添加安装源

sudo add-apt-repository ppa:certbot/certbot

更新apt安装源

sudo apt-get update

安装

sudo apt-get install python-certbot-apache

安装letsencrypt并生成证书

安装 letsencrypt

sudo apt-get install letsencrypt

生成证书

letsencrypt certonly --agree-tos --email xxx@qq.com -d xxx.xxx.com(域名需要解析到服务器要能 ping 通)

安装过程可能出现的提示信息

• 你是希望如何使用ACME CA进行身份验证？
  How would you like to authenticate with the ACME CA?

  
  

  

  
  

  我这是 nginx 选的 2 如果没有选择第三个

• 成功提示

  
  

  

• 如果提示

  
  

  

  
  

  原因是 nginx 或者是 apache 占用 80 端口，先关闭掉，然后重新执行

• 会在 /etc/letsencrypt/live/ 目录下成一个上面 <生成证书> 步骤中填写的域名文件夹里面包含证书信息

  
  

  

nginx 配置 https 访问

• ssl 配置

    server {
        listen 443 ssl;
        server_name xxx.xxx.com;    # 域名
        ssl_certificate /etc/letsencrypt/live/unicallcenter.botongweb.com/fullchain.pem;
        ssl_certificate_key  /etc/letsencrypt/live/unicallcenter.botongweb.com/privkey.pem;
        ssl_trusted_certificate /etc/letsencrypt/live/unicallcenter.botongweb.com/chain.pem;
        ssl_protocols   TLSv1 TLSv1.1 TLSv1.2;

        location / {
            root '/root/data/www';       # 静态页面存放路径
            index index.html;
            try_files $uri $uri/ /index.html;
        }
        error_page  405 =200 $uri;
    }

upstream gateway {
    server xx.xx.xx.xx:9099;  # 服务的地址
}

server {
    listen 443 ssl;
    server_name xx.xx.xx.com;    # 域名
 
    ssl_certificate /etc/letsencrypt/live/api.uincall.botongweb.com/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/api.uincall.botongweb.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/api.uincall.botongweb.com/chain.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto $scheme;
 
    location / {
        proxy_pass http://gateway;  # 上面代理的服务地址
    }
}
 
server {
    listen 80;
    server_name xx.xx.xx.com;    # 域名
    return 301 https://$host$request_uri;
}

手动续约

sudo certbot renew --dry-run

定时续约证书

crontab -e

每天夜里凌晨 2 点续签

• 2 * * * service nginx stop & letsencrypt renew & service nginx start

启动，关闭 定时任务

启动

/etc/init.d/cron start

查看启动状态

/etc/init.d/cron status

重启服务

/etc/init.d/cron restart

重新加载文件

/etc/init.d/cron reload