u1ef3 90 ng\u00e0y v\u00e0 chuy\u1ec7n gia h\u1ea1n t\u1ef1 \u0111\u1ed9ng<\/h2>\n<p>Ch\u1ee9ng ch\u1ec9 Let&#8217;s Encrypt c\u00f3 hi\u1ec7u l\u1ef1c <strong>90 ng\u00e0y<\/strong>. \u0110\u00e2y l\u00e0 l\u1ef1a ch\u1ecdn c\u00f3 ch\u1ee7 \u0111\u00edch: v\u00f2ng \u0111\u1eddi ng\u1eafn bu\u1ed9c m\u1ecdi ng\u01b0\u1eddi ph\u1ea3i t\u1ef1 \u0111\u1ed9ng ho\u00e1, v\u00e0 gi\u1edbi h\u1ea1n thi\u1ec7t h\u1ea1i n\u1ebfu kho\u00e1 ri\u00eang b\u1ecb l\u1ed9. Th\u00f4ng l\u1ec7 l\u00e0 gia h\u1ea1n khi c\u00f2n kho\u1ea3ng <strong>30 ng\u00e0y<\/strong>, t\u1ee9c v\u00e0o kho\u1ea3ng ng\u00e0y th\u1ee9 60 \u2014 nh\u01b0 v\u1eady b\u1ea1n c\u00f2n c\u1ea3 th\u00e1ng \u0111\u1ec7m \u0111\u1ec3 x\u1eed l\u00fd n\u1ebfu c\u00f3 tr\u1ee5c tr\u1eb7c.<\/p>\n<p>C\u1ea3 certbot l\u1eabn acme.sh \u0111\u1ec1u t\u1ef1 c\u00e0i s\u1eb5n t\u00e1c v\u1ee5 \u0111\u1ecbnh k\u1ef3 khi c\u00e0i \u0111\u1eb7t, v\u00e0 l\u1ec7nh gia h\u1ea1n ch\u1ec9 th\u1ef1c s\u1ef1 l\u00e0m vi\u1ec7c khi ch\u1ee9ng ch\u1ec9 \u0111\u00e3 t\u1edbi ng\u01b0\u1ee1ng. V\u00ec v\u1eady ch\u1ea1y l\u1ec7nh gia h\u1ea1n h\u1eb1ng ng\u00e0y l\u00e0 b\u00ecnh th\u01b0\u1eddng v\u00e0 kh\u00f4ng h\u1ec1 l\u00e3ng ph\u00ed.<\/p>\n<pre>\n# Di\u1ec5n t\u1eadp gia h\u1ea1n: ch\u1ea1y to\u00e0n b\u1ed9 quy tr\u00ecnh nh\u01b0ng kh\u00f4ng thay ch\u1ee9ng ch\u1ec9 th\u1eadt\nsudo certbot renew --dry-run\n# Ki\u1ec3m tra t\u00e1c v\u1ee5 \u0111\u1ecbnh k\u1ef3 c\u00f3 \u0111ang b\u1eadt kh\u00f4ng\nsystemctl list-timers | grep -i certbot\n# Xem ng\u00e0y h\u1ebft h\u1ea1n th\u1ef1c t\u1ebf m\u00e0 m\u00e1y ch\u1ee7 \u0111ang ph\u1ee5c v\u1ee5\necho | openssl s_client -servername tenmien.com -connect tenmien.com:443 2&gt;\/dev\/null \n  | openssl x509 -noout -dates\n<\/pre>\n<p>C\u00e2u l\u1ec7nh cu\u1ed1i quan tr\u1ecdng h\u01a1n hai c\u00e2u tr\u00ean: n\u00f3 h\u1ecfi th\u1eb3ng c\u1ed5ng 443 xem <em>ch\u1ee9ng ch\u1ec9 \u0111ang \u0111\u01b0\u1ee3c ph\u1ee5c v\u1ee5<\/em> h\u1ebft h\u1ea1n ng\u00e0y n\u00e0o. T\u00ecnh hu\u1ed1ng hay g\u1eb7p nh\u1ea5t kh\u00f4ng ph\u1ea3i l\u00e0 gia h\u1ea1n th\u1ea5t b\u1ea1i, m\u00e0 l\u00e0 gia h\u1ea1n th\u00e0nh c\u00f4ng nh\u01b0ng d\u1ecbch v\u1ee5 ch\u01b0a \u0111\u01b0\u1ee3c n\u1ea1p l\u1ea1i n\u00ean v\u1eabn gi\u1eef ch\u1ee9ng ch\u1ec9 c\u0169 trong b\u1ed9 nh\u1edb. Lu\u00f4n khai b\u00e1o l\u1ec7nh n\u1ea1p l\u1ea1i d\u1ecbch v\u1ee5 trong m\u00f3c sau gia h\u1ea1n.