Ssl证书自动续签

openssl genrsa -out ca.key 4096

openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=IT/OU=Docker/CN=domain.com" \
 -key ca.key \
 -out ca.crt

openssl genrsa -out domain.com.key 4096

openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=IT/OU=Docker/CN=domain.com" \
    -key domain.com.key \
    -out domain.com.csr

cat > v3.ext <<- 'EOF'
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=127.0.0.1
DNS.2=domain.com
DNS.3=localhost
EOF

openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in domain.com.csr \
    -out domain.com.crt

# 直接下载
curl https://get.acme.sh | sh
# clone 仓库
git clone https://github.com/acmesh-official/acme.sh.git
alias acme.sh=~/.acme.sh/acme.sh

# 使用http方式
acme.sh --issue -d plyx.site -d *.plyx.site -w /var/www/html/plyx.site
# 使用dns 方式
acme.sh --issue -d *.plyx.site -d plyx.site --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please # 添加A记录
dig -t txt  _acme-challenge.clsn.io @8.8.8.8 # 验证证书
acme.sh --renew  -d *.plyx.site -d plyx.site --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please # 生成证书
# 使用dns api方式
api 参考文档 https://github.com/Neilpang/acme.sh/tree/master/dnsapi
export Ali_Key=""
export Ali_Secret=""
acme.sh --issue --dns dns_ali -d plyx.site -d *.plyx.site
acme.sh --issue --dns dns_ali -d plyx.site -d *.plyx.site --keylength ec-256

# 查看证书
acme.sh --list
# 删除证书
acme.sh --remove -d plyx.site [--ecc]

acme.sh  --install-cert -d 01member.com \
         --key-file /etc/nginx/conf.d/ssl/key.pem \
         --fullchain-file /etc/nginx/conf.d/ssl/cert.pem \
         --reloadcmd "service nginx force-reload"

cat fullchain.cer plyx.site.key > haproxy.crt

acme.sh --renew -d plyx.site --force
acme.sh --renew -d plyx.site --force --ecc

echo |openssl s_client -servername plyx.site  -connect plyx.site:443 2>/dev/null | openssl x509 -noout -dates|awk -F '=' '/notAfter/{print $2}'

openssl x509 -in cert.pem -noout -dates

acme.sh --upgrade

# 开启自动更新
acme.sh  --upgrade  --auto-upgrade
# 关闭自动更新
acme.sh  --upgrade  --auto-upgrade 0

55 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null