在nginx 使用Let’s Encrypt 免費的SSL/TLS 證書
來自： https://xiequan.info/在nginx-使用lets-encrypt-免費的ssltls-證書/
Let’s Encrypt 是一個將于2015年末推出的 數字證書認證機構 ，將通過旨在消除當前手動創建和安裝證書的復雜過程的自動化流程，為安全網站提供免費的 SSL / TLS 證書。 [1] [2]
Let’s Encrypt 是由 互聯網安全研究小組 （ISRG，一個公益組織）提供的服務。主要贊助商包括 電子前哨基金會 ， Mozilla基金會 ， Akamai 以及 思科 。2015年4月9日，ISRG與 Linux基金會 宣布合作。
用以實現這一新的數字證書認證機構的協議被稱為自動證書管理環境（ACME）。 GitHub 上有這一規范的草案，且提案的一個版本已作為一個Internet草案發布。
Let’s Encrypt 宣稱這一過程將十分簡單、自動化并且免費。
2015年8月7日，該服務更新其推出計劃，預計將在2015年9月7日當周某時發布首個證書，隨后向列入白名單的域名發行少量證書并逐漸擴大發行。若一切按計劃進行，該服務預計將在2015年11月16日當周某時全面開始提供。
首先下載Let’s Encrypt Client
$ sudo apt-get update $ sudo apt-get install -y git $ sudo git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt $ cd /opt/letsencrypt $ sudo ./letsencrypt-auto
$ sudoapt-getupdate $ sudoapt-getinstall -y git $ sudogitclone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt $ cd /opt/letsencrypt $ sudo ./letsencrypt-auto
為Let’s Encrypt Temporary File創建一個模板
我們在webroot-path/.well-known/acme-challenge/通過Let’s Encrypt client創建一個臨時文件包含了使用Encrypt server驗證你域名去獲得驗證的token 。webroot?path在我們接下來的示例中代表/var/www/letsencrypt
我們通過這個 GitHub Gist 創建一個模板文件包含Let’s Encryp需要發出的證書，不使用模板的話我們可以通過Let’s Encrypt 命令行來設置參數。
1.創建Let’s Encrypt保存臨時文件的目錄和指定需要的權限：
$ cd /var/www $ mkdir letsencrypt $ sudo chgroup www-data letsencrypt
$ cd /var/www $ mkdirletsencrypt $ sudochgroupwww-dataletsencrypt
2.創建/etc/letsencrypt/configs/my-domain.conf文件，my?domain是你需要實現https的域名拷貝Gist里面的內容，然后為domains，rsa-key-size，server和email這幾個字段指定合適的值
# the domain we want to get the cert for; # technically it's possible to have multiple of this lines, but it only worked # with one domain for me, another one only got one cert, so I would recommend # separate config files per domain. domains = my-domain # increase key size rsa-key-size = 2048 # Or 4096 # the current closed beta (as of 2015-Nov-07) is using this server server = https://acme-v01.api.letsencrypt.org/directory # this address will receive renewal reminders email = my-email # turn off the ncurses UI, we want this to be run as a cronjob text = True # authenticate by placing a file in the webroot (under .well-known/acme-challenge/) # and then letting LE fetch it authenticator = webroot webroot-path = /var/www/letsencrypt/
# the domain we want to get the cert for; # technically it's possible to have multiple of this lines, but it only worked # with one domain for me, another one only got one cert, so I would recommend # separate config files per domain. domains = my-domain # increase key size rsa-key-size = 2048 # Or 4096 # the current closed beta (as of 2015-Nov-07) is using this server server = https://acme-v01.api.letsencrypt.org/directory # this address will receive renewal reminders email = my-email # turn off the ncurses UI, we want this to be run as a cronjob text = True # authenticate by placing a file in the webroot (under .well-known/acme-challenge/) # and then letting LE fetch it authenticator = webroot webroot-path = /var/www/letsencrypt/
讓Let’s Encrypt去訪問臨時文件
1.在Nginx 中配置一個虛擬server
server {
listen 80 default_server;
server_name my-domain;
location /.well-known/acme-challenge {
root /var/www/letsencrypt;
}
...
