开始安装https

假设运行环境为centos7.1,Web 服务器是 Nginx 1.12.0(因为我的生产环境是),当前工作目录为 /root
获取certbot客户端
wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto
单个域名下发
./certbot-auto certonly --standalone --email 你的邮箱地址 -d 你的域名地址
多域名下发
./certbot-auto certonly --standalone --email 你的邮箱地址 -d 你的域名1 -d 你的域名2
查看生产的证书目录
cd /etc/letsencrypt/live/

nignix配置

vim test.conf
listen 443;
ssl on;
ssl_certificate /etc/letsencrypt/live/test.com/fullchain.pem;
#ssl_certificate /etc/letsencrypt/live/test.com/cert.pem;
ssl_certificate_key /etc/letsencrypt/live/test.com/privkey.pem;

     ssl_prefer_server_ciphers on;
             #选择tlsv的版本协议
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_session_timeout 5m;
resolver 8.8.8.8 8.8.4.4 223.5.5.5 valid=300s;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=31536000;";
charset utf-8;
server_name test.com;
root /home/test;
location / {
root /home/test;
index index.php index.html index.htm;

      if (!-e $request_filename){
    rewrite ^(.*)$ /$1.php last;
    break;
}
    }

#php调用
location ~ .php$ {
fastcgi_pass unix:/dev/shm/php-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}

             重启nginx

             证书续签

             ./certbot-auto renew