安装
# yum install -y epel-release nginx git（未安装的安装下）
git clone https://github.com/letsencrypt/letsencrypt
cd letsencrypt
./letsencrypt-auto --help
获取 SSL 证书
证书申请频率限制
- IP 限制：每注册 IP 每 3 个小时不超过 10 次
- 域名数量限制：每个域名（包含子域名）每 7 天不超过 5 个
webroot 模式
这种方式生成的证书可以给多个二级域名使用，这种方式需要验证443端口，如果端口被占用会失败，如果提示congratulations，则表示成功
./letsencrypt-auto certonly --webroot --webroot-path /usr/share/nginx/html -d yourDomain --agree-tos --email your@email.com
certonly 模式
唯一需要注意的就是，certonly 模式下获取证书需要先关闭 nginx
service nginx stop
./letsencrypt-auto certonly --standalone -d yourDomain
获取成功后，会输出类似如下内容：
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for cjli.info
Waiting for verification...
Cleaning up challenges
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/yourDomain/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/yourDomain/privkey.pem
Your cert will expire on 2018-07-30. To obtain a new or tweaked
version of this certificate in the future, simply run
letsencrypt-auto again. To non-interactively renew *all* of your
certificates, run "letsencrypt-auto renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
注意：上面成功提示信息中的证书和私钥文件的路径，用于接下来 nginx 的配置
生成 dhparam
为了进一步提高安全性，建议为 nginx 再生成 2048 位 DH parameters：
openssl dhparam -out /etc/ssl/certs/dhparams.pem 2048
关于 DH Parameters 的解释，可以参考：What’s the purpose of DH Parameters?。
nginx 部署 ssl 证书
# HTTPS server
server {
listen 80;
listen 443 ssl;
server_name yourDomain;
root html;
index index.html index.htm;
ssl_certificate /etc/letsencrypt/live/yourDomain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourDomain/privkey.pem;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
location /backend{
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://localhost:8090/backend;
}
# backend
location /server {
try_files $uri $uri/ /server/index.html;
}
location /image/{
root /opt/nginx/html/;
autoindex on;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
}
如配置htttps后访问不了，需要到服务提供商添加安全组，如阿里云-网络与安全-安全组，如还有问题可能跟防火墙有关，具体自行查阅资料
证书续期
由于 Let’s Encrypt 颁发的服务器证书有效期只有 90 天，因此如果需要长期使用，就有必要设置好自动续期。
通过 letsencrypt-auto 工具，手动续期命令为：
./letsencrypt-auto renew
而所谓的自动续期，就是自动定时执行上面手动获得证书的操作，对于 Linux 来说，可以使用 crontab。
echo '@monthly root /path/to/letsencrypt-auto certonly --webroot --webroot-path /usr/share/nginx/html -d yourDomain --agree-tos --email your@email.com >> /var/log/letsencrypt/letsencrypt-auto-update.log' | tee --append /etc/crontab
