acme.sh
方式(推荐)sslforfree1.tinywan.com sslforfree2.tinywan.com
,输入后点选右边的 Create Free SSL Certificate 继续Manual Verification (DNS)
:点选下方的Manually Verify Domain
按钮继续。Download SSL Certificate
下载证书Certificate Successfully Generated
,如果通过验证后,就会开始为生成所申请网站 SSL 凭证。当凭证生成后,可以看到[Get Notified of Expiration],由于申请的凭证有效期只有90天,所以可以在此设定一组 Email 和密码,即可在凭证过期前(一周左右)取得通知,以免错过延长(renew)时间。
您可以通过单击下面的下载来下载文件,或将以下内容复制并粘贴到相应的输入中进行安装。 SSL证书在90天后过期,因此请务必重新生成您的SSL证书,否则您的网站可能会停止工作。 如果您需要,也可以删除所有验证文件夹,文件或TXT记录,因为它们仅用于验证目的。
域名已添加到您的帐户中。 您将在域名即将到期前一周收到通知。Download All SSL Certificate Files
下载凭证文件压缩包,解压缩后可以看到 private.key、ca_bundle.crt和 certificate.crt
三个文件申请SSL DNS API 列表大全
如下所示安装成功
注:我在centos 7上遇到问题,安装完后执行
acme.sh
,提示命令没找到,如果遇到跟我一样的问题,请关掉终端然后再登陆,或者执行以下指令:source ~/.bashrc
acme.sh
强大之处在于,可以自动配置DNS,不用去域名后台操作解析记录了,我的域名是在阿里注册的,下面给出阿里云解析的例子,其他地方注册的请参考这里自行修改:传送门
请先前往阿里云后台获取App_Key
跟App_Secret
传送门,然后执行以下脚本
# 替换成从阿里云后台获取的密钥
export Ali_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
export Ali_Secret="jlsdflanljkljlfdsaklkjflsa"
# 换成自己的域名
acme.sh --issue --dns dns_ali -d zhuziyu.cn -d *.zhuziyu.cn
这里是通过线程休眠120秒等待DNS生效的方式,所以至少需要等待两分钟
到了这一步大功告成。生成的证书放在该目录下:/home/www/.acme.sh/
自动生成一个定时任务,每天凌晨0:00
自动检测过期域名并且自动续期
19 0 * * * "/home/www/.acme.sh"/acme.sh --cron --home "/home/www/.acme.sh" > /dev/null
server {
server_name xx.domain.com;
listen 443 http2 ssl;
ssl_certificate /path/.acme.sh/domain/fullchain.cer;
ssl_certificate_key /path/.acme.sh/domain/domain.key;
ssl_trusted_certificate /path/.acme.sh/domain/ca.cer;
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_pass http://127.0.0.1:10086;
}
}
acme.sh
比certbot
的方式更加自动化,省去了手动去域名后台改DNS记录的步骤,而且不用依赖Python,强烈推荐。
第一次成功之后,acme.sh
会记录下App_Key
跟App_Secre
t,并且生成一个定时任务,每天凌晨0:00
自动检测过期域名并且自动续期。对这种方式有顾虑的,请慎重,不过也可以自行删掉用户级的定时任务,并且清理掉~/.acme.sh文件夹就行
$ docker run --rm -it -v "D:\Git\docker-lnmp\dev\nginx\v5\etc\letsencrypt":/acme.sh -e Ali_Key="LTAIn" -e Ali_Secret="zLzA" neilpang/acme.sh --issue --dns dns_ali -d tinywan.t
op -d *.tinywan.top
[Tue Dec 25 01:44:38 UTC 2018] Registering account
[Tue Dec 25 01:44:40 UTC 2018] Registered
[Tue Dec 25 01:44:40 UTC 2018] ACCOUNT_THUMBPRINT='UjJGcl0AYEvwHhkimYhobMKf3vIIFItPd2g4Y7HAUmI'
[Tue Dec 25 01:44:40 UTC 2018] Creating domain key
[Tue Dec 25 01:44:40 UTC 2018] The domain key is here: /acme.sh/tinywan.top/tinywan.top.key
[Tue Dec 25 01:44:40 UTC 2018] Multi domain='DNS:tinywan.top,DNS:*.tinywan.top'
[Tue Dec 25 01:44:40 UTC 2018] Getting domain auth token for each domain
[Tue Dec 25 01:44:41 UTC 2018] Getting webroot for domain='tinywan.top'
[Tue Dec 25 01:44:41 UTC 2018] Getting webroot for domain='*.tinywan.top'
