概述 本文介绍如何通过 Certbot 安装 Https Letsencrypt 证书 先决条件 1、拥有一个域名,例如 mydomain.com 2、在域名服务器创建一条A记录,指向云主机的公网IP )下的/.well-known/acme-challenge/目录里面,并通过已经启动的nginx验证随机文件,生成证书 证书应用 通过以上方式生的成证书及 privkey 等文件一般位于 /etc/letsencrypt sites-available/default 中的 server 节点下添加: listen 443 ssl; listen [::]:443 ssl; ssl_certificate /etc/letsencrypt /live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; 续期
toc 因为Hipo在线版的~~计划(不日放出)~~,所以将hipo.cash升级到https,证书是免费开放的 letsencrypt,配合官方的工具certbot。 ; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot # Redirect non-https traffic to https if ($ = "https") { return 301 https://$host$request_uri; } # managed by Certbot ---- letsencrypt http://127.0.0.1:18080; } } 重启nginx,正常情况下网站便成功升级到了https letsencrypt的脚本需要90后renew下,certbot也支持自动更新
自从Https开始以后,一直为GitHub Pages的HTTPS认证而烦恼,之前一直用的cloudflare,无奈不是官方出的,总感觉不顺啊,进网站有时还是会提示SSL错误,今天才知道官方支持了HTTPS配置了,那是相当的简单,真香!
(采用 CC BY-NC-SA 4.0 许可协议进行授权) 本文标题:《 Letsencrypt 泛域名 SSL 证书免费申请 》 本文链接:https://lisz.me/tech/webmaster
参考: https://github.com/Neilpang/acme.sh/wiki/%E8%AF%B4%E6%98%8E https://lnmp.org/faq/letsencrypt-wildcard-ssl.html
letsencrypt的官方网站是 https://letsencrypt.org/ github地址是 https://github.com/letsencrypt/letsencrypt ,现在好像会自动跳转到 mkdir -p /home/website/letsencrypt; git clone https://github.com/letsencrypt/letsencrypt /home/website /letsencrypt/letsencrypt; cd /home/website/letsencrypt/letsencrypt; . /bin/sh /home/website/letsencrypt/letsencrypt/letsencrypt-auto renew; cp /etc/letsencrypt/live/gf.owent.net /letsencrypt/renew.sh letsencrypt会把证书放在/etc/letsencrypt/live/[域名]里,我的证书都放在/home/website/ssl/中,所以我把它copy
在home目录创建.azure.ini文件,替换成你的azure service principal:
cert-manager.yaml 创建 clusterissuer # issuer.yaml apiVersion: v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: # 邮箱,证书过期前会发邮件到这个邮箱 email: admin@arfront.com server: https://acme-v02.api.letsencrypt.org apiVersion: extensions/v1beta1 kind: Ingress metadata: annotations: cert-manager.io/cluster-issuer: letsencrypt-prod #需要使用这个标记,letsencrypt-prod是上面issuer的名称 name: nginx namespace: default spec: rules: - host: dev.arfront.cn
example -d example.com -d www.example.com -w /var/www/thing -d thing.is -d m.thing.is 生成的证书通常保存在/etc/letsencrypt
下面给出一个示例的 letsencrypt.yml 配置,替换其中的 即可快速查看配置。 apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: this privateKeySecretRef: name: prod-issuer-account-key server: https://acme-v02.api.letsencrypt.org $ kubectl describe clusterissuer letsencrypt ... 参考文献# Default static install By cert-manager Traefik Docs HTTPS using Letsencrypt and Traefik with k3s
参考: https://letsencrypt.org/zh-cn/docs/ https://github.com/acmesh-official/acme.sh/tree/master/dnsapi https://github.com/acmesh-official/acme.sh/wiki/%E8%AF%B4%E6%98%8E https://lnmp.org/faq/letsencrypt-wildcard-ssl.html
下面给出一个示例的 letsencrypt.yml 配置,替换其中的 即可快速查看配置。 apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: this privateKeySecretRef: name: prod-issuer-account-key server: https://acme-v02.api.letsencrypt.org $ kubectl describe clusterissuer letsencrypt ... 参考文献# Default static install By cert-manager Traefik Docs HTTPS using Letsencrypt and Traefik with k3s
