一传泊、前戲
在文章《利用微信小程序和Kubernetes打造簡(jiǎn)易私有云（一尔许、開(kāi)篇）》中购桑，本人計(jì)劃用微信小程序作為K8S私有云的前端膀斋。由于之前對(duì)微信小程序也不了解茵典，就不得不走一遍流程來(lái)學(xué)習(xí)實(shí)踐，才發(fā)現(xiàn)搭一個(gè)微信小程序遠(yuǎn)沒(méi)有想象的那么容易啊医窿。
如果你要搭建微信小程序的后端服務(wù)，首先炊林，你的服務(wù)器必須有個(gè)域名姥卢，而且域名還必須要備案。另外，小程序和服務(wù)器之間是通過(guò)https交流独榴，你還得申請(qǐng)SSL證書(shū)僧叉，如官方文檔提到如下：
每個(gè)微信小程序需要事先設(shè)置一個(gè)通訊域名，小程序可以跟指定的域名與進(jìn)行網(wǎng)絡(luò)通信棺榔。包括普通 HTTPS 請(qǐng)求（request）瓶堕、上傳文件（uploadFile）、下載文件（downloadFile) 和 WebSocket 通信（connectSocket）
小程序必須使用 HTTPS 請(qǐng)求症歇。小程序內(nèi)會(huì)對(duì)服務(wù)器域名使用的 HTTPS 證書(shū)進(jìn)行校驗(yàn)郎笆，如果校驗(yàn)失敗，則請(qǐng)求不能成功發(fā)起忘晤。由于系統(tǒng)限制宛蚓，不同平臺(tái)對(duì)于證書(shū)要求的嚴(yán)格程度不同。為了保證小程序的兼容性设塔，建議開(kāi)發(fā)者按照最高標(biāo)準(zhǔn)進(jìn)行證書(shū)配置凄吏，并使用相關(guān)工具檢查現(xiàn)有證書(shū)是否符合要求。
所以闰蛔，開(kāi)發(fā)小程序我們得先把基礎(chǔ)環(huán)境搭好痕钢，本篇文章主要就是討論如何給自己的服務(wù)器申請(qǐng)SSL證書(shū)。當(dāng)然序六，你得提前有個(gè)服務(wù)器盖喷，而且有個(gè)域名。本人使用的是阿里云ECS难咕。
本文可以算是《利用微信小程序和Kubernetes打造簡(jiǎn)易私有云》系列的前傳课梳，歡迎看官不吝賜教，走你~
二余佃、高潮
簡(jiǎn)介
了解SSL證書(shū)的都知道暮刃，絕大部分都是收費(fèi)的，而且還很貴爆土。之前阿里云有段時(shí)間可以申請(qǐng)免費(fèi)的證書(shū)椭懊，但現(xiàn)在木有了，只提供收費(fèi)的步势，價(jià)格也貴的離譜（反正我沒(méi)錢）：
若仔細(xì)挖掘氧猬，其實(shí)也可發(fā)現(xiàn)很多免費(fèi)的SSL證書(shū)申請(qǐng)服務(wù)，適合個(gè)人開(kāi)發(fā)使用坏瘩。但我個(gè)人不推薦使用國(guó)內(nèi)的免費(fèi)SSL證書(shū)盅抚，總感覺(jué)不靠譜。這里倔矾，我強(qiáng)烈推薦——Let's Encrypt 妄均，大家可以自行谷歌柱锹，這是一個(gè)很受歡迎并永久免費(fèi)的SSL項(xiàng)目，而且到期后可以免費(fèi)續(xù)簽(有效期90天)丰包，非常方便禁熏，請(qǐng)戳官網(wǎng)。
安裝
本人使用阿里云的CentOS 7親自嘗試安裝邑彪，發(fā)現(xiàn)官方推薦的安裝方式不太靠譜瞧毙，會(huì)出現(xiàn)各種python相關(guān)的依賴問(wèn)題。這里寄症，我們直接使用官方另一種安裝方式宙彪，親測(cè)可行。
1.下載certbot-auto
執(zhí)行：
user@webserver:~$ wget https://dl.eff.org/certbot-auto
user@webserver:~$ chmod a+x ./certbot-auto
這里瘸爽，我們無(wú)需關(guān)心Certbot是什么您访，只需要知道，證書(shū)的申請(qǐng)和生成是通過(guò)Certbot完成的剪决，而certbot-auto腳本封裝了Certbot灵汪。
2.申請(qǐng)證書(shū)
執(zhí)行：
./certbot-auto certonly --standalone --email abc@163.com -d ainizhi.xin
如上，certbot-auto命令會(huì)自動(dòng)下載Certbot所需的依賴柑潦，并且為ainizhi.xin域名申請(qǐng)并生成證書(shū)享言。請(qǐng)更換--email和 -d后的參數(shù)，分別表示自己郵箱和域名渗鬼。
另外览露，證書(shū)90后就會(huì)到期，到時(shí)我們只需要使用certbot-auto renew命令免費(fèi)續(xù)簽即可（建議配合使用linux的crontab機(jī)制）譬胎，可參考官方文檔差牛。
3.證書(shū)位置
生成后的證書(shū)位置如下：
[root@iz2ze2tzqe1llll9ow0vxoz ~]# ll /etc/letsencrypt/live/ainizhi.xin/
total 4
lrwxrwxrwx 1 root root 35 May 9 09:12 cert.pem -> ../../archive/ainizhi.xin/cert1.pem
lrwxrwxrwx 1 root root 36 May 9 09:12 chain.pem -> ../../archive/ainizhi.xin/chain1.pem
lrwxrwxrwx 1 root root 40 May 9 09:12 fullchain.pem -> ../../archive/ainizhi.xin/fullchain1.pem
lrwxrwxrwx 1 root root 38 May 9 09:12 privkey.pem -> ../../archive/ainizhi.xin/privkey1.pem
-rw-r--r-- 1 root root 682 May 9 09:12 README
這里，我們使用的是fullchain.pem和privkey.pem堰乔，前者是證書(shū)偏化，后者是私鑰。
啟用證書(shū)
本文使用Nginx來(lái)驗(yàn)證我們生成的證書(shū)镐侯，當(dāng)然侦讨，你得提前安裝好Nginx。首先，修改Nginx默認(rèn)的配置文件，啟用https配置：
server {
listen 8060 ssl http2 default_server;
listen [::]:8060 ssl http2 default_server;
server_name _;
root /usr/share/nginx/html;
ssl_certificate "/etc/letsencrypt/live/ainizhi.xin/fullchain.pem";
ssl_certificate_key "/etc/letsencrypt/live/ainizhi.xin/privkey.pem";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
