85 lines
2.6 KiB
Markdown
85 lines
2.6 KiB
Markdown
---
|
|
title: "Letsencrypt 笔记"
|
|
date: 2021-11-06T20:52:00+08:00
|
|
lastmod: 2021-11-06T20:52:00+08:00
|
|
keywords: []
|
|
tags: ["letsencrypt", "certbot", "ssl"]
|
|
categories: ["web"]
|
|
---
|
|
|
|
# 安装 certbot
|
|
- 在 alpine linux 中安装 certbot
|
|
```bash
|
|
apk add --no-cache certbot openssl
|
|
```
|
|
|
|
- 注册
|
|
```bash
|
|
certbot register --register-unsafely-without-email --agree-tos
|
|
```
|
|
|
|
# 普通域名证书
|
|
- 申请 ssl 证书，有效期 90 天
|
|
```bash
|
|
certbot certonly -n -d x.x.com --standalone
|
|
|
|
# 证书文件生成到 /etc/letsencrypt/live/x.x.com/ 下
|
|
# 参数 -d 可以使用多次来指定多个域名，也可以在一个 -d 参数中使用逗号分隔多个域名
|
|
# 参数 --cert-name 可以指定证书文件的父级目录名字(替换默认的 x.x.com)
|
|
```
|
|
|
|
- 续签 ssl 证书
|
|
```bash
|
|
cerbot renew --force-renewal
|
|
```
|
|
|
|
- 生成 2048 位的交换密钥文件
|
|
```bash
|
|
openssl dhparam -out /etc/letsencrypt/dhparam.pem 2048
|
|
```
|
|
|
|
# 通配域名证书
|
|
- 申请 ssl 证书，有效期 90 天
|
|
```bash
|
|
certbot certonly --manual -d '*.x.com' \
|
|
--preferred-challenges dns \
|
|
--server https://acme-v02.api.letsencrypt.org/directory
|
|
|
|
# 证书文件生成到 /etc/letsencrypt/live/x.com/ 下
|
|
# 参数 --cert-name 可以指定证书文件的父级目录名字(替换默认的 x.com)
|
|
```
|
|
|
|
- 续签 ssl 证书，使用 certonly 子命令指定域名单独更新
|
|
```bash
|
|
certbot certonly --force-renewal --manual -d '*.x.com' \
|
|
--preferred-challenges dns \
|
|
--server https://acme-v02.api.letsencrypt.org/directory
|
|
```
|
|
|
|
- 生成 2048 位的交换密钥文件
|
|
```bash
|
|
openssl dhparam -out /etc/letsencrypt/dhparam.pem 2048
|
|
```
|
|
|
|
# 使用证书
|
|
- nginx 配置 ssl
|
|
```
|
|
server {
|
|
listen 443 ssl;
|
|
server_name x.x.x;
|
|
ssl_certificate /etc/letsencrypt/live/x.x.x/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/x.x.x/privkey.pem;
|
|
ssl_session_cache shared:le_nginx_SSL:10m;
|
|
ssl_session_timeout 1440m;
|
|
ssl_session_tickets off;
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
|
|
ssl_dhparam /etc/letsencrypt/dhparam.pem;
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|
|
```
|
|
|