因為 Google Chrome 自 2018/05/01 對於沒有合法的 SSL 網站憑證, 就會出現警告, 所以就出現要買 SSL 網站憑證的議題, 針對個人網站或是非正式的公司網站, 採用 Let's Encrypt 免費網站 SSL 憑證似乎是個不錯的選擇.
: Congratulations! You have successfully enabled https://www.ichiayi.com You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=www.ichiayi.com :
certbot-auto --nginx certonly
: ## ## SSL Virtual Host Context ## #<VirtualHost _default_:443> #: #: #</VirtualHost>
: : <VirtualHost *:80> ServerName www.ichiayi.com ServerAdmin [email protected] DocumentRoot /var/www/www.ichiayi.com_html CustomLog logs/www.ichiayi.com-access_log common ErrorLog logs/www.ichiayi.com-error_log Redirect permanent / https://www.ichiayi.com/ </VirtualHost> :
server { server_name www.ichiayi.com; access_log /var/log/nginx/www.ichiayi.com.access.log main; error_log /var/log/nginx/www.ichiayi.com.error.log; location / { : : } listen 443 ssl; # managed by Certbot ssl_certificate /etc/letsencrypt/live/www.ichiayi.com/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/www.ichiayi.com/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot } server { if ($host = www.ichiayi.com) { return 301 https://$host$request_uri; } # managed by Certbot listen 80; server_name www.ichiayi.com; return 404; # managed by Certbot }
vi /etc/crontab
: # let's encrypt 0 */8 * * * root python -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot renew > /tmp/cert-bot_renew.log
service crond restart
/root/lets-encrypt/certbot-auto -d ichiayi.com -d *.ichiayi.com --manual --preferred-challenges dns certonly --server https://acme-v02.api.letsencrypt.org/directory
Please deploy a DNS TXT record under the name _acme-challenge.ichiayi.com with the following value: 0sGmQQTfit9lW3okOa4jaYmefNQS4FsF6zZgEtyppKw Before continuing, verify the record is deployed. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Press Enter to Continue - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please deploy a DNS TXT record under the name _acme-challenge.ichiayi.com with the following value: fEsd-DYrN-AB_XVWb-Aa9Yx9OxCofBlFkxNmt7RWiCk Before continuing, verify the record is deployed.
: ; $TTL 86400 ; 1 day -- ; 3 hours $ORIGIN ichiayi.com. @ IN SOA ns1 server ( 2018123100 ; serial 28800 ; refresh (2 hours) 14400 ; retry (15 minutes) 720000 ; expire (1 week) 86400 ; minimum (12 hours) ) NS ns4.everplast.net. NS ns7.ichiayi.com. ; ; lets-encrypt SSL Cert _acme-challenge IN TXT "0sGmQQTfit9lW3okOa4jaYmefNQS4FsF6zZgEtyppKw" _acme-challenge IN TXT "fEsd-DYrN-AB_XVWb-Aa9Yx9OxCofBlFkxNmt7RWiCk" ; :
C:\Users\jonathan>nslookup 預設伺服器: UnKnown Address: 192.168.1.5 > server 8.8.8.8 預設伺服器: google-public-dns-a.google.com Address: 8.8.8.8 > _acme-challenge.ichiayi.com 伺服器: google-public-dns-a.google.com Address: 8.8.8.8 名稱: _acme-challenge.ichiayi.com > set type=txt > _acme-challenge.ichiayi.com 伺服器: google-public-dns-a.google.com Address: 8.8.8.8 未經授權的回答: _acme-challenge.ichiayi.com text = "fEsd-DYrN-AB_XVWb-Aa9Yx9OxCofBlFkxNmt7RWiCk" _acme-challenge.ichiayi.com text = "0sGmQQTfit9lW3okOa4jaYmefNQS4FsF6zZgEtyppKw"
: Waiting for verification... Cleaning up challenges IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/ichiayi.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/ichiayi.com/privkey.pem Your cert will expire on 2019-03-31. To obtain a new or tweaked version of this certificate in the future, simply run certbot-auto again. To non-interactively renew *all* of your certificates, run "certbot-auto renew" - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal. - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
apt install python3-certbot-dns-cloudflare
mkdir -p /root/lets-encrypt/
Exp:
# Cloudflare API credentials used by Certbot dns_cloudflare_email = [email protected] dns_cloudflare_api_key = 0123456789abcdef0123456789abcdef01234567
chmod 600 /root/lets-encrypt/cloudflare.ini
/usr/bin/certbot certonly \ --dns-cloudflare \ --dns-cloudflare-credentials /root/lets-encrypt/cloudflare.ini \ --dns-cloudflare-propagation-seconds 10 \ -d example.com
/usr/bin/certbot renew \ --dns-cloudflare \ --dns-cloudflare-credentials /root/lets-encrypt/cloudflare.ini \ --dns-cloudflare-propagation-seconds 10
vi /root/lets-encrypt/renewcert.sh
/usr/bin/certbot renew \ --dns-cloudflare \ --dns-cloudflare-credentials /root/lets-encrypt/cloudflare.ini \ --dns-cloudflare-propagation-seconds 10
chmod a+x /root/lets-encrypt/renewcert.sh
vi /etc/crontab
: # let's encrypt 35 2 * * * root /root/lets-encrypt/renewcert.sh > /tmp/renewcert.log
systemctl restart crond