零依赖!使用acme.sh设置nginx多个https证书自动更新，无限续期https证书

zhaoolee

发布于 2021-06-29 11:18:05

8.9K1

发布于 2021-06-29 11:18:05

在谷歌的推动下，网站支持https几乎成了刚需，而免费的https证书大多只有一年的使用时间，且二级子域名需要单个申请，而遇到https证书失效的情况，基本就是一次生产事故，为了彻底解决以上问题，本文提供一种通用的，无限续期https证书的教程。

安装nginx

# 获取源
sudo rpm -ivh http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm
# 安装Nginx
sudo yum install -y nginx
# 设置开机启动
sudo systemctl enable nginx
# 开启nginx
sudo systemctl start nginx
# 重启nginx
sudo systemctl restart nginx
# nginx重新加载配置文件
sudo systemctl reload nginx

以配置域名hk.v2fy.com为例，新建配置文件 /etc/nginx/conf.d/hk.v2fy.com.conf

touch /etc/nginx/conf.d/hk.v2fy.com.conf

在 /etc/nginx/conf.d/hk.v2fy.com 中添加http服务相关内容

server {
    listen       80;
    listen       [::]:80;
    server_name  hk.v2fy.com;
    root         /usr/share/nginx/html/hk.v2fy.com;

    error_page 404 /404.html;
    location = /404.html {
    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
    }
}

新建hk.v2fy.com对应的网站文件夹

mkdir -p /usr/share/nginx/html/hk.v2fy.com

新建文件

touch /usr/share/nginx/html/hk.v2fy.com/index.html

在/usr/share/nginx/html/hk.v2fy.com/index.html 中输入

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>V2方圆HK</title>
</head>
<body>
    Test
</body>
</html>

重启nginx

··· sudo systemctl restart nginx ···

访问测试

http://hk.v2fy.com/

hk.v2fy.com

下面开始添加https

安装 acme.sh

curl  https://get.acme.sh | sh -s email=zhaoolee@gmail.com
source ~/.bashrc

获取https证书

acme.sh --issue  -d hk.v2fy.com   --nginx

https证书生成的位置

在这一步acme.sh读取了nginx配置，并自动生成了证书

将证书拷贝到/etc/nginx/ssl文件夹

创建文件夹

mkdir -p /etc/nginx/ssl/hk.v2fy.com

拷贝证书

acme.sh --install-cert -d hk.v2fy.com \
--key-file       /etc/nginx/ssl/hk.v2fy.com/hk.v2fy.com.key  \
--fullchain-file  /etc/nginx/ssl/hk.v2fy.com/fullchain.cer \
--reloadcmd     "service nginx force-reload"

请一定使用以上语法acme.sh --install-cer进行拷贝，这样证书才能保证在新的位置也能自动更新。

证书拷贝成功

将 /etc/nginx/ssl/hk.v2fy.com/ 中的证书手动配置到 nginx, 并重启nginx生效

将/etc/nginx/conf.d/hk.v2fy.com.conf中的内容替换为

server {
    listen       80;
    listen       [::]:80;
    server_name  hk.v2fy.com;
    root         /usr/share/nginx/html/hk.v2fy.com;

    error_page 404 /404.html;
    location = /404.html {
    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
    }
}


server {
    listen       443 ssl http2;
    listen       [::]:443 ssl http2;
    server_name  hk.v2fy.com;
    root         /usr/share/nginx/html/hk.v2fy.com;

    ssl_certificate "/etc/nginx/ssl/hk.v2fy.com/fullchain.cer";
    ssl_certificate_key "/etc/nginx/ssl/hk.v2fy.com/hk.v2fy.com.key";
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # Load configuration files for the default server block.
    include /etc/nginx/default.d/*.conf;

    error_page 404 /404.html;
        location = /40x.html {
    }

    error_page 500 502 503 504 /50x.html;
        location = /50x.html {
    }
}

打开 https://hk.v2fy.com

证书已生效

证书获得

由于我们全程使用 acme.sh 进行安装，acme.sh会自动为你创建一个定时任务, 每天 0:00 点自动检测所有的证书, 如果快过期了, 需要更新, 则会自动更新证书.

自动创建f

运行ps aux | grep acme可以看到scme一直在后台运行

ps aux | grep acme

如何实现多个证书同步更新

如果你需要多个证书，比如给 api.v2fy.com 配置证书，重复本文步骤即可~

acme.sh --issue  -d api.v2fy.com   --nginx

新证书

创建文件夹

mkdir -p /etc/nginx/ssl/api.v2fy.com

拷贝证书

acme.sh --install-cert -d api.v2fy.com \
--key-file       /etc/nginx/ssl/api.v2fy.com/api.v2fy.com.key  \
--fullchain-file  /etc/nginx/ssl/api.v2fy.com/fullchain.cer \
--reloadcmd     "service nginx force-reload"

设置 /etc/nginx/conf.d/api.v2fy.com.conf

server {
    listen       80;
    listen       [::]:80;
    server_name  api.v2fy.com;
    root         /usr/share/nginx/html/api.v2fy.com;

    error_page 404 /404.html;
    location = /404.html {
    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
    }
}


server {
    listen       443 ssl http2;
    listen       [::]:443 ssl http2;
    server_name  api.v2fy.com;
    root         /usr/share/nginx/html/api.v2fy.com;

    ssl_certificate "/etc/nginx/ssl/api.v2fy.com/fullchain.cer";
    ssl_certificate_key "/etc/nginx/ssl/api.v2fy.com/api.v2fy.com.key";
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # Load configuration files for the default server block.
    include /etc/nginx/default.d/*.conf;

    error_page 404 /404.html;
        location = /40x.html {
    }

    error_page 500 502 503 504 /50x.html;
        location = /50x.html {
    }
}