LetsEncrypt申请免费https通配符证书
Mac 申请
-
- 如果没有安装brew,先安装brew brew官网
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"
-
- 登录 LetsEncrypt官网(https://certbot.eff.org/) 选择容器和平台按照提示进行操作
-
- 安装 certbot
brew install certbot
sudo certbot certonly -d *.域名 --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory --no-bootstrap
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel):
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.
Are you OK with your IP being logged?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- e. 把dns解析TXT文本到_acme-challenge.域名下后回车(可以使用
dig -t txt _acme-challenge.域名命令查看dns解析是否生效)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.域名 with the following value:
文本
Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- f. 申请成功 证书在 /etc/letsencrypt/live/域名 目录
- Congratulations
/etc/letsencrypt/live/域名/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/f域名/privkey.pem
Your cert will expire on 2020-09-01. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
CentOS申请
sudo wget https://dl.eff.org/certbot-auto
sudo chmod a+x certbot-auto
./certbot-auto certonly -d *.域名 --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory --no-bootstrap
其他说明
This directory contains your keys and certificates.
`privkey.pem` : the private key for your certificate.
`fullchain.pem`: the certificate file used in most server software.
`chain.pem` : used for OCSP stapling in Nginx >=1.3.7.
`cert.pem` : will break many server configurations, and should not be used
without reading further documentation (see link below).
WARNING: DO NOT MOVE OR RENAME THESE FILES!
Certbot expects these files to remain in this location in order
to function properly!
We recommend not moving these files. For more information, see the Certbot
User Guide at https://certbot.eff.org/docs/using.html#where-are-my-certificates.
privkey.pem 是私钥fullchain.pem 是大多数服务器软件中使用的证书文件chain.pem 用于Nginx >=1.3.7cert.pem 正常不应该使用- 然后这些证书文件实际上是软链接
/etc/letsencrypt/archive/域名 里面的对应 privkey1.pem privkey2.pem 的,所以 LetsEncrypt 不希望我们去动他,可以直接用于服务器证书配置,或者使用 ln -s 证书路径 服务器配置证书路径 软链接再去链接文件到我们实际服务器的配置中
- 证书有效期为三个月，到期之前需要更新证书，更新流程就是重新执行一遍上面的操作，新证书会在你申请证书的日期上加三个月。
- 可以使用命令设置证书自动续期,这个目前没有测试
./certbot-auto renew --dry-run
./certbot-auto renew --quiet
- 阿里云，腾讯云等云服务器供应商,每个账号一般都会有20个免费的单域名证书名额，如果使用单域名的话这些可能比较方便。
- nginx证书配置
ssl_certificate 配置写privkey.pem 路径ssl_certificate_key 配置写 fullchain.pem 或者 chain.pem 路径- 如果nginx安装了http2 模块可以使用http2 速度比https快了不少
