centos7用Let's Encrypt 获取免费证书

安装

# yum install -y epel-release nginx git（未安装的安装下）
git clone https://github.com/letsencrypt/letsencrypt
cd letsencrypt
./letsencrypt-auto --help

获取 SSL 证书

证书申请频率限制

• IP 限制：每注册 IP 每 3 个小时不超过 10 次
• 域名数量限制：每个域名（包含子域名）每 7 天不超过 5 个

webroot 模式

这种方式生成的证书可以给多个二级域名使用，这种方式需要验证443端口，如果端口被占用会失败，如果提示congratulations，则表示成功

./letsencrypt-auto certonly --webroot --webroot-path /usr/share/nginx/html -d yourDomain --agree-tos --email [email protected]

certonly 模式

唯一需要注意的就是，certonly 模式下获取证书需要先关闭 nginx

service nginx stop
./letsencrypt-auto certonly --standalone -d yourDomain

获取成功后，会输出类似如下内容：

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for cjli.info
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/yourDomain/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/yourDomain/privkey.pem
   Your cert will expire on 2018-07-30. To obtain a new or tweaked
   version of this certificate in the future, simply run
   letsencrypt-auto again. To non-interactively renew *all* of your
   certificates, run "letsencrypt-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

注意：上面成功提示信息中的证书和私钥文件的路径，用于接下来 nginx 的配置

生成 dhparam

为了进一步提高安全性，建议为 nginx 再生成 2048 位 DH parameters：

openssl dhparam -out /etc/ssl/certs/dhparams.pem 2048

关于 DH Parameters 的解释，可以参考：What’s the purpose of DH Parameters?。

nginx 部署 ssl 证书

    # HTTPS server
    server {
        listen 80;
        listen 443 ssl;
        server_name yourDomain;
        root html;
        index index.html index.htm;
        ssl_certificate   /etc/letsencrypt/live/yourDomain/fullchain.pem;
        ssl_certificate_key  /etc/letsencrypt/live/yourDomain/privkey.pem;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

        location /backend{
            proxy_set_header  X-Real-IP  $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass http://localhost:8090/backend;
        }
        
        # backend
        location /server {
            try_files $uri $uri/ /server/index.html;
        }
        
        location /image/{
          root /opt/nginx/html/;
          autoindex on;
        }
        
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }
}

如配置htttps后访问不了，需要到服务提供商添加安全组，如阿里云-网络与安全-安全组，如还有问题可能跟防火墙有关，具体自行查阅资料

证书续期

由于 Let’s Encrypt 颁发的服务器证书有效期只有 90 天，因此如果需要长期使用，就有必要设置好自动续期。
通过 letsencrypt-auto 工具，手动续期命令为：

./letsencrypt-auto renew

而所谓的自动续期，就是自动定时执行上面手动获得证书的操作，对于 Linux 来说，可以使用 crontab。

echo '@monthly root /path/to/letsencrypt-auto certonly --webroot --webroot-path /usr/share/nginx/html -d yourDomain --agree-tos --email [email protected] >> /var/log/letsencrypt/letsencrypt-auto-update.log' | tee --append /etc/crontab