Centos7 通配符HTTPS证书申请实测笔记

环境：

免费通配符HTTPS证书网址：

https://letsencrypt.org/

1.下载证书申请工具

[root@centos ~]# mkdir /opt/letsencrypt -p
[root@centos ~]# cd /opt/letsencrypt
[root@centos ~]# wget https://dl.eff.org/certbot-auto
[root@centos ~]# chmod u+x certbot-auto

2.申请证书（注意提供的域名 *.domain.com）
./certbot-auto --server https://acme-v02.api.letsencrypt.org/directory --manual --preferred-challenges dns-01 certonly -d "*.domain.com"

需要下载多个依赖包,完成后，需要根据提示提供信息

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): [email protected]

-------------------------------------------------------------------------------
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
-------------------------------------------------------------------------------
(A)gree/(C)ancel: A

-------------------------------------------------------------------------------
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about EFF and
our work to encrypt the web, protect its users and defend digital rights.
-------------------------------------------------------------------------------
(Y)es/(N)o: Y
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for jooylife.cn

-------------------------------------------------------------------------------
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
-------------------------------------------------------------------------------
(Y)es/(N)o: Y

-------------------------------------------------------------------------------
Please deploy a DNS TXT record under the name
_acme-challenge.domain.com with the following value:

GcOWiMJRp7DjbG0m855SU1dWxwgL16zDiqQjOJwKNdY

Before continuing, verify the record is deployed.
-------------------------------------------------------------------------------
Press Enter to Continue

到这里，先不要继续，必须先到域名解析平台，添加DNS TXT记录

域名解析设置

记录类型：TXT
主机记录:_acme-challenge.domain.com
解析线路：
记录值：GcOWiMJRp7DjbG0m855SU1dWxwgL16zDiqQjOJwKNdY
TTL值：10分钟

设置后，需要确认更新成功
dig _acme-challenge.domain.com txt

如果成功读取到值，则代表设置成功

Before continuing, verify the record is deployed.
-------------------------------------------------------------------------------
Press Enter to Continue

回车继续证书生成

查看生成证书文件
ll /etc/letsencrypt/live/domain.com

查看证书信息
./certbot-auto certificates

查看证书更新到期信息
cat /etc/letsencrypt/renewal/domain.com.conf

mkdir /data/ssl -p
cp /etc/letsencrypt/live/domain.com/fullchain.pem /data/ssl
cp /etc/letsencrypt/live/domain.com/privkey.pem /data/ssl
chown -R www:www fullchain.pem
chown -R www:www privkey.pem

cd /opt/nginx/conf/vhosts/

vim www.domain.com.conf
设置NGINX
server {
    server_name www.domain.com;
    listen 443 ssl;
    ssl on;
    ssl_certificate /data/ssl/fullchain.pem;
    ssl_certificate_key /data/ssl/privkey.pem;

    location / {
      proxy_pass http://www.baidu.com;
    }
}

证书手动更新 (30天内到期才可以更新)
cd /opt/letsencrypt
certbot-auto renew

配置证书自动更新

crontab -e

# 每月1日的凌晨3点就会执行一次所有域名的续期操作
0 3 1 * * ./certbot-auto renew --renew-hook "/etc/init.d/nginx reload"
# 每月1号5时执行执行一次更新，并重启nginx服务器
00 05 01 * * ./certbot-auto renew --renew-hook "/etc/init.d/nginx reload"

#/bin/sh
#续期说明：只用renew的话，会先检查证书是否需要更新，大概是距离到期还有三天或者十几天之内才会执行更新，否则会提示不需要更新。（昨天更新了证书，今天直接用renew，提示不允许更新）
#这里方便测试，增加参数--force-renew，能够强制立即更新（但好像也会有检查，时间会变短，比如我刚才更新过了，马上再次执行会报错并提示不需要更新）。
./certbot-auto renew --force-renew
#生成p12
cd /mnt/web/letsTemp &&  openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out fullchain_and_key.p12 -name tomcat -passin passyourPKCS12pass  -passout pass:yourPKCS12pass
#移动新生成的证书文件
cp /etc/letsencrypt/live/yourDomain/fullchain.pem /mnt/web/letsTemp
cp /etc/letsencrypt/live/yourDomain/privkey.pem /mnt/web/letsTemp
#生成jks文件
#备份并删除原jks文件
mv /mnt/web/letsTemp/MyDSKeyStore.jks /mnt/web/letsTemp/MyDSKeyStore`date '+%Y-%m-%d'`.jks
cd /mnt/web/letsTemp && keytool -importkeystore -deststorepass yourKeyPass  -destkeypass yourKeyPass  -destkeystore MyDSKeyStore.jks -srckeystore fullchain_and_key.p12 -srcstoretype PKCS12 -srcstorepass yourPKCS12pass  -alias tomcat
#重启服务器
/mnt/web/tomcat/tomcat8/bin/restartup.sh

在打开的编辑器中添加如下内容（每个月1号凌晨3点更新）
0    0  3 *  *  sh /mnt/web/lets/ssl_auto_auth.sh >/dev/null 2>&1 &

Centos7 通配符HTTPS证书申请 实测 笔记

猜你喜欢

Centos7 通配符HTTPS证书申请实测笔记