Nginx配置使用Let’s Encrypt免费SSL证书

alex 默认1 阅读模式

以前写过一篇在Apache环境下配置使用免费的SSL证书,本次将在Nginx

环境下使用SSL证书 https://www.qnjslm.com/ITHelp/580.html

 
 

本次还是使用certbot来管理证书,首先安装插件

 
 

注: 前提时已经安装号Nginx,并且服务器可以连接公网访问到Let's Encrypt的API

 
 

[root@mail ~]# yum install python2-certbot-nginx

 
 

使用插件生成证书

 
 

certbot --nginx

以上命令会自动修改nginx配置,比较傻瓜式的安装

 
 

如果不想让程序去修改nginx日志,可以执行下面的命令

certbot --nginx certonly

 
 

[root@mail ~]# certbot --nginx certonly

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator nginx, Installer nginx

Enter email address (used for urgent renewal and security notices) (Enter 'c' to

cancel): admin@qnjslm.com //指定证书联系人邮件地址

Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org

 
 

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Please read the Terms of Service at

https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must

agree in order to register with the ACME server at

https://acme-v02.api.letsencrypt.org/directory

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(A)gree/(C)ancel: A //同意协议,你懂的

 
 

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Would you be willing to share your email address with the Electronic Frontier

Foundation, a founding partner of the Let's Encrypt project and the non-profit

organization that develops Certbot? We'd like to send you email about our work

encrypting the web, EFF news, campaigns, and ways to support digital freedom.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: Y //是否接收发生的广告,你懂的

Starting new HTTPS connection (1): supporters.eff.org

No names were found in your configuration files. Please enter in your domain

name(s) (comma and/or space separated) (Enter 'c' to cancel): mail.qnjslm.com //指定证书签注的名称,如果你的nginx已经配置了name,会自动读取到。

Obtaining a new certificate

Performing the following challenges:

http-01 challenge for mail.qnjslm.com

Using default address 80 for authentication.

Waiting for verification...

Cleaning up challenges

 
 

IMPORTANT NOTES:

- Congratulations! Your certificate and chain have been saved at:

/etc/letsencrypt/live/mail.qnjslm.com/fullchain.pem //证书文件

Your key file has been saved at:

/etc/letsencrypt/live/mail.qnjslm.com/privkey.pem //证书的密钥文件

Your cert will expire on 2019-02-17. To obtain a new or tweaked

version of this certificate in the future, simply run certbot

again. To non-interactively renew *all* of your certificates, run

"certbot renew"

- Your account credentials have been saved in your Certbot

configuration directory at /etc/letsencrypt. You should make a

secure backup of this folder now. This configuration directory will

also contain certificates and private keys obtained by Certbot so

making regular backups of this folder is ideal.

- If you like Certbot, please consider supporting our work by:

 
 

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate

Donating to EFF: https://eff.org/donate-le

 
 

[root@mail ~]#

 
 

下面我们手工来配置Nginx

在server配置文件下添加如下配置

 
 

ssl_certificate /etc/letsencrypt/live/mail.qnjslm.com/fullchain.pem;

ssl_certificate_key /etc/letsencrypt/live/mail.qnjslm.com/privkey.pem;

 
 

 
 

重启nginx进行检查即可,

 
 

注意:

证书三个月有效期,我们需要在到期前去重新更新执行 certbot renew 即可

建议添加到计划任务里面执行

 
 

 
 

 
 

 
 

 
 

 
 

文章末尾固定信息

 
alex
  • 本文由 alex 发表于 2018年11月19日 15:06:02
  • 转载请务必保留本文链接:https://www.qnjslm.com/ITHelp/929.html
    • 红薯
      红薯 0

      nginx -s reload
      热加载体验会好些。

    匿名

    发表评论

    匿名网友
    :?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:
    确定