参考:https://diamondfsd.com/article/e221b455-b0e7-40b7-a6c7-9bb7e3e35657 当然使用伟大的lets encrypt呀
add-apt-repository ppa:certbot/certbot
apt-get update
apt-get install certbot
service nginx stop
certbot certonly --standalone -d www.superpig.win
# service nginx start
如果出现提示按提示输入邮箱和是否共享email给EFF(第一次安装) 申请成功后,会出现这样的提示
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/www.superpig.win/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/www.superpig.win/privkey.pem
Your cert will expire on 2018-01-07. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
在nginx的配置中加入下面的字段就行。
ssl_certificate /etc/letsencrypt/live/www.superpig.win/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.superpig.win/privkey.pem;
搞定。
可以设置每隔一段时间就自动续期证书
15 2 * */2 * certbot renew --pre-hook "service nginx stop" --post-hook "service nginx start"