ubuntu+let's encrypt生成永久免费https证书 ubuntu+tomcat+nginx+let's encrypt

时间 2019-11-20

标签 ubuntu+let's ubuntu let encrypt 生成永久免费 https 证书 ubuntu+tomcat+nginx+let's tomcat nginx 栏目 Ubuntu 繁體版

原文原文链接

1. 下载let's encryptpython

$ sudo add-apt-repository ppa:certbot/certbot
$ sudo apt-get update
$ sudo apt-get install certbot

2. 生成密钥，调用以前须要中止nginxlinux

certbot certonly --standalone -d www.域名1.com -d www.域名2.com

　　生成成功，提示以下nginx

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/【这里是你的域名文件夹路径】/fullchain.pem. Your cert will
   expire on 【这里是到期时间】. To obtain a new or tweaked version of this
   certificate in the future, simply run certbot-auto again. To
   non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:
 
   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

3. 配置nginxbash

server{
	client_max_body_size     50m;
	server_name  【这里是你的域名】;
	listen 443 ssl;
	ssl_certificate /etc/letsencrypt/live/【这里是你的域名证书文件夹名】/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/【这里是你的域名证书文件夹名】/privkey.pem;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_prefer_server_ciphers on;
	ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;
	listen [::]:443 ssl ipv6only=on;
	
	location ^~  /xxx {
                proxy_connect_timeout 500s;
                proxy_read_timeout 500s;
                proxy_send_timeout 500s;
                proxy_pass   http://127.0.0.1:8080/xxx/;
                proxy_set_header  Host            $host;
                proxy_set_header  X-Real-IP        $remote_addr;
                proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
        }
}

4. 重启nginxide

nginx -s reload

5. 重定向http访问到httpsui

server {
        listen 80;
        server_name 【这里是你的域名】;
        rewrite ^(.*) https://$server_name$1 permanent;
}

6.强制刷新续约this

#先中止nginx
一、service nginx stop

#强制刷新证书续约、由于此证书只有90天有效期，须要在到期前执行续约
二、certbot renew --force-renew
#出现提示中包含这句，就说明已经成功了  Congratulations, all renewals succeeded. The following certs have been renewed:

#启动nginx
三、service nginx start

也能够一步到位执行：spa

certbot renew --quiet --renew-hook "/etc/init.d/nginx reload"：不打印日志，日志查看/var/log/letsencrypt/letsencrypt.logrest

certbot renew --renew-hook "/etc/init.d/nginx reload" ：控制台打印日志日志

七、自动续约、能够利用linux自带的cron来定时执行刷新脚本，这样这个证书就是永久有效的了

crontab -e #编辑crontab列表  

#天天的23点59分执行
59 23 * * * certbot renew --quiet --renew-hook "/etc/init.d/nginx reload"

crontab -l #查看crontab列表   

service cron restart #重启定时任务，让任务生效