概述 本文介绍如何通过 Certbot 安装 Https Letsencrypt 证书 先决条件 1、拥有一个域名,例如 mydomain.com 2、在域名服务器创建一条A记录,指向云主机的公网IP )下的/.well-known/acme-challenge/目录里面,并通过已经启动的nginx验证随机文件,生成证书 证书应用 通过以上方式生的成证书及 privkey 等文件一般位于 /etc/letsencrypt sites-available/default 中的 server 节点下添加: listen 443 ssl; listen [::]:443 ssl; ssl_certificate /etc/letsencrypt /live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; 续期
toc 因为Hipo在线版的~~计划(不日放出)~~,所以将hipo.cash升级到https,证书是免费开放的 letsencrypt,配合官方的工具certbot。 ; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot # Redirect non-https traffic to https if ($ = "https") { return 301 https://$host$request_uri; } # managed by Certbot ---- letsencrypt http://127.0.0.1:18080; } } 重启nginx,正常情况下网站便成功升级到了https letsencrypt的脚本需要90后renew下,certbot也支持自动更新
自从Https开始以后,一直为GitHub Pages的HTTPS认证而烦恼,之前一直用的cloudflare,无奈不是官方出的,总感觉不顺啊,进网站有时还是会提示SSL错误,今天才知道官方支持了HTTPS配置了,那是相当的简单,真香!
(采用 CC BY-NC-SA 4.0 许可协议进行授权) 本文标题:《 Letsencrypt 泛域名 SSL 证书免费申请 》 本文链接:https://lisz.me/tech/webmaster
letsencrypt的官方网站是 https://letsencrypt.org/ github地址是 https://github.com/letsencrypt/letsencrypt ,现在好像会自动跳转到 mkdir -p /home/website/letsencrypt; git clone https://github.com/letsencrypt/letsencrypt /home/website /letsencrypt/letsencrypt; cd /home/website/letsencrypt/letsencrypt; . /bin/sh /home/website/letsencrypt/letsencrypt/letsencrypt-auto renew; cp /etc/letsencrypt/live/gf.owent.net /letsencrypt/renew.sh letsencrypt会把证书放在/etc/letsencrypt/live/[域名]里,我的证书都放在/home/website/ssl/中,所以我把它copy
参考: https://github.com/Neilpang/acme.sh/wiki/%E8%AF%B4%E6%98%8E https://lnmp.org/faq/letsencrypt-wildcard-ssl.html
在home目录创建.azure.ini文件,替换成你的azure service principal:
cert-manager.yaml 创建 clusterissuer # issuer.yaml apiVersion: v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: # 邮箱,证书过期前会发邮件到这个邮箱 email: admin@arfront.com server: https://acme-v02.api.letsencrypt.org apiVersion: extensions/v1beta1 kind: Ingress metadata: annotations: cert-manager.io/cluster-issuer: letsencrypt-prod #需要使用这个标记,letsencrypt-prod是上面issuer的名称 name: nginx namespace: default spec: rules: - host: dev.arfront.cn
下面给出一个示例的 letsencrypt.yml 配置,替换其中的 即可快速查看配置。 apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: this privateKeySecretRef: name: prod-issuer-account-key server: https://acme-v02.api.letsencrypt.org $ kubectl describe clusterissuer letsencrypt ... 参考文献# Default static install By cert-manager Traefik Docs HTTPS using Letsencrypt and Traefik with k3s
example -d example.com -d www.example.com -w /var/www/thing -d thing.is -d m.thing.is 生成的证书通常保存在/etc/letsencrypt
参考: https://letsencrypt.org/zh-cn/docs/ https://github.com/acmesh-official/acme.sh/tree/master/dnsapi https://github.com/acmesh-official/acme.sh/wiki/%E8%AF%B4%E6%98%8E https://lnmp.org/faq/letsencrypt-wildcard-ssl.html
下面给出一个示例的 letsencrypt.yml 配置,替换其中的 即可快速查看配置。 apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: this privateKeySecretRef: name: prod-issuer-account-key server: https://acme-v02.api.letsencrypt.org $ kubectl describe clusterissuer letsencrypt ... 参考文献# Default static install By cert-manager Traefik Docs HTTPS using Letsencrypt and Traefik with k3s