[Tue Dec 25 01:44:41 UTC 2018] Found domain api file: /root/.acme.sh/dnsapi/dns_ali.sh
[Tue Dec 25 01:44:42 UTC 2018] Found domain api file: /root/.acme.sh/dnsapi/dns_ali.sh
[Tue Dec 25 01:44:43 UTC 2018] Sleep 120 seconds for the txt records to take effect
[Tue Dec 25 01:46:44 UTC 2018] Verifying:tinywan.top
[Tue Dec 25 01:46:47 UTC 2018] Success
[Tue Dec 25 01:46:47 UTC 2018] Verifying:*.tinywan.top
[Tue Dec 25 01:46:51 UTC 2018] Success
[Tue Dec 25 01:46:51 UTC 2018] Removing DNS records.
[Tue Dec 25 01:46:54 UTC 2018] Verify finished, start to sign.
[Tue Dec 25 01:46:57 UTC 2018] Cert success.
-----BEGIN CERTIFICATE-----
MIIFXDCCBESgAwIBAgISAxdu6rCkYCOfSo3YSzuLV0RKMA0GCSqGSIb3DQEBCwUA
-----END CERTIFICATE-----
[Tue Dec 25 01:46:57 UTC 2018] Your cert is in /acme.sh/tinywan.top/tinywan.top.cer
[Tue Dec 25 01:46:57 UTC 2018] Your cert key is in /acme.sh/tinywan.top/tinywan.top.key
[Tue Dec 25 01:46:57 UTC 2018] The intermediate CA cert is in /acme.sh/tinywan.top/ca.cer
[Tue Dec 25 01:46:57 UTC 2018] And the full chain certs is there: /acme.sh/tinywan.top/fullchain.cer
保存目录
/home/www/openssl
D:\Git\docker-lnmp\dev\nginx\v5\etc\letsencrypt
参数详解(阿里云后台获取的密钥)
Ali_Key
阿里云 AccessKey IDAli_Secret
阿里云 Access Key Secret如果是二级域名,则应该多追加域名:
*.frps.tinywan.top
docker run --rm -it -v "D:\Git\docker-lnmp\dev\nginx\v5\etc\letsencrypt":/acme.sh -e Ali_Key="LTAInNlMZ" -e Ali_Secret="zLzefTpRA" neilpang/acme.sh --issue --dns dns_ali -d tinywan.
top -d *.tinywan.top -d *.frps.tinywan.top
user www;
worker_processes auto;
error_log /var/log/nginx/error.log error;
pid /run/openresty.pid;
worker_rlimit_nofile 204800;
events {
worker_connections 65535;
multi_accept on;
use epoll;
}
http {
charset utf-8;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
server_tokens off;
log_not_found off;
types_hash_max_size 2048;
client_max_body_size 16M;
# MIME
include mime.types;
default_type application/octet-stream;
# logging
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log warn;
# SSL
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
# modern configuration
ssl_protocols TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256;
ssl_prefer_server_ciphers on;
# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
resolver_timeout 2s;
more_set_headers "X-Frame-Options: SAMEORIGIN";
include "/usr/local/openresty/nginx/conf/conf.d/*.conf";
#include /etc/nginx/sites-enabled/*;
#include "/opt/verynginx/verynginx/nginx_conf/in_http_block.conf";
}
command not found
$ sudo luarocks sudo: luarocks: command not found
解决办法,使用绝对路径
sudo /usr/local/openresty/luajit/bin/luarocks