Nginx配置使用Let’s Encrypt免费SSL证书

以前写过一篇在Apache环境下配置使用免费的SSL证书，本次将在Nginx

环境下使用SSL证书 https://www.qnjslm.com/ITHelp/580.html

本次还是使用certbot来管理证书，首先安装插件

注： 前提时已经安装号Nginx，并且服务器可以连接公网访问到Let's Encrypt的API

[root@mail ~]# yum install python2-certbot-nginx

使用插件生成证书

certbot --nginx

以上命令会自动修改nginx配置，比较傻瓜式的安装

如果不想让程序去修改nginx日志，可以执行下面的命令

certbot --nginx certonly

[root@mail ~]# certbot --nginx certonly

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator nginx, Installer nginx

Enter email address (used for urgent renewal and security notices) (Enter 'c' to

cancel): admin@qnjslm.com //指定证书联系人邮件地址

Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Please read the Terms of Service at

https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must

agree in order to register with the ACME server at

https://acme-v02.api.letsencrypt.org/directory

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(A)gree/(C)ancel: A //同意协议，你懂的

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Would you be willing to share your email address with the Electronic Frontier

Foundation, a founding partner of the Let's Encrypt project and the non-profit

organization that develops Certbot? We'd like to send you email about our work

encrypting the web, EFF news, campaigns, and ways to support digital freedom.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: Y //是否接收发生的广告，你懂的

Starting new HTTPS connection (1): supporters.eff.org

No names were found in your configuration files. Please enter in your domain

name(s) (comma and/or space separated) (Enter 'c' to cancel): mail.qnjslm.com //指定证书签注的名称，如果你的nginx已经配置了name，会自动读取到。

Obtaining a new certificate

Performing the following challenges:

http-01 challenge for mail.qnjslm.com

Using default address 80 for authentication.

Waiting for verification...

Cleaning up challenges

IMPORTANT NOTES:

- Congratulations! Your certificate and chain have been saved at:

/etc/letsencrypt/live/mail.qnjslm.com/fullchain.pem //证书文件

Your key file has been saved at:

/etc/letsencrypt/live/mail.qnjslm.com/privkey.pem //证书的密钥文件

Your cert will expire on 2019-02-17. To obtain a new or tweaked

version of this certificate in the future, simply run certbot

again. To non-interactively renew *all* of your certificates, run

"certbot renew"

- Your account credentials have been saved in your Certbot

configuration directory at /etc/letsencrypt. You should make a

secure backup of this folder now. This configuration directory will

also contain certificates and private keys obtained by Certbot so

making regular backups of this folder is ideal.

- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate

Donating to EFF: https://eff.org/donate-le

[root@mail ~]#

下面我们手工来配置Nginx

在server配置文件下添加如下配置

ssl_certificate /etc/letsencrypt/live/mail.qnjslm.com/fullchain.pem;

ssl_certificate_key /etc/letsencrypt/live/mail.qnjslm.com/privkey.pem;

重启nginx进行检查即可，

注意：

证书三个月有效期，我们需要在到期前去重新更新执行 certbot renew 即可

建议添加到计划任务里面执行