下載安裝及執行的腳本

wget https://dl.eff.org/certbot-auto --no-check-certificate
chmod +x ./certbot-auto
./certbot-auto -n

生成證書 只需要輸入郵件地址和網站根目錄 提示以下內容 說明安裝完成

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Missing command line flags. For non-interactive execution, you will need to specify a plugin on the command line.  Run with '--help plugins' to see a list of options, and see https://eff.org/letsencrypt-plugins for more detail on what the plugins do and how to use them.

nginx設定隱藏目錄訪問

location ~ /.well-known {
    allow all;
}

生成域名證書

./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /var/www/ -d hack.idv.tw

cd /etc/letsencrypt/live/

萬用字元的申請指令 (需要驗證dns)

certbot-auto certonly -d *.manpc.tk --manual --preferred-challenges dns

nginx設定

server {
    listen 80; # IPv4
    listen [::]:80;
    server_name hack.idv.tw ;
    proxy_set_header       Host $host;
    proxy_set_header  X-Real-IP  $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto  $scheme;
    #rewrite ^(.*) https://$host$1 permanent;
    return 301 https://www.itnotetk.com$request_uri;    #跳轉到Https

}


server {
    listen 443 ssl http2;
    server_name hack.idv.tw ;
    ssl on;
    ssl_certificate /etc/letsencrypt/live/hack.idv.tw/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/hack.idv.tw/privkey.pem;
    client_max_body_size 256m;
    ssl_dhparam /etc/nginx/certs/dhparam.pem;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_stapling on;
    ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA";
    ssl_prefer_server_ciphers on;
    #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains;preload" always;

Let's Encrypt憑證只有90天 需要手動續約
設定定時更新證書 crontab設定排程

0 1 * * * /root/certbot-auto renew --disable-hook-validation --renew-hook "/etc/init.d/nginx reload"

瀏覽器顯示的證書

測試ssl安全性網站 https://globalsign.ssllabs.com/

ssl憑證設定檔

[email protected]:~# cd /etc/letsencrypt/renewal
[email protected]:/etc/letsencrypt/renewal# pwd
/etc/letsencrypt/renewal
[email protected]:/etc/letsencrypt/renewal# ls
hack.idv.tw.conf  manpc.tk.conf  tonyhack.cloudns.pw.conf  tonyhack.familyds.net.conf
[email protected]:/etc/letsencrypt/renewal# 

刪除SSL Certificate

./certbot-auto delete --cert-name tonyhack.cloudns.pw

參考資料

certbot 刪除不需再更新SSL的域名(domain)

 

Hits: 283

By tony

自由軟體愛好者~喜歡不斷的思考各種問題,有新的事物都會想去學習嘗試 做實驗並熱衷研究 沒有所謂頂天的技術 只有謙虛及不斷的學習 精進專業,本站主要以分享系統及網路相關知識、資源而建立。 Github http://stnet253.github.io

發佈留言

發佈留言必須填寫的電子郵件地址不會公開。 必填欄位標示為 *

這個網站採用 Akismet 服務減少垃圾留言。進一步了解 Akismet 如何處理網站訪客的留言資料