域名添加HTTPS

利用Let‘s Encrypt 免费生成HTTPS证书

1. 下载安装certbot(Let‘s Encrypt )
2. 利用certbot生成证书
3. 配置nginx的https证书

安装cerbot

[[email protected] ~]# wget https://dl.eff.org/certbot-auto
[[email protected] ~]# chmod a+x certbot-auto
[[email protected] ~]#./certbot-auto　　

利用certbot生成证书

给一个域名生成证书

[[email protected] certbot]# ./certbot-auto certonly --email  [email protected] --agree-tos --webroot -w  /alidata1/www/timecash22/api3  -d  xxxx.zjm.cn
/root/.local/share/letsencrypt/lib/python2.6/site-packages/cryptography/__init__.py:26: DeprecationWarning: Python 2.6 is no longer supported by the Python core team, please upgrade your Python. A future version of cryptography will drop support for Python 2.6
  DeprecationWarning
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for xxx.zjm.cn
Using the webroot path /alidata1/www/timecash22/api3 for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/xxx.zjm.cn/fullchain.pem. Your
   cert will expire on 2017-09-06. To obtain a new or tweaked version
   of this certificate in the future, simply run certbot-auto again.
   To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let‘s Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

-w:指定域名的根目录
-d:指定域名

Note:证书已经生成到了/etc/letsencrypy/live/xxx.zjm.cn下

Nginx配置https证书

server {
    listen 443 ssl;
    ....
    ssl_certificate /etc/letsencrypt/live/xxx.zjm.cn/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/xxx.zjm.cn/privkey.pem;
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;

}

ssl_certificate和ssl_certificate_key分别对应fullchain.pem,privkey.pem

ssl_dhparam通过以下命令生成

$ sudo mkdir /etc/nginx/ssl
$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

给多个域名生成一个证书,也就是多个域名使用一个ssl证书

./certbot-auto certonly --email [email protected] --agree-tos --webroot -w /var/www/laozuo -d laozuo.org -d www.laozuo.org -w /var/www/laobuluo -d laobuluo.com -d www.laobuluo.com

自动更新https证书

由于这个免费的证书只有90天的使用时间,所以遇到定时更新以下证书,这里是利用certbot每隔一段时间自动更新证书

手动执行更新

./certbot-auto  renew --dry-run

结合crontab每隔一段时间自动更新证书

30 2 * * 1 ./certbot-auto  renew  >> /var/log/le-renew.log