这两天把Nginx、PHP和网站都给装上了，现在来给网站安装SSL证书。目前常用知名的证书机构有好几个，其中就有大名鼎鼎的免费证书机构Let’s Encrypt。下面就来简单演示一下安装Let’s Encrypt证书的流程。
安装Let’s Encrypt客户端 Certbot
添加 CentOS 8 EPEL 安装源
sudo dnf install epel-release安装Certbot、Nginx扩展
sudo dnf install certbot python3-certbot-nginx用Certbot客户端签发证书
安装完Certbot，就可以用它来签发证书了。
sudo certbot --nginx执行以上命令，会列出可以生成SSL证书的域名，根据需要输入选项数字。
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Which names would you like to activate HTTPS for?
1: a.example.com
2: b.example.com
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):输入选项之后，就自动开始签发证书了，签发完毕后，会输出一下内容：
Requesting a certificate for a.example.com
Performing the following challenges:
http-01 challenge for a.example.com
Waiting for verification…
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/conf.d/www.conf
Redirecting all traffic on port 80 to ssl in /etc/nginx/conf.d/www.conf
Congratulations! You have successfully enabled https://a.example.com
IMPORTANT NOTES:
Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/a.example.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/a.example.com/privkey.pem
Your certificate will expire on 2021-10-04. To obtain a new or
tweaked version of this certificate in the future, simply run
certbot again with the "certonly" option. To non-interactively
renew all of your certificates, run "certbot renew"
If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le 看到 Congratulations!，就说明证书签发成功了。证书签发成功，Certbot会自动修改nginx的配置，添加SSL的配置信息。重启一下Nginx使配置生效。
设置自动过期续签
使用Let’s Encrypt签发的证书，有效期只有90天，可以使用Certbot自动续签证书。命令如下：
sudo certbot renew --dry-run我们可以利用crontab来实现自动续签证书。
执行命令：sudo crontab -e
输入续签命令：
## 该脚本会在每天凌晨3点执行证书续签更新。
0 3 * * * /usr/bin/certbot renew --quiet至此，操作完毕。
Categories: Linux
