补充记录腾讯云 DNSPod 域名 API 申请 Let’s Encrypt 泛域名 SSL 证书需要注意的几点

server
 {
 listen 80;
 #listen [::]:80;
 server_name www.vpsss.net vpsss.net;
 return 301 https://www.vpsss.net$request_uri;
 }

server
 {
 listen 443 ssl https2;
 ssl_certificate /etc/letsencrypt/live/www.vpsss.net/fullchain.pem;
 ssl_certificate_key /etc/letsencrypt/live/www.vpsss.net/privkey.pem;
 # 注意检查上面证书的路径，live 下的证书文件夹名是否含有 www，如果没有，请在上面两行中删除 www.

 ssl_ciphers "EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5";
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_prefer_server_ciphers on;
 ssl_session_cache shared:SSL:10m;

 # HSTS (ngx_https_headers_module is required) (31536000 seconds = 12 months)
 # add_header Strict-Transport-Security "max-age=31536000" always;

 # OCSP Stapling ---
 # fetch OCSP records from URL in ssl_certificate and cache them
 ssl_stapling on;
 ssl_stapling_verify on;

index index.html index.htm index.php default.html default.htm default.php;
 server_name www.vpsss.net;
 root /home/wwwroot/www.vpsss.net;

include wordpress.conf;
 #error_page 404 /404.html;
 include enable-php.conf;

location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
 {
 expires 30d;
 }

location /wp-content/uploads/ {  
location ~ .*\.(php)?$ {  
deny all;  
} 
} 

location ~ .*\.(js|css)?$
 {
 expires 12h;
 }

location ~ /\.
 {
 deny all;
 }
 access_log off;
 }