通过acme.sh开源工具申请泛解析SSL证书

# yum install socat -y
​
# curl https://get.acme.sh | sh
# curl https://get.acme.sh | sh -s email=my@example.com(zerossl.com注册的邮箱账号，在浏览器登录ZeroSSL之后可以看到证书)
​
# 或者
# wget -O- https://get.acme.sh | sh

alias acme.sh=~/.acme.sh/acme.sh
echo 'alias acme.sh=~/.acme.sh/acme.sh' >>/etc/profile

acme.sh --help     #获取帮助
acme.sh --version  # 查看版本
​

acme.sh --set-default-ca --server zerossl

ssl.xgss.net A记录解析到 150.158.130.33
只解析上面一条即可，因为只是为 ssl.xgss.net 申请证书，后面的解析是为了实验能否申请到多*.xgss.net的证书
xgss.net A记录解析到 150.158.130.33
*.xgss.net A记录解析到 150.158.130.33

# mkdir -p /data/wwwroot/web/ssl.xgss.net/
# echo 'hello SSL'> /data/wwwroot/web/ssl.xgss.net/index.html
配置nginx站点
server {
  listen       80;
  access_log /dev/null;
  error_log /dev/null;
  server_name  ssl.xgss.net xgss.net;
  root /data/wwwroot/web/ssl.xgss.net/;
  location / {
                index  index.html index.htm index.php;
        }
}

# curl http://ssl.xgss.net/
hello SSL

acme.sh  --issue  -d mydomain.com -d www.mydomain.com  --webroot  /home/wwwroot/mydomain.com/

acme.sh --issue  -d mydomain.com   --nginx

acme.sh  --issue -d mydomain.com   --standalone

# /root/.acme.sh/acme.sh --register-account -m XXXX@163.com
[Mon Jun 27 13:37:27 CST 2022] No EAB credentials found for ZeroSSL, let's get one
[Mon Jun 27 13:37:30 CST 2022] Registering account: https://acme.zerossl.com/v2/DV90
[Mon Jun 27 13:37:38 CST 2022] Registered
[Mon Jun 27 13:37:38 CST 2022] ACCOUNT_THUMBPRINT='*********************'

mkdir -p /data/wwwroot/web/ssl

# /root/.acme.sh/acme.sh  --issue -d ssl.xgss.net  --webroot  /data/wwwroot/web/ssl.xgss.net/ \
--keypath       /data/wwwroot/web/ssl/ssl.xgss.net.key  \
--fullchainpath /data/wwwroot/web/ssl/ssl.xgss.net.key.pem \
--reloadcmd "/usr/local/openresty/nginx/sbin/nginx -s reload"

openssl dhparam -out /data/wwwroot/web/ssl/dhparam.pem     2048         

  server {
        listen 443 ssl;
        access_log /dev/null;
        error_log /dev/null;
        server_name  ssl.xgss.net;
        root /data/wwwroot/web/ssl.xgss.net/ ;
        
        ssl_certificate     /data/wwwroot/web/ssl/ssl.xgss.net.key.pem;
        ssl_certificate_key /data/wwwroot/web/ssl/ssl.xgss.net.key;
​
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_dhparam /data/wwwroot/web/ssl/dhparam.pem;
        
        location / {
            index  index.html index.htm index.php;
        }
     }

acme.sh  --issue  --dns   -d mydomain.com \
 --yes-I-know-dns-manual-mode-enough-go-ahead-please

acme.sh  --renew   -d mydomain.com \
  --yes-I-know-dns-manual-mode-enough-go-ahead-please

# DNSPod
export DP_Id="你的 API ID"
export DP_Key="你的 Token"
​
# aliyun
export Ali_Key="你的 AccessKey ID"
export Ali_Secret="你的 AccessKey Secret"

acme.sh --issue -d example.com -d *.example.com --dns dns_dp

acme.sh --issue  -d example.com -d *.example.com --dns dns_ali

acme.sh --issue  -d xgss.net -d *.xgss.net --dns dns_ali \
--keypath       /data/wwwroot/web/ssl/all.xgss.net.key  \
--fullchainpath /data/wwwroot/web/ssl/all.xgss.net.key.pem \
--reloadcmd "/usr/local/openresty/nginx/sbin/nginx -s reload"
​
openssl dhparam -out /data/wwwroot/web/ssl/dhparam.pem     2048      
​
# ll /data/wwwroot/web/ssl
total 16
-rw------- 1 root root 1679 Jun 27 19:02 all.xgss.net.key
-rw-r--r-- 1 root root 6684 Jun 27 19:02 all.xgss.net.key.pem
-rw-r--r-- 1 root root  424 Jun 27 19:03 dhparam.pem

# curl https://ssl2.xgss.net/
hello SSL
[root@shanghai-node02 ssl]# curl https://ssl3.xgss.net/
hello SSL
[root@shanghai-node02 ssl]# curl https://ssl4.xgss.net/
hello SSL

00 00 * * * root /root/.acme.sh/acme.sh --cron --home /root/.acme.sh &>/var/log/acme.sh.logs

acme.sh --info -d xgss.net

crontab  -l
​
56 * * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

acme.sh --upgrade

acme.sh  --upgrade  --auto-upgrade

acme.sh --upgrade  --auto-upgrade  0