通过Let's Encrypt配置SSL通配符证书

2018-06-14

具体配置过程

安装 Certbot

  • 安装 Certbot，官网提供了简单详细的教程：certbot

比如我是 Nginx 和 Ubuntu16.04

1
2
3
4
5
$ sudo apt-get update
$ sudo apt-get install software-properties-common
$ sudo add-apt-repository ppa:certbot/certbot
$ sudo apt-get update
$ sudo apt-get install python-certbot-nginx

安装完成

1
$ certbot --version

certbot 0.22.2

申请证书

申请证书

1
$ sudo certbot certonly  -d "*.time0x.com" --manual --preferred-challenges dns-01  --server https://acme-v02.api.letsencrypt.org/directory

提示：先不要按回车，去配置解析，并且检查是否解析成功

1
2
3
4
5
6
7
8
9
-------------------------------------------------------------------------------
Please deploy a DNS TXT record under the name
_acme-challenge.time0x.com with the following value:

N3mxDaoHs6j_xybQf2FImy3oALBKbjq1xbKi0rWbhxY

Before continuing, verify the record is deployed.
-------------------------------------------------------------------------------
Press Enter to Continue

添加解析

在服务商域名解析处添加一条 TXT 记录

检查解析

检查是否配置成功

1
dig  -t txt _acme-challenge.time0x.com @8.8.8.8

按回车

1
2
3
4
5
6
7
8
9
10
11
12
13
IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/time0x.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/time0x.com/privkey.pem
   Your cert will expire on 2018-09-13. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

配置对应的 nginx 配置文件

根据申请证书成功后 IMPORTANT NOTES: 所显示的
证书文件：/etc/letsencrypt/live/example.com/fullchain.pem 和
密钥文件：/etc/letsencrypt/live/example.com/privkey.pem
来配置对应的 nginx 配置文件。
请注意，虽然是通配符证书，但是证书文件目录中不是 *.example.com，而是 example.com。

1
2
3
4
5
6
7
8
listen 443 http2 ssl;
ssl_certificate /etc/letsencrypt/live/time0x.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/time0x.com/privkey.pem;
ssl_trusted_certificate  /etc/letsencrypt/live/time0x.com/chain.pem;

if ($scheme != "https") {
    return 301 https://$host$request_uri;
}

证书续期

Let’s encrypt 的免费证书默认有效期为 90 天，到期后再执行一边以上步骤，或者 提供authentication script 需要域名服务商提供操作 DNS 的 API。

Let’s encrypt 官网链接