如何獲得一個免費HTTPS證書？

摘要： 最受歡迎的免費HTTPS證書，瞭解一下？

HTTPS已成爲業界標準，這篇博客將教你申請Let's Encrypt的免費HTTPS證書。

本文的操做是在Ubuntu 16.04下進行，使用nginx做爲Web服務器。

1. 安裝Certbot

Certbot能夠用於管理(申請、更新、配置、撤銷和刪除等)Let's Encrypt證書。這裏安裝的是帶nginx插件的certbot：

sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository -y ppa:certbot/certbot
sudo apt-get update
sudo apt-get install -y python-certbot-nginx

2. 配置Nginx

vim /etc/nginx/conf.d/fundebug.conf

此時尚未HTTPS證書，所以域名只能使用80端口而非443端口，網站只能經過http協議而非https協議訪問：http://www.fundebug.com。

server
{
    listen 80;
    server_name www.fundebug.com;
}

重啓nginx:

systemctl restart nginx

3. 配置DNS

使域名www.fundebug.com指向nginx所在服務器的IP：

若是你想發現代碼中隱藏的BUG，歡迎免費試用最專業的BUG實時監控平臺Fundebug!

4. 申請證書

使用certbot命令爲www.fundebug.com申請HTTPS證書。--nginx選項表示Web服務器爲nginx，迅雷電影，-d選項指定域名，-n選項表示非交互式運行命令。若去除-n選項，則終端會提醒你選擇是否將http請求重定向爲https請求。

certbot --nginx -d www.fundebug.com -n

證書申請成功以後，會看到如下信息。Let's Encrypt證書的有效期只有3個月，可是Certbot會經過Cron和systemd timer自動更新證書，證書的時效性不用擔憂。

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/www.fundebug.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/www.fundebug.com/privkey.pem
   Your cert will expire on 2018-09-29. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

HTTPS證書相關的文件在/etc/letsencrypt/目錄中：

find /etc/letsencrypt/ -name "*www.fundebug.com*"
/etc/letsencrypt/renewal/www.fundebug.com.conf
/etc/letsencrypt/archive/www.fundebug.com
/etc/letsencrypt/live/www.fundebug.com

certbot會自動修改nginx配置文件：

cat /etc/nginx/conf.d/fundebug.conf

nginx監聽了443端口並配置了HTTPS證書，360排名查詢，這時咱們能夠經過HTTPS協議訪問了！https://www.fundebug.com

server
{
    listen 80;
    server_name www.fundebug.com;

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/www.fundebug.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/www.fundebug.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

 

參考

• Certbot文檔：Nginx on Ubuntu 16.04 (xenial)