<\/p>\n<p>\u0110\u1eebng tr\u00f4ng ch\u1edd v\u00e0o email nh\u1eafc h\u1ebft h\u1ea1n t\u1eeb b\u00ean c\u1ea5p ch\u1ee9ng ch\u1ec9. H\u00e3y t\u1ef1 \u0111\u1eb7t m\u1ed9t ph\u00e9p gi\u00e1m s\u00e1t \u0111\u1ecbnh k\u1ef3 ki\u1ec3m tra s\u1ed1 ng\u00e0y c\u00f2n l\u1ea1i v\u00e0 b\u00e1o cho b\u1ea1n khi xu\u1ed1ng d\u01b0\u1edbi ng\u01b0\u1ee1ng \u2014 \u0111\u00f3 l\u00e0 c\u00e1ch duy nh\u1ea5t b\u1ea1n bi\u1ebft tr\u01b0\u1edbc thay v\u00ec bi\u1ebft khi kh\u00e1ch g\u1ecdi \u0111i\u1ec7n.<\/p>\n<h2>B\u1ea3y l\u1ed7i khi\u1ebfn vi\u1ec7c c\u1ea5p ho\u1eb7c gia h\u1ea1n th\u1ea5t b\u1ea1i<\/h2>\n<ul>\n<li><strong>C\u1ed5ng 80 b\u1ecb \u0111\u00f3ng.<\/strong> HTTP-01 c\u1ea7n c\u1ed5ng 80. B\u1ea1n c\u00f3 th\u1ec3 chuy\u1ec3n h\u01b0\u1edbng to\u00e0n b\u1ed9 sang HTTPS, v\u00ec quy tr\u00ecnh x\u00e1c minh \u0111i theo chuy\u1ec3n h\u01b0\u1edbng, nh\u01b0ng kh\u00f4ng \u0111\u01b0\u1ee3c ch\u1eb7n h\u1eb3n c\u1ed5ng 80 \u1edf t\u01b0\u1eddng l\u1eeda.<\/li>\n<li><strong>Ch\u1eb7n nh\u1ea7m th\u01b0 m\u1ee5c th\u1eed th\u00e1ch.<\/strong> Quy t\u1eafc vi\u1ebft l\u1ea1i \u0111\u01b0\u1eddng d\u1eabn c\u1ee7a \u1ee9ng d\u1ee5ng nu\u1ed1t lu\u00f4n <code>\/.well-known\/acme-challenge\/<\/code>. H\u00e3y th\u00eam ngo\u1ea1i l\u1ec7 cho \u0111\u01b0\u1eddng d\u1eabn n\u00e0y tr\u01b0\u1edbc m\u1ecdi quy t\u1eafc kh\u00e1c.<\/li>\n<li><strong>Ch\u1eb7n theo v\u00f9ng \u0111\u1ecba l\u00fd.<\/strong> M\u00e1y ch\u1ee7 x\u00e1c minh \u0111i t\u1eeb nhi\u1ec1u \u0111i\u1ec3m tr\u00ean th\u1ebf gi\u1edbi. N\u1ebfu b\u1ea1n ch\u1ec9 cho ph\u00e9p truy c\u1eadp t\u1eeb Vi\u1ec7t Nam, ph\u1ea7n l\u1edbn c\u00e1c \u0111i\u1ec3m ki\u1ec3m tra s\u1ebd b\u1ecb ch\u1eb7n v\u00e0 th\u1eed th\u00e1ch tr\u01b0\u1ee3t.<\/li>\n<li><strong>B\u1ea3n ghi DNS ch\u01b0a lan truy\u1ec1n.<\/strong> V\u1edbi DNS-01, TTL cao khi\u1ebfn b\u1ea3n ghi TXT m\u1edbi ch\u01b0a th\u1ea5y \u0111\u01b0\u1ee3c l\u00fac ki\u1ec3m tra. H\u1ea1 TTL c\u1ee7a v\u00f9ng DNS xu\u1ed1ng th\u1ea5p tr\u01b0\u1edbc khi t\u1ef1 \u0111\u1ed9ng ho\u00e1.<\/li>\n<li><strong>\u0110\u1ee5ng gi\u1edbi h\u1ea1n c\u1ea5p ph\u00e1t.<\/strong> M\u1ed7i t\u00ean mi\u1ec1n c\u00f3 h\u1ea1n m\u1ee9c s\u1ed1 l\u1ea7n c\u1ea5p trong m\u1ed9t kho\u1ea3ng th\u1eddi gian. Khi \u0111ang th\u1eed c\u1ea5u h\u00ecnh, lu\u00f4n d\u00f9ng m\u00f4i tr\u01b0\u1eddng staging; ch\u1ec9 chuy\u1ec3n sang th\u1eadt khi \u0111\u00e3 ch\u1ea1y tr\u01a1n.<\/li>\n<li><strong>\u0110\u1ed3ng h\u1ed3 h\u1ec7 th\u1ed1ng sai.