【完美实战】CentOS下通过CertBot工具申请免费Let‘s Encrypt泛域名ssl证书【兼容泛域名的ssl,很强大哦】

电玩女神 2021-09-02 10:03 790阅读 0赞

十大免费SSL证书：网站免费添加HTTPS加密：[https://blog.csdn.net/ithomer/article/details/78075006?utm\_source=po\_vip][https_blog.csdn.net_ithomer_article_details_78075006_utm_source_po_vip]

certbot命令选项大全：[https://www.dazhuanlan.com/2019/12/13/5df2eeb662b16/][https_www.dazhuanlan.com_2019_12_13_5df2eeb662b16]

免费ssl证书：**Let's Encrypt **（推荐）官网：[https://letsencrypt.org][https_letsencrypt.org]

申请工具[certbot官网：https://certbot.eff.org/lets-encrypt/centosrhel7-nginx][certbot_https_certbot.eff.org_lets-encrypt_centosrhel7-nginx]

参考申请【简单易懂】：[https://www.cnblogs.com/lee2guang/p/12736355.html][https_www.cnblogs.com_lee2guang_p_12736355.html]

**第一步：安装cerbot工具：**

yum install certbot python2-certbot-nginx

** 第二步：手动运行这条命令即可生成ssl证书：**

$ certbot certonly --preferred-challenges dns --manual -d dada.fun -d *.dada.fun --server https://acme-v02.api.letsencrypt.org/directory

注意：-d 指定域名，\*.dada.fun 必须的，本来就冲着它来的。有的机构会自动带上 dada.fun，但是 Let’s Encrypt 不会，所以要把 dada.fun 带上，不然访问 dada.fun 还是 HTTP 就尴尬了！

其次：第二步生成ssl证书时会提示输入【邮箱】

$ sudo certbot certonly --standalone  -d 'bysir.store'
    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Plugins selected: Authenticator standalone, Installer None
    Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
    Obtaining a new certificate
    Performing the following challenges:
    http-01 challenge for bysir.store
    Waiting for verification...
    Cleaning up challenges
    
    IMPORTANT NOTES:
     - Congratulations! Your certificate and chain have been saved at:
       /etc/letsencrypt/live/bysir.store/fullchain.pem
       Your key file has been saved at:
       /etc/letsencrypt/live/bysir.store/privkey.pem
       Your cert will expire on 2018-09-11. To obtain a new or tweaked
       version of this certificate in the future, simply run certbot
       again. To non-interactively renew *all* of your certificates, run
       "certbot renew"
     - If you like Certbot, please consider supporting our work by:
    
       Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
       Donating to EFF:                    https://eff.org/donate-le

可以看到验证通过并成功生成了证书, 其中 privkey.pem就是nginx要的key, fullchain.pem就是nginx要的pem.

完成.

(ps: 使用DNS认证方式会简单很多, 推荐使用)

【非常重要】免费申请的SSL证书有效期只有3个月，为此必须设置定时更新任务来确保域名证书永久有效！参考【看最下面介绍】：[https://www.jianshu.com/p/034b891cf395][https_www.jianshu.com_p_034b891cf395]

**cerbot工具官方配置定时器执行更新域名证书任务代码：**[https://certbot.eff.org/lets-encrypt/centosrhel7-nginx][certbot_https_certbot.eff.org_lets-encrypt_centosrhel7-nginx]

echo "0 0,12 * * * root python -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot renew -q" | sudo tee -a /etc/crontab > /dev/null

# 执行以下这条命令则自动更新证书的时间【这里的-q是一个参数，请参考certbot命令大全】
    certbot -q renew

**certbot移除证书的方法【先移除后删除】：**

第一步运行命令：
    
    certbot revoke --cert-path /etc/letsencrypt/archive/www.mydomain.com/cert1.pem
    
    第二步：运行命令
    certbot delete
    
    然后会提示域名对应的编号数字，输入对应数字则删除证书

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzM0MzE0NA_size_16_color_FFFFFF_t_70][]

[https_blog.csdn.net_ithomer_article_details_78075006_utm_source_po_vip]: https://blog.csdn.net/ithomer/article/details/78075006?utm_source=po_vip
[https_www.dazhuanlan.com_2019_12_13_5df2eeb662b16]: https://www.dazhuanlan.com/2019/12/13/5df2eeb662b16/
[https_letsencrypt.org]: https://letsencrypt.org/
[certbot_https_certbot.eff.org_lets-encrypt_centosrhel7-nginx]: https://certbot.eff.org/lets-encrypt/centosrhel7-nginx
[https_www.cnblogs.com_lee2guang_p_12736355.html]: https://www.cnblogs.com/lee2guang/p/12736355.html
[https_www.jianshu.com_p_034b891cf395]: https://www.jianshu.com/p/034b891cf395
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzM0MzE0NA_size_16_color_FFFFFF_t_70]: /images/20210813/1ed33f40e691464cb352a691106520c5.png