假定你已經(jīng)用nginx搭建好網(wǎng)站
安裝Certbot
Certbot是維護Let's Encrypt的Package。
添加package repository
sudo add-apt-repository ppa:certbot/certbot
直接回車瘩蚪，添加完畢后，更新apt源數(shù)據(jù)：
sudo apt-get update
然后安裝Certbot的Nginx package：
sudo apt-get install python-certbot-nginx
簽發(fā)ssl證書
現(xiàn)在使用Let's Encrypt簽發(fā)ssl證書：
sudo certbot --nginx -d your-domian.com -d www.your-domain.com
注意這里的 your-domain.com 換成你自己的域名懒构，如果你第一次運行certbot的話邢享，會讓你輸入郵箱始衅，還要接受Let's Encrypt的協(xié)議武福，最后會讓你選擇是否重定向http到https：
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
選2议双，重定向即可。
最后可以看到生成的證書的位置：
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/oyty.me/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/oyty.me/privkey.pem
Your cert will expire on 2018-09-24. To obtain a new or tweaked
version of this certificate in the future, simply run certbot again
with the "certonly" option. To non-interactively renew *all* of
your certificates, run "certbot renew"
- Your account credentials have been saved in your Certbot
configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Certbot so
making regular backups of this folder is ideal.
- If you like Certbot, please consider supporting our work by:
這個時候捉片，ssl證書已經(jīng)自動簽發(fā)完畢了平痰，你可以訪問網(wǎng)站汞舱，發(fā)現(xiàn)已經(jīng)是https的了。
查看我之前的nginx配置文件/etc/nginx/sites-available/oyty
server {
server_name oyty.me www.oyty.me;
root /var/www/oyty/oyty.github.io;
index index.html;
location / {
try_files $uri $uri/ =404;
}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/oyty.me/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/oyty.me/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = www.oyty.me) {
return 301 https://$host$request_uri;
} # managed by Certbot
if ($host = oyty.me) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
listen [::]:80;
server_name oyty.me www.oyty.me;
return 404; # managed by Certbot
}
ssl證書文件自動集成了宗雇，如果沒有你也可以根據(jù)生成的證書地址自己配置昂芜。
自動更新證書
因為 Let's Encrypt 簽發(fā)的 SSL 證書有效期只有 90 天，所有在過期之前赔蒲，我們需要自動更新 SSL 證書泌神，而如果你使用最新的 certbot 的話，Let's Encrypt 會幫你添加自動更新的腳本到 /etc/cron.d 里嘹履，你只需要去檢測一下這個命令是否生效就OK腻扇！
sudo certbot renew --dry-run
