使用Let’s Encrypt申请免费的ssl证书

只要能够自己配置域名的dns就可以使用 Let’s Encrypt 申请免费的 ssl证书，而且还支持通配符和多域名证书，非常强大。

1.安装工具

centos

# 安装依赖
yum -y install yum-utils
yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional

# 安装证书工具
yum install certbot

macos

# 安装brew
/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

# 安装证书工具
brew install certbot

2.获取证书

sudo certbot certonly  --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory

# 根据提示输入域名、配置dns
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Please enter in your domain name(s) (comma and/or space separated)  (Enter 'c'
to cancel): 
# 这里申请了两个通配符域名
*.cdn.example.com *.example.com
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for cdn.example.com
dns-01 challenge for example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# 允许记录
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# 根据提示配置_acme-challenge.cdn.example.com 和 _acme-challenge.example.com 两个域名的返回值

Please deploy a DNS TXT record under the name
_acme-challenge.cdn.example.com with the following value:

BEchky8W9MP0eSRtJT38iv5WI7fL0k_3Bvjx27k-610

Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.example.com with the following value:

Aw9zfmHTyDhWvDKU8kuscdgIFSGo4EyRWiCKa1FTbj4

Before continuing, verify the record is deployed.
(This must be set up in addition to the previous challenges; do not remove,
replace, or undo the previous challenge tasks yet. Note that you might be
asked to create multiple distinct TXT records with the same name. This is
permitted by DNS standards.)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue

验证通过后生成的证书在/etc/letsencrypt/live/目录下