debian+apache+acme_tiny+lets-encrypt配置筆記

須要預先將須要申請ssl的域名指向到服務器，此方法徹底經過api實現，好處是綠色無污染，不須要註冊帳號，不會泄露私人信息
環境爲 debian7+apache

apt-get install apache2
a2enmod rewrite
a2enmod ssl
apt-get install php5 php-pear
vi /etc/apache2/sites-enabled/000-default
---------------------------000-default------------------------
Alias /.well-known/acme-challenge/ /var/www/challenges/
--------------------------------------------------------------
mkdir /var/www/challenges

mkdir /etc/apache2/ssl
cd /etc/apache2/ssl
openssl genrsa 4096 > account.key
openssl genrsa 4096 > domain.key
openssl req -new -sha256 -key domain.key -subj "/" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:domain.com,DNS:www.domain.com")) > domain.csr
wget https://raw.githubusercontent.com/diafygi/acme-tiny/master/acme_tiny.py
python acme_tiny.py --account-key ./account.key --csr ./domain.csr --acme-dir /var/www/challenges/ > ./signed.crt
wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem

--------------------------------------------------------------
a2ensite default-ssl
------------------default-ssl---------------------------------
SSLCertificateFile /etc/apache2/ssl/signed.crt
SSLCertificateKeyFile /etc/apache2/ssl/domain.key
SSLCertificateChainFile /etc/apache2/ssl/intermediate.pem
--------------------------------------------------------------



vi /etc/apache2/ssl/renew.sh
------------------------------renew.sh-------------------------
#!/bin/bash

cd /etc/apache2/ssl
python acme_tiny.py --account-key ./account.key --csr ./domain.csr --acme-dir /var/www/challenges/ > ./signed.crt || exit
wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem
/etc/init.d/apache2 reload

--------------------------------------------------------------

crontab -e

------------------crontab--------------------------------
0 0 1 * * /etc/apache2/ssl/renew.sh >/dev/null 2>&1
--------------------------------------------------------------

　　nginx設置

location /.well-known/acme-challenge/ {
        alias /var/www/challenges/

; }

cat signed.crt intermediate.pem > mysite.crt #合併證書


nginx配置
ssl_certificate /root/bin/nginx/conf/custom/cert/mysite.crt;
ssl_certificate_key /root/bin/nginx/conf/custom/cert/zorelworld.key;