使用Let's Encrypt免费证书实现https

yum install epel-release -y

yum install certbot python2-certbot-nginx

certbot --nginx

certbot certonly --nginx

[root@VM_0_2_centos ssl]# certbot certonly --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): coolops@163.com
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Starting new HTTPS connection (1): supporters.eff.org

Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: jenkins.coolops.cn
2: www.coolops.cn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for jenkins.coolops.cn
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/jenkins.coolops.cn/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/jenkins.coolops.cn/privkey.pem
   Your cert will expire on 2020-08-23. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

[root@VM_0_2_centos jenkins.coolops.cn]# cd /etc/letsencrypt/live/jenkins.coolops.cn
[root@VM_0_2_centos jenkins.coolops.cn]# ll 
total 4
lrwxrwxrwx 1 root root  42 May 25 14:50 cert.pem -> ../../archive/jenkins.coolops.cn/cert1.pem
lrwxrwxrwx 1 root root  43 May 25 14:50 chain.pem -> ../../archive/jenkins.coolops.cn/chain1.pem
lrwxrwxrwx 1 root root  47 May 25 14:50 fullchain.pem -> ../../archive/jenkins.coolops.cn/fullchain1.pem
lrwxrwxrwx 1 root root  45 May 25 14:50 privkey.pem -> ../../archive/jenkins.coolops.cn/privkey1.pem
-rw-r--r-- 1 root root 692 May 25 14:50 README

 server{
         listen 80 ;
         listen 443 ssl;
         server_name jenkins.coolops.cn;
         ssl_certificate /etc/letsencrypt/live/jenkins.coolops.cn/fullchain.pem;
         ssl_certificate_key /etc/letsencrypt/live/jenkins.coolops.cn/privkey.pem;
         ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
         ssl_prefer_server_ciphers  on;
         ssl_session_cache    shared:SSL:1m;
         ssl_session_timeout  5m;

         location / {
                 proxy_connect_timeout 180;
                 proxy_send_timeout 180;
                 proxy_read_timeout 180;
                 proxy_set_header Host $host;
                 proxy_set_header X-Forwarder-For $remote_addr;
                 proxy_pass http://127.0.0.1:8080;
         }
 }

echo "0 0,12 * * * root python -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot renew -q" | sudo tee -a /etc/crontab > /dev/null