使用certbot自动签发SSL证书(Lets Encrypt证书)
转载来自我的一位运维朋友的技术博客
我知道很多云上都有免费1年的SSL证书了，但是1年到了你还得手动去续期，域名多了那工作量就大了去了。我的环境是阿里云centos6,亲测centos7同样适用，一句命令即可！
Let's Encrypt 的最大贡献是它的 ACME 协议，第一份全自动服务器身份验证协议，以及配套的基础设施和客户端。
关于Let's Encrypt 上线的意义可以参考一下知乎
https://www.zhihu.com/question/36710815?sort=created
现在我们来使用certbot自动注册免费的SSL证书及基于ACME协议自动续期！
官网地址 https://certbot.eff.org/#centos6-nginx 可根据你的软件和系统版本 https://certbot.eff.org/docs/install.html#id10
wget https://dl.eff.org/certbot-auto chmod a+x certbot-auto
命令帮助
./certbot-auto --help all
一句话搞定SSL！前提是先解析并且找得到server_name
./certbot-auto --nginx certonly --nginx-server-root /usr/local/nginx/conf --nginx-ctl /usr/local/nginx/sbin/nginx -m "[email protected]" -n --agree-tos --domains www.jklot.com
certbot默认的nginx配置是/etc/nginx/,像我们平常都是放在/usr/local/nginx/需要自定义一下
如果卡在安装python packages 上
cat ~/.pip/pip.conf [global] index-url=http://mirrors.aliyun.com/pypi/simple/ [install] trusted-host=mirrors.aliyun.com
如果你没有加这些参数
-m "[email protected]" -n --agree-tos
那就需要手动应答了。。邮件你不要随便填啊，到时候快过期会给你一封邮件，还是很有用的
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel):
You must
agree in order to register with the ACME server 等等等。。。
最后，提示以下信息，则说明我们申请成功了。
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/www.jklot.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/www.jklot.com/privkey.pem
Your cert will expire on 2018-04-04. To obtain a new or tweaked
Nginx配置
server {
listen 80;
server_name www.jklot.com;
rewrite ^/(.*)$ https://www.jklot.com/$1 permanent;
}
server {
listen 443;
server_name www.jklot.com;
index index.html index.htm index.php;
root /data/web/www.jklot.com/;
ssl on;
ssl_certificate /etc/letsencrypt/live/www.jklot.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.jklot.com/privkey.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
ssl_prefer_server_ciphers on;最后可以测试一下证书的安全性
https://www.ssllabs.com/ssltest/index.html
管理证书
./certbot-auto certificates
注销证书
./certbot-auto revoke --cert-path /etc/letsencrypt/live/www.jklot.com/cert.pem Saving debug log to /var/log/letsencrypt/letsencrypt.log ------------------------------------------------------------------------------- Would you like to delete the cert(s) you just revoked? ------------------------------------------------------------------------------- (Y)es (recommended)/(N)o: Y ------------------------------------------------------------------------------- Deleted all files relating to certificate 1.jklot.com. ------------------------------------------------------------------------------- ------------------------------------------------------------------------------- Congratulations! You have successfully revoked the certificate that was located at /etc/letsencrypt/live/www.jklot.com/cert.pem
./certbot-auto delete --cert-name www.jklot.com
手动续期
./certbot-auto renew
自动续期
添加到crontab里面
00 0,12 * * * root /usr/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && cd /root ; ./certbot-auto renew --renew-hook "/usr/local/nginx/sbin/nginx -s reload"
上面是certbot官网的定时，我也不清楚为啥要在弄个随机的小时内执行renew...
那这样岂不是可以无限申请了吗？实际上是有限制的。https://letsencrypt.org/docs/rate-limits/
另外可以百度 Certbot命令行
如果你上面用不来，那使用在线申请Let's Encrypt 证书的网站吧 https://www.sslforfree.com
ps:碰到以下可以尝试改天看看，可能是网络问题-。-
OSError: [Errno 97] Address family not supported by protocol
During handling of the above exception, another exception occurred
urllib.error.URLError: <urlopen error [Errno 97] Address family not supported by protocol>
另外
Could not find a version that satisfies the requirement certifi==2019.3.9 (from -r /tmp/tmp.JxrK6eMCti/letsencrypt-auto-requirements.txt (line 12)) (from versions: 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 1.0.0, 1.0.1, 14.5.14, 2015.4.28, 2015.9.6, 2015.9.6.1, 2015.9.6.2, 2015.11.20, 2015.11.20.1, 2016.2.28, 2016.8.2, 2016.8.8, 2016.8.31, 2016.9.26, 2017.1.23, 2017.4.17, 2017.7.27, 2017.7.27.1, 2017.11.5, 2018.1.18, 2018.4.16, 2018.8.13, 2018.8.24, 2018.10.15, 2018.11.29)
No matching distribution found for certifi==2019.3.9 (from -r /tmp/tmp.JxrK6eMCti/letsencrypt-auto-requirements.txt (line 12))
把rm -f /root/.pip/pip.conf 删掉就好了