<\/strong> L\u1ec7ch gi\u1edd nhi\u1ec1u l\u00e0m ch\u1ee9ng ch\u1ec9 b\u1ecb coi l\u00e0 ch\u01b0a c\u00f3 hi\u1ec7u l\u1ef1c ho\u1eb7c \u0111\u00e3 h\u1ebft h\u1ea1n. B\u1eadt \u0111\u1ed3ng b\u1ed9 th\u1eddi gian tr\u00ean m\u00e1y ch\u1ee7.<\/li>\n<li><strong>B\u1eadt HSTS qu\u00e1 s\u1edbm.<\/strong> HSTS ra l\u1ec7nh cho tr\u00ecnh duy\u1ec7t ch\u1ec9 \u0111\u01b0\u1ee3c k\u1ebft n\u1ed1i b\u1eb1ng HTTPS trong kho\u1ea3ng th\u1eddi gian d\u00e0i. B\u1eadt khi ch\u1ee9ng ch\u1ec9 ch\u01b0a \u1ed5n \u0111\u1ecbnh l\u00e0 t\u1ef1 kho\u00e1 m\u00ecnh ra ngo\u00e0i. H\u00e3y ch\u1ea1y HTTPS tr\u01a1n tru v\u00e0i tu\u1ea7n r\u1ed3i m\u1edbi b\u1eadt, v\u00e0 b\u1eaft \u0111\u1ea7u b\u1eb1ng th\u1eddi h\u1ea1n ng\u1eafn.<\/li>\n<\/ul>\n<h2>Sau khi c\u00f3 ch\u1ee9ng ch\u1ec9 th\u00ec l\u00e0m g\u00ec ti\u1ebfp<\/h2>\n<ol>\n<li>Chuy\u1ec3n h\u01b0\u1edbng to\u00e0n b\u1ed9 HTTP sang HTTPS b\u1eb1ng m\u00e3 301, tr\u1eeb \u0111\u01b0\u1eddng d\u1eabn th\u1eed th\u00e1ch ACME.<\/li>\n<li>So\u00e1t n\u1ed9i dung h\u1ed7n h\u1ee3p: \u1ea3nh, t\u1ec7p CSS v\u00e0 JavaScript c\u00f2n g\u1ecdi b\u1eb1ng <code>http:\/\/<\/code> s\u1ebd l\u00e0m m\u1ea5t bi\u1ec3u t\u01b0\u1ee3ng an to\u00e0n. C\u00f4ng c\u1ee5 d\u00e0nh cho nh\u00e0 ph\u00e1t tri\u1ec3n c\u1ee7a tr\u00ecnh duy\u1ec7t li\u1ec7t k\u00ea \u0111\u1ee7 danh s\u00e1ch n\u00e0y.<\/li>\n<li>Ki\u1ec3m tra chu\u1ed7i ch\u1ee9ng ch\u1ec9 b\u1eb1ng m\u1ed9t c\u00f4ng c\u1ee5 \u0111\u00e1nh gi\u00e1 c\u1ea5u h\u00ecnh TLS tr\u1ef1c tuy\u1ebfn, xem c\u00f3 thi\u1ebfu ch\u1ee9ng ch\u1ec9 trung gian kh\u00f4ng.<\/li>\n<li>\u0110\u1eb7t gi\u00e1m s\u00e1t ng\u00e0y h\u1ebft h\u1ea1n cho m\u1ecdi t\u00ean mi\u1ec1n, k\u1ec3 c\u1ea3 t\u00ean mi\u1ec1n ph\u1ee5 \u00edt d\u00f9ng \u2014 ch\u00fang ch\u00ednh l\u00e0 nh\u1eefng c\u00e1i h\u1ebft h\u1ea1n m\u00e0 kh\u00f4ng ai bi\u1ebft.<\/li>\n<li>C\u00f3 HTTPS r\u1ed3i th\u00ec t\u00ednh ti\u1ebfp t\u1edbi chuy\u1ec7n ch\u1ecbu t\u1ea3i v\u00e0 ch\u1ed1ng l\u1ea1m d\u1ee5ng: xem <a href=\"\/blog\/chong-ddos-co-ban\/\">K\u1ef9 thu\u1eadt ch\u1ed1ng DDoS c\u01a1 b\u1ea3n khi qu\u1ea3n tr\u1ecb Web<\/a>.<\/li>\n<\/ol>\n<h2>K\u1ebft<\/h2>\n<p>Let&#8217;s Encrypt c\u1ea5p ch\u1ee9ng ch\u1ec9 DV mi\u1ec5n ph\u00ed qua giao th\u1ee9c ACME, x\u00e1c minh b\u1eb1ng HTTP-01 ho\u1eb7c DNS-01, hi\u1ec7u l\u1ef1c 90 ng\u00e0y v\u00e0 m\u1eb7c \u0111\u1ecbnh l\u00e0 ph\u1ea3i t\u1ef1 \u0111\u1ed9ng ho\u00e1. Ch\u1ecdn HTTP-01 cho website th\u00f4ng th\u01b0\u1eddng, DNS-01 khi c\u1ea7n ch\u1ee9ng ch\u1ec9 k\u00fd t\u1ef1 \u0111\u1ea1i di\u1ec7n ho\u1eb7c m\u00e1y ch\u1ee7 kh\u00f4ng l\u1ed9 ra Internet. Vi\u1ec7c quan tr\u1ecdng nh\u1ea5t kh\u00f4ng ph\u1ea3i l\u1ea7n c\u1ea5p \u0111\u1ea7u ti\u00ean m\u00e0 l\u00e0 ch\u1ee9ng minh \u0111\u01b0\u1ee3c r\u1eb1ng l\u1ea7n gia h\u1ea1n th\u1ee9 hai s\u1ebd t\u1ef1 ch\u1ea1y: h\u00e3y di\u1ec5n t\u1eadp gia h\u1ea1n, khai b\u00e1o l\u1ec7nh n\u1ea1p l\u1ea1i d\u1ecbch v\u1ee5, v\u00e0 gi\u00e1m s\u00e1t ng\u00e0y h\u1ebft h\u1ea1n t\u1eeb b\u00ean ngo\u00e0i.<\/p>\n<p>\u0110ang t\u00ecm t\u00ean mi\u1ec1n cho d\u1ef1 \u00e1n m\u1edbi v\u00e0 mu\u1ed1n ch\u1ea1y HTTPS ngay t\u1eeb ng\u00e0y \u0111\u1ea7u? Tra v\u00e0 \u0111\u0103ng k\u00fd t\u1ea1i <a href=\"https:\/\/ivi.vn\/search\">ivi.vn\/search<\/a>, s\u1eeda b\u1ea3n ghi DNS ngay trong dashboard r\u1ed3i c\u1ea5p ch\u1ee9ng ch\u1ec9 theo \u0111\u00fang c\u00e1c b\u01b0\u1edbc \u1edf tr\u00ean.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>C\u00e1ch ho\u1ea1t \u0111\u1ed9ng c\u1ee7a giao th\u1ee9c ACME, ch\u1ecdn gi\u1eefa x\u00e1c minh HTTP-01 v\u00e0 DNS-01, v\u00ec sao ch\u1ee9ng ch\u1ec9 k\u00fd t\u1ef1 \u0111\u1ea1i di\u1ec7n b\u1eaft bu\u1ed9c d\u00f9ng DNS-01, v\u00e0 c\u00e1ch b\u1ea3o \u0111\u1ea3m gia h\u1ea1n t\u1ef1 \u0111\u1ed9ng cho chu k\u1ef3 90 ng\u00e0y.<\/p>\n","protected":false},"author":1,"featured_media":66,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-16","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-quan-tri-web"],"_links":{"self":[{"href":"https:\/\/ivi.vn\/blog\/wp-json\/wp\/v2\/posts\/16","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ivi.vn\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ivi.vn\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ivi.vn\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ivi.vn\/blog\/wp-json\/wp\/v2\/comments?post=16"}],"version-history":[{"count":1,"href":"https:\/\/ivi.vn\/blog\/wp-json\/wp\/v2\/posts\/16\/revisions"}],"predecessor-version":[{"id":58,"href":"https:\/\/ivi.vn\/blog\/wp-json\/wp\/v2\/posts\/16\/revisions\/58"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ivi.vn\/blog\/wp-json\/wp\/v2\/media\/66"}],"wp:attachment":[{"href":"https:\/\/ivi.vn\/blog\/wp-json\/wp\/v2\/media?parent=16"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ivi.vn\/blog\/wp-json\/wp\/v2\/categories?post=16"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ivi.vn\/blog\/wp-json\/wp\/v2\/tags?post=16"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}