/letsencrypt cd letsencrypt . docker run -it --rm -p 443:443 -p 80:80 --name letsencrypt \ -v "/etc/letsencrypt:/etc/letsencrypt " \ -v "/var/lib/letsencrypt:/var/lib/letsencrypt" \ quay.io/letsencrypt/letsencrypt , 查看/etc/letsencrypt将会看到如下结构: /etc/letsencrypt/ ├── accounts │ └── acme-staging.api.letsencrypt.org 实现这些, 需要两步: 1、首先, letsencrypt客户端会向letsencrypt CA(下文简称为:CA)证明web服务器控制一个域 2、其次, letsencrypt客户端(下文简称为:代理
/letsencrypt 2.进入目录 cd letsencrypt 3.查看工具用法 . 我输入的是tomcat的ROOT目录,成功之后出现如下信息: [root@host letsencrypt]# . : 执行成功后:在/etc/letsencrypt/live/xx.com 目录下有5个文件 /etc/letsencrypt/live/janeyork.qicp.vip cert.pem 服务器证书 pass:123456 #移动新生成的证书文件 cp /etc/letsencrypt/live/yourDomain/fullchain.pem /mnt/web/letsTemp cp /etc/letsencrypt /tomcat_letsencrypt.jks /etc/letsencrypt/live/www.xxx.com/tomcat_letsencrypt`date '+%Y-%m-%d'`.jks cd
测试环境: ubuntu 14 64bit lnmp 1.3 获取证书 git clone https://github.com/letsencrypt/letsencrypt cd letsencrypt /letsencrypt-auto certonly --standalone --email hhtjim@foxmail.com -d hhtjim.com -d www.hhtjim.com # /letsencrypt-auto certonly --webroot --email hhtjim@foxmail.com -d link.hhtjim.com 执行完上面三个命令之后会有图形界面出现 /live/域名/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/域名/privkey.pem; 参考如下完整配置 server /bin/sh ~/letsencrypt/letsencrypt-auto certonly --webroot -w /home/wwwroot/www.hhtjim.com/ --renew-by-default
/certbot/etc/letsencrypt:/etc/letsencrypt -v ./certbot/var/log/letsencrpt:/var/log/letsencrypt -v . /certbot/etc/letsencrypt/live:/letsencrypt/live # 当前证书目录 - . /certbot/etc/letsencrypt:/etc/letsencrypt \-v . /certbot/var/lib/letsencrypt:/var/lib/letsencrypt \-v . /certbot/var/log/letsencrypt:/var/log/letsencrypt \-v .
报错内容: [root@ebs-40617 /]# git clone https://github.com/letsencrypt/letsencrypt Cloning into 'letsencrypt '... fatal: unable to access 'https://github.com/letsencrypt/letsencrypt/': SSL connect error 解决: 更新
为了使它更简单,我们将把 .well-known/acme-challenge 的所有 HTTP 请求映射到单个目录 / var/lib/letsencrypt。 mkdir -p /var/lib/letsencrypt/.well-known chgrp www-data /var/lib/letsencrypt chmod g+s /var/lib/letsencrypt 打开文本编辑器并创建第一个片段 letsencrypt.conf: sudo nano /etc/nginx/snippets/letsencrypt.conf /etc/nginx/snippets/ letsencrypt.conf location ^~ /.well-known/acme-challenge/ { allow all; root /var/lib/letsencrypt/ /etc/letsencrypt/live/example.com/chain.pem; include snippets/ssl.conf; include snippets/letsencrypt.conf
/letsencrypt.log Plugins selected: Authenticator nginx, Installer nginx Enter email address (used for You must agree in order to register with the ACME server at https://acme-v02.api.letsencrypt.org/directory Your certificate and chain have been saved at: /etc/letsencrypt/live/jenkins.coolops.cn/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/jenkins.coolops.cn/privkey.pem Your 我们可以到相应的目录下查看证书 [root@VM_0_2_centos jenkins.coolops.cn]# cd /etc/letsencrypt/live/jenkins.coolops.cn
windows 平台推荐使用letsencrypt-win-simple(https://github.com/Lone-Coder/letsencrypt-win-simple/releases )申请证书 1.准备工作 1.1 设置DNS 在 DNS 服务器设置正确的域名(二级域名、三级域名都可以) 1.2 下载运行 letsencrypt-win-simple: 下载最新版本 letsencrypt-win-simple (https://github.com/Lone-Coder/letsencrypt-win-simple/releases ) 在服务器上解压 letsencrypt-win-simple,解压后文件结构如下 letsencrypt-win-simple.V1.9.1 文件结构 1.3 letsencrypt-win-simple 运行环境 双击 letsencrypt.exe,运行需要 .NET 运行环境, 安装 2.IIS 部署 HTTPS 站点 2.1 自动化认证单个域名 在服务器上,终端 cd 到 letsencrypt.exe 文件夹,键入如下命令: letsencrypt.exe —accepttos