}server {
listen 80 default_server;
server_namemy-domain;
location /.well-known/acme-challenge {
root /var/www/letsencrypt;
}
...
}2.驗證配置文件然后重新啟動Nginx
$ sudo nginx -t && sudo nginx -s reload
$ sudonginx -t && sudonginx -s reload
請求證書
通過上面的步驟我們萬事俱備了，我們可以請求證書了。
$ cd /opt/letsencrypt $ ./letsencrypt-auto --config /etc/letsencrypt/configs/my-domain.conf certonly Updating letsencrypt and virtual environment dependencies...... Requesting root privileges to run with virtualenv: /root/.local/share/letsencrypt/bin/letsencrypt --config /etc/letsencrypt/configs/my-domain.conf certonly IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at /etc/letsencrypt/live/my-domain/fullchain.pem. Your cert will expire on date. To obtain a new version of the certificate in the future, simply run Let's Encrypt again.
$ cd /opt/letsencrypt $ ./letsencrypt-auto --config /etc/letsencrypt/configs/my-domain.confcertonly Updatingletsencryptand virtualenvironmentdependencies...... Requestingrootprivilegesto runwithvirtualenv: /root/.local/share/letsencrypt/bin/letsencrypt --config /etc/letsencrypt/configs/my-domain.confcertonly IMPORTANTNOTES: - Congratulations! Yourcertificateand chainhavebeensavedat /etc/letsencrypt/live/my-domain/fullchain.pem. Yourcert willexpireondate. To obtain a new versionofthe certificatein thefuture, simplyrunLet's Encryptagain.
Nginx加載證書
1.在Nginx的配置文件中添加下面內容（這里默認你是會配置Nginx）
server {
listen 443 ssl default_server;
server_name my-domain;
ssl_certificate /etc/letsencrypt/live/my-domain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/my-domain/privkey.pem;
...
}server {
listen 443 ssldefault_server;
server_namemy-domain;
ssl_certificate /etc/letsencrypt/live/my-domain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/my-domain/privkey.pem;
...
}2.重新啟動Nginx，Nginx每修改一次配置文件都需要通過重啟加載新的配置
$ sudo nginx -t && sudo nginx -s reload
$ sudonginx -t && sudonginx -s reload
自動申請Let’s Encrypt Certificates的有效期
Let’s Encrypt certificates的免費使用時間只有90天，時間到了之后我們就需要重新續簽就像簽證一樣。可能你會忘記。然而我們可以通過cron 這個程序來幫助我們完成自動操作
1.我們可以創建一個shell 腳本
#!/bin/sh cd /opt/letsencrypt/ ./letsencrypt-auto --config /etc/letsencrypt/configs/my-domain.conf certonly if [ $? -ne 0 ] then ERRORLOG=`tail /var/log/letsencrypt/letsencrypt.log` echo -e "The Let's Encrypt cert has not been renewed! \n \n" \ $ERRORLOG else nginx -s reload fi exit 0
#!/bin/sh cd /opt/letsencrypt/ ./letsencrypt-auto --config /etc/letsencrypt/configs/my-domain.confcertonly if [ $? -ne 0 ] then ERRORLOG=`tail /var/log/letsencrypt/letsencrypt.log` echo -e "The Let's Encrypt cert has not been renewed! \n \n" \ $ERRORLOG else nginx -s reload fi exit 0
2.創建一個 /var/log/letsencrypt/目錄
3.運行 crontab -e 讓我們寫的腳本程序每2個月執行一次
0 0 1 JAN,MAR,MAY,JUL,SEP,NOV * /path/to/renew-letsencrypt.sh
0 0 1 JAN,MAR,MAY,JUL,SEP,NOV * /path/to/renew-letsencrypt.sh
Nginx官方教程： https://www.nginx.com/blog/free-certificates-lets-encrypt-and-nginx/
在nginx 使用Let’s Encrypt 免費的SSL/TLS 證書
本文由用戶 shiqiduan 自行上傳分享，僅供網友學習交流。所有權歸原作者，若您的權利被侵害，請聯系管理員。
轉載本站原創文章，請注明出處，并保留原始鏈接、圖片水印。
本站是一個以用戶分享為主的開源技術平臺，歡迎各類分享！