Let's encrypt申請泛域名證書

一、下載工具

wget https://dl.eff.org/certbot-auto

chmod a+x ./certbot-auto

 

二、初始化

./certbot-auto

 

三、獲取證書（1）

./certbot-auto certonly --manual -d *.mydomain.com --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory

將*.mydomain.com換成你的域名。

注意：mydomain.com域名必須爲你本身全部，且你能操做跟它相關的DNS記錄。同時，執行certbot-auto命令的服務器必須就是mydomain.com所對應的服務器。

 

當咱們看到相似如下信息時，就須要停一會：

-------------------------------------------------------------------------------
Please deploy a DNS TXT record under the name
_acme-challenge.mydomain.com with the following value:

xfnee7V1DS2ZlOLllasdkv-HltYfsdfahrradfU47xxs

Before continuing, verify the record is deployed.
-------------------------------------------------------------------------------
Press Enter to Continue

 

四、配置DNS記錄

根據第3步的信息，登陸咱們的DNS控制檯，添加TXT記錄：

TXT　　_acme-challenge.mydomain.com　　xfnee7V1DS2ZlOLllasdkv-HltYfsdfahrradfU47xxs

 

五、獲取證書（2）

等DNS信息生效後，就繼續獲取證書（1）的步驟，按下回車，系統會自動開始認證。

等待一會，若是出現如下信息，則說明證書生成成功。

IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/mydomain.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/mydomain.com/privkey.pem
Your cert will expire on 2019-01-12. To obtain a new or tweaked
version of this certificate in the future, simply run certbot-auto
again. To non-interactively renew *all* of your certificates, run
"certbot-auto renew"
- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

 

六、使用證書

/etc/letsencrypt/live/mydomain.com/fullchain.pem

/etc/letsencrypt/live/mydomain.com/privkey.pem

 

複製這倆文件到正確的位置，好比nginx的配置目錄下，而後修改nginx配置文件：

server {

    listen 443 ssl;

    server_name www.mydomain.com;

    server_name img.mydomain.com;  // 這行不要加，這裏是爲了說明泛域名能夠做用於全部二級域名。

    ssl_certificate  /etc/letsencrypt/live/example.com/fullchain.pem;

    ssl_certificate_key  /etc/letsencrypt/live/example.com/privkey.pem;

    location / {

        root html;

    }

}

 

七、更新證書

// 更新即將到期的證書

./certbot-auto renew

 

// 強制更新一個證書（這個證書也許還有好久纔到期）

./certbot-auto renew --force-renewal

 

將更新命令加入定時任務，讓它自動更新。（如何判斷快到90天了）