debian+apache+acme_tiny+lets-encrypt配置笔记

apt-get install apache2
a2enmod rewrite
a2enmod ssl
apt-get install php5 php-pear
vi /etc/apache2/sites-enabled/000-default
---------------------------000-default------------------------
Alias /.well-known/acme-challenge/ /var/www/challenges/
--------------------------------------------------------------
mkdir /var/www/challenges

mkdir /etc/apache2/ssl
cd /etc/apache2/ssl
openssl genrsa 4096 > account.key
openssl genrsa 4096 > domain.key
openssl req -new -sha256 -key domain.key -subj "/" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:domain.com,DNS:www.domain.com")) > domain.csr
wget https://raw.githubusercontent.com/diafygi/acme-tiny/master/acme_tiny.py
python acme_tiny.py --account-key ./account.key --csr ./domain.csr --acme-dir /var/www/challenges/ > ./signed.crt
wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem


------------------default-ssl---------------------------------
SSLCertificateFile    /etc/apache2/ssl/signed.crt
SSLCertificateKeyFile /etc/apache2/ssl/domain.key
SSLCertificateChainFile /etc/apache2/ssl/intermediate.pem
--------------------------------------------------------------

vi /etc/apache/ssl/renew.sh
------------------------------renew.sh-------------------------
#!/bin/bash

cd /etc/apache2/ssl
python acme_tiny.py --account-key ./account.key --csr ./domain.csr --acme-dir /var/www/challenges/ > ./signed.crt || exit
wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem
/etc/init.d/apache2 reload

--------------------------------------------------------------

crontab -e

------------------crontab--------------------------------
0 0 1 * * /etc/apache/ssl/renew.sh >/dev/null 2>&1
--------------------------------------------------------------