只需六步,让你的网站免费用上https

第一步: 创建密钥

openssl genrsa 4096 > account.key  

第二步:为你的域名创建认证签名

openssl genrsa 4096 > domain.key  
#一个域名
openssl req -new -sha256 -key domain.key -subj "/CN=lovejog.com" > domain.csr

#二个域名 ( www.lovejog.com和lovejog.com)
openssl req -new -sha256 -key domain.key -subj "/" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=lovejog.com,DNS:www.lovejog.com")) > domain.csr  

第三步: 在主机上创建一个可以访问的目录.well-known/acme-challenge/

#创建目录
mkdir -p /var/www/challenges/  
#example for nginx
server {  
    listen 80;
    server_name lovejog.com www.lovejog.com;

    location /.well-known/acme-challenge/ {
        alias /var/www/challenges/;
        try_files $uri =404;
    }

    ...the rest of your config
}

第四步: 获取签名证书

下载 acme_tiny.py https://github.com/diafygi/acme-tiny.git

#在服务器运行
python acme_tiny.py --account-key ./account.key --csr ./domain.csr --acme-dir /var/www/challenges/ > ./signed.crt  

第五步: 安装证书

#NOTE: For nginx, you need to append the Let's Encrypt intermediate cert to your cert
wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem  
cat signed.crt intermediate.pem > chained.pem  
server {  
    listen 443;
    server_name yoursite.com, www.yoursite.com;

    ssl on;
    ssl_certificate /opt/cert/chained.pem;
    ssl_certificate_key /opt/cert/domain.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
    ssl_session_cache shared:SSL:50m;
    #ssl_dhparam /path/to/server.dhparam;
    ssl_prefer_server_ciphers on;

    ...the rest of your config
}

server {  
    listen 80;
    server_name lovejog.com, www.loveojog.com;

    location /.well-known/acme-challenge/ {
        alias /var/www/challenges/;
        try_files $uri =404;
    }

     location / {
        rewrite ^ https://lovejog.com$request_uri? permanent;      
        }


}

第六步: 设置自动运行脚本(因为90天要重新刷新一次)

创建文件 renew_cert.sh:

#!/bin/bash
python /opt/cert/acme_tiny.py --account-key /opt/cert/account.key --csr /opt/cert/domain.csr --acme-dir /var/www/challenges/ > /tmp/signed.crt || exit  
wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem  
cat /tmp/signed.crt intermediate.pem > /opt/cert/pchained.pem  
service nginx reload  
#使用crontab -e 进入然后加入以下命令
0 0 1 * * cd /opt/cert/ && ./renew_cert.sh 2>> /var/log/acme_tiny.log