第一步: 创建密钥
openssl genrsa 4096 > account.key
第二步:为你的域名创建认证签名
openssl genrsa 4096 > domain.key
#一个域名
openssl req -new -sha256 -key domain.key -subj "/CN=lovejog.com" > domain.csr
#二个域名 ( www.lovejog.com和lovejog.com)
openssl req -new -sha256 -key domain.key -subj "/" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=lovejog.com,DNS:www.lovejog.com")) > domain.csr
第三步: 在主机上创建一个可以访问的目录.well-known/acme-challenge/
#创建目录
mkdir -p /var/www/challenges/
#example for nginx
server {
listen 80;
server_name lovejog.com www.lovejog.com;
location /.well-known/acme-challenge/ {
alias /var/www/challenges/;
try_files $uri =404;
}
...the rest of your config
}
第四步: 获取签名证书
下载acme-tiny.py https://github.com/diafygi/acme-tiny
#在服务器运行
python acme_tiny.py --account-key ./account.key --csr ./domain.csr --acme-dir /var/www/challenges/ > ./signed.crt
第五步: 安装证书
#NOTE: For nginx, you need to append the Let's Encrypt intermediate cert to your cert
wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem
cat signed.crt intermediate.pem > chained.pem
server {
listen 443;
server_name yoursite.com, www.yoursite.com;
ssl on;
ssl_certificate /opt/cert/chained.pem;
ssl_certificate_key /opt/cert/domain.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
ssl_session_cache shared:SSL:50m;
#ssl_dhparam /path/to/server.dhparam;
ssl_prefer_server_ciphers on;
...the rest of your config
}
server {
listen 80;
server_name lovejog.com, www.loveojog.com;
location /.well-known/acme-challenge/ {
alias /var/www/challenges/;
try_files $uri =404;
}
location / {
rewrite ^ https://lovejog.com$request_uri? permanent;
}
}
第六步: 设置自动运行脚本(因为90天要重新刷新一次)
创建文件 renew_cert.sh:
#!/bin/bash
python /opt/cert/acme_tiny.py --account-key /opt/cert/account.key --csr /opt/cert/domain.csr --acme-dir /var/www/challenges/ > /tmp/signed.crt || exit
wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem
cat /tmp/signed.crt intermediate.pem > /opt/cert/pchained.pem
service nginx reload
#使用crontab -e 进入然后加入以下命令
0 0 1 * * cd /opt/cert/ && ./renew_cert.sh 2>> /var/log/acme_tiny.log