/letsencrypt cd letsencrypt . docker run -it --rm -p 443:443 -p 80:80 --name letsencrypt \ -v "/etc/letsencrypt:/etc/letsencrypt " \ -v "/var/lib/letsencrypt:/var/lib/letsencrypt" \ quay.io/letsencrypt/letsencrypt , 查看/etc/letsencrypt将会看到如下结构: /etc/letsencrypt/ ├── accounts │ └── acme-staging.api.letsencrypt.org 实现这些, 需要两步: 1、首先, letsencrypt客户端会向letsencrypt CA(下文简称为:CA)证明web服务器控制一个域 2、其次, letsencrypt客户端(下文简称为:代理
/letsencrypt 2.进入目录 cd letsencrypt 3.查看工具用法 . 我输入的是tomcat的ROOT目录,成功之后出现如下信息: [root@host letsencrypt]# . : 执行成功后:在/etc/letsencrypt/live/xx.com 目录下有5个文件 /etc/letsencrypt/live/janeyork.qicp.vip cert.pem 服务器证书 pass:123456 #移动新生成的证书文件 cp /etc/letsencrypt/live/yourDomain/fullchain.pem /mnt/web/letsTemp cp /etc/letsencrypt /tomcat_letsencrypt.jks /etc/letsencrypt/live/www.xxx.com/tomcat_letsencrypt`date '+%Y-%m-%d'`.jks cd
测试环境: ubuntu 14 64bit lnmp 1.3 获取证书 git clone https://github.com/letsencrypt/letsencrypt cd letsencrypt /letsencrypt-auto certonly --standalone --email hhtjim@foxmail.com -d hhtjim.com -d www.hhtjim.com # /letsencrypt-auto certonly --webroot --email hhtjim@foxmail.com -d link.hhtjim.com 执行完上面三个命令之后会有图形界面出现 /live/域名/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/域名/privkey.pem; 参考如下完整配置 server /bin/sh ~/letsencrypt/letsencrypt-auto certonly --webroot -w /home/wwwroot/www.hhtjim.com/ --renew-by-default
/certbot/etc/letsencrypt:/etc/letsencrypt -v ./certbot/var/log/letsencrpt:/var/log/letsencrypt -v . /certbot/etc/letsencrypt/live:/letsencrypt/live # 当前证书目录 - . /certbot/etc/letsencrypt:/etc/letsencrypt \-v . /certbot/var/lib/letsencrypt:/var/lib/letsencrypt \-v . /certbot/var/log/letsencrypt:/var/log/letsencrypt \-v .
报错内容: [root@ebs-40617 /]# git clone https://github.com/letsencrypt/letsencrypt Cloning into 'letsencrypt '... fatal: unable to access 'https://github.com/letsencrypt/letsencrypt/': SSL connect error 解决: 更新
/letsencrypt.log Plugins selected: Authenticator nginx, Installer nginx Enter email address (used for You must agree in order to register with the ACME server at https://acme-v02.api.letsencrypt.org/directory Your certificate and chain have been saved at: /etc/letsencrypt/live/jenkins.coolops.cn/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/jenkins.coolops.cn/privkey.pem Your 我们可以到相应的目录下查看证书 [root@VM_0_2_centos jenkins.coolops.cn]# cd /etc/letsencrypt/live/jenkins.coolops.cn
Your certificate and chain have been saved at: /etc/letsencrypt/live/www.fundebug.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/www.fundebug.com/privkey.pem Your cert /donate Donating to EFF: https://eff.org/donate-le HTTPS 证书相关的文件在/etc/letsencrypt /目录中: find /etc/letsencrypt/ -name "*www.fundebug.com*" /etc/letsencrypt/renewal/www.fundebug.com.conf /etc/letsencrypt/archive/www.fundebug.com /etc/letsencrypt/live/www.fundebug.com certbot 会自动修改 nginx
certbot-auto certonly --standalone --email syf@alexorz.com --agree-tos -d alexorz.com 查看生成的证书 ll /etc/letsencrypt /live/alexorz.com/privkey.pem lrwxrwxrwx 1 root root 38 Nov 10 01:59 /etc/letsencrypt/live/alexorz.com /privkey.pem ll /etc/letsencrypt/live/alexorz.com/fullchain.pem lrwxrwxrwx 1 root root 40 Nov 10 01: 59 /etc/letsencrypt/live/alexorz.com/fullchain.pem -> ../.. /live/alexorz.com/fullchain.pem"; ssl_certificate_key "/etc/letsencrypt/live/alexorz.com/privkey.pem