error_page 404 /404.html;
location = /40x.html {
root /usr/share/nginx/html;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}
如上型将，我們主要修改了如下路徑：
ssl_certificate "/etc/letsencrypt/live/ainizhi.xin/fullchain.pem";
ssl_certificate_key "/etc/letsencrypt/live/ainizhi.xin/privkey.pem";
修改后重啟nginx即可。另外奄喂，可能有讀者會(huì)問(wèn)到，為什么不使用默認(rèn)的443接口——答曰：因?yàn)槲业挠蛎麤](méi)有備案 (灬? ?灬)。
測(cè)試
我們使用Chrome或其他瀏覽器訪問(wèn)地址https://ainizhi.xin，如下圖所示拍鲤，我們可以看到地址欄前面有了可愛(ài)的的“鎖”圖標(biāo)：
如上贴谎，則表示我們申請(qǐng)的免費(fèi)SSL證書(shū)啟用成功汞扎，也被各大瀏覽器廠商認(rèn)可季稳。
問(wèn)題
安裝Certbot 時(shí)很可能會(huì)出現(xiàn)如下錯(cuò)誤：
...省略...
Creating virtual environment...
Installing Python packages...
Traceback (most recent call last):
File "/tmp/tmp.AT0iiLfl6l/pipstrap.py", line 184, in <module>
exit(main())
File "/tmp/tmp.AT0iiLfl6l/pipstrap.py", line 165, in main
for path, digest in PACKAGES]
File "/tmp/tmp.AT0iiLfl6l/pipstrap.py", line 120, in hashed_download
response = opener(using_https=parsed_url.scheme == 'https').open(url)
File "/usr/lib64/python2.7/urllib2.py", line 431, in open
response = self._open(req, data)
File "/usr/lib64/python2.7/urllib2.py", line 449, in _open
'_open', req)
File "/usr/lib64/python2.7/urllib2.py", line 409, in _call_chain
result = func(*args)
File "/usr/lib64/python2.7/urllib2.py", line 1258, in https_open
context=self._context, check_hostname=self._check_hostname)
File "/usr/lib64/python2.7/urllib2.py", line 1214, in do_open
raise URLError(err)
urllib2.URLError: <urlopen error [Errno 101] Network is unreachable>
一般是網(wǎng)絡(luò)問(wèn)題，重試幾次即可澈魄。成功時(shí)如下所示：
...省略...
Creating virtual environment...
Installing Python packages...
Installation succeeded.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
-------------------------------------------------------------------------------
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v01.api.letsencrypt.org/directory
-------------------------------------------------------------------------------
(A)gree/(C)ancel: A
-------------------------------------------------------------------------------
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about EFF and
our work to encrypt the web, protect its users and defend digital rights.
-------------------------------------------------------------------------------
(Y)es/(N)o: Y
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for ainizhi.xin
Waiting for verification...
Cleaning up challenges
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/ainizhi.xin/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/ainizhi.xin/privkey.pem
Your cert will expire on 2018-08-07\. To obtain a new or tweaked
version of this certificate in the future, simply run certbot-auto
again. To non-interactively renew *all* of your certificates, run
"certbot-auto renew"
- Your account credentials have been saved in your Certbot
configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Certbot so
making regular backups of this folder is ideal.
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF:
睡覺(jué)
本文只是簡(jiǎn)單的介紹了如何通過(guò)Let's Encrypt申請(qǐng)免費(fèi)SSL證書(shū)并應(yīng)用之景鼠。本人水平有限，難免有錯(cuò)誤或遺漏之處痹扇，望大家指正和諒解铛漓，歡迎評(píng)論留言。
