下載安裝及執行的腳本
wget https://dl.eff.org/certbot-auto --no-check-certificate chmod +x ./certbot-auto ./certbot-auto -n
生成證書 只需要輸入郵件地址和網站根目錄 提示以下內容 說明安裝完成
Saving debug log to /var/log/letsencrypt/letsencrypt.log Missing command line flags. For non-interactive execution, you will need to specify a plugin on the command line. Run with '--help plugins' to see a list of options, and see https://eff.org/letsencrypt-plugins for more detail on what the plugins do and how to use them.
nginx設定隱藏目錄訪問
location ~ /.well-known {
allow all;
}
生成域名證書
./certbot-auto certonly --email [email protected] --agree-tos --no-eff-email --webroot -w /var/www/ -d hack.idv.tw
cd /etc/letsencrypt/live/
萬用字元的申請指令 (需要驗證dns)
certbot-auto certonly -d *.manpc.tk --manual --preferred-challenges dns
nginx設定
server {
listen 80; # IPv4
listen [::]:80;
server_name hack.idv.tw ;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
#rewrite ^(.*) https://$host$1 permanent;
return 301 https://www.itnotetk.com$request_uri; #跳轉到Https
}
server {
listen 443 ssl http2;
server_name hack.idv.tw ;
ssl on;
ssl_certificate /etc/letsencrypt/live/hack.idv.tw/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/hack.idv.tw/privkey.pem;
client_max_body_size 256m;
ssl_dhparam /etc/nginx/certs/dhparam.pem;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_stapling on;
ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA";
ssl_prefer_server_ciphers on;
#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains;preload" always;
Let's Encrypt憑證只有90天 需要手動續約
設定定時更新證書 crontab設定排程
0 1 * * * /root/certbot-auto renew --disable-hook-validation --renew-hook "/etc/init.d/nginx reload"
瀏覽器顯示的證書
測試ssl安全性網站 https://globalsign.ssllabs.com/
ssl憑證設定檔
root@Joker:~# cd /etc/letsencrypt/renewal root@Joker:/etc/letsencrypt/renewal# pwd /etc/letsencrypt/renewal root@Joker:/etc/letsencrypt/renewal# ls hack.idv.tw.conf manpc.tk.conf tonyhack.cloudns.pw.conf tonyhack.familyds.net.conf root@Joker:/etc/letsencrypt/renewal#
刪除SSL Certificate
./certbot-auto delete --cert-name tonyhack.cloudns.pw
參考資料