{"id":22,"date":"2025-05-20T23:57:49","date_gmt":"2025-05-20T15:57:49","guid":{"rendered":"https:\/\/itfinn.com\/?p=22"},"modified":"2025-05-20T23:57:49","modified_gmt":"2025-05-20T15:57:49","slug":"%e7%94%b3%e8%af%b7%e9%85%8d%e7%bd%ae-lets-encrypt-ssl%e8%af%81%e4%b9%a6","status":"publish","type":"post","link":"https:\/\/itfinn.com\/index.php\/2025\/05\/20\/%e7%94%b3%e8%af%b7%e9%85%8d%e7%bd%ae-lets-encrypt-ssl%e8%af%81%e4%b9%a6\/","title":{"rendered":"\u7533\u8bf7&\u914d\u7f6e Let’s Encrypt SSL\u8bc1\u4e66"},"content":{"rendered":"\n
\n

Let’s Encrypt<\/a><\/strong>
\u4f5c\u4e3a\u4e00\u4e2a\u516c\u5171\u4e14\u514d\u8d39SSL\u7684\u9879\u76ee\u9010\u6e10\u88ab\u5e7f\u5927\u7528\u6237\u4f20\u64ad\u548c\u4f7f\u7528\uff0c\u662f\u7531Mozilla\u3001Cisco\u3001Akamai\u3001IdenTrust\u3001EFF\u7b49\u7ec4\u7ec7\u4eba\u5458\u53d1\u8d77\uff0c\u4e3b\u8981\u7684\u76ee\u7684\u4e5f\u662f\u4e3a\u4e86\u63a8\u8fdb\u7f51\u7ad9\u4eceHTTP\u5411HTTPS\u8fc7\u5ea6\u7684\u8fdb\u7a0b\uff0c\u76ee\u524d\u5df2\u7ecf\u6709\u8d8a\u6765\u8d8a\u591a\u7684\u5546\u5bb6\u52a0\u5165\u548c\u8d5e\u52a9\u652f\u6301\u3002<\/em><\/p>\n<\/blockquote>\n\n\n\n

\u867d\u7136\u76ee\u524dLet’s Encrypt\u514d\u8d39SSL\u8bc1\u4e66\u9ed8\u8ba4\u662f90\u5929\u6709\u6548\u671f\uff0c\u4f46\u662f\u6211\u4eec\u4e5f\u53ef\u4ee5\u5230\u671f\u81ea\u52a8\u7eed\u7ea6\uff0c\u4e0d\u5f71\u54cd\u6211\u4eec\u7684\u5c1d\u8bd5\u548c\u4f7f\u7528\u3002<\/strong><\/p>\n\n\n\n

\n\n\n\n

1. \u51c6\u5907\u5de5\u4f5c<\/h2>\n\n\n\n

\u6839\u636e\u5b98\u65b9\u7684\u8981\u6c42\uff0c\u6211\u4eec\u5728VPS\u3001\u670d\u52a1\u5668\u4e0a\u90e8\u7f72Let’s Encrypt\u514d\u8d39SSL\u8bc1\u4e66\u4e4b\u524d\uff0c\u9700\u8981\u7cfb\u7edf\u652f\u6301Python2.7<\/code>\u4ee5\u4e0a\u7248\u672c\u4ee5\u53ca\u652f\u6301GIT<\/code>\u5de5\u5177\u3002
\u8fd9\u4e2a\u9700\u8981\u6839\u636e\u6211\u4eec\u4e0d\u540c\u7684\u7cfb\u7edf\u7248\u672c\u8fdb\u884c\u5b89\u88c5\u548c\u5347\u7ea7\uff0c\u56e0\u4e3a\u6709\u4e9b\u670d\u52a1\u5546\u63d0\u4f9b\u7684\u7248\u672c\u517c\u5bb9\u662f\u5b8c\u5584\u7684\u3002
\u6700\u4e3a\u7b80\u5355\u7684\u5c31\u662fDebian\u73af\u5883\u4e0d\u652f\u6301\uff0c\u53ef\u4ee5\u8fd0\u884capt-get -y install git<\/code>\u76f4\u63a5\u5b89\u88c5\u652f\u6301\uff0c
\u5982\u679c\u662fCentOS\u76f4\u63a5\u8fd0\u884cyum -y install git-core<\/code>\u652f\u6301\u3002
\u8fd9\u4e2a\u5177\u4f53\u9047\u5230\u95ee\u9898\u5728\u8ba8\u8bba\u548c\u641c\u7d22\u89e3\u51b3\u65b9\u6848\uff0c\u56e0\u4e3a\u6bcf\u4e2a\u73af\u5883\u3001\u5546\u5bb6\u53d1\u884c\u7248\u90fd\u53ef\u80fd\u4e0d\u540c\u3002<\/p>\n\n\n\n

2. \u5feb\u901f\u83b7\u53d6SSL\u8bc1\u4e66<\/h2>\n\n\n\n

Let’s Encrypt\u80af\u5b9a\u662f\u8003\u8651\u5230\u63a8\u5e7fHTTPS\u7684\u666e\u53ca\u578b\u4f1a\u8ba9\u7528\u6237\u7b80\u5355\u7684\u83b7\u53d6\u548c\u90e8\u7f72SSL\u8bc1\u4e66\uff0c\u6240\u4ee5\u53ef\u4ee5\u91c7\u7528\u4e0b\u9762\u7b80\u5355\u7684\u4e00\u952e\u90e8\u7f72\u83b7\u53d6\u8bc1\u4e66\u3002
PS\uff1a\u5728\u83b7\u53d6\u67d0\u4e2a\u7ad9\u70b9\u8bc1\u4e66\u6587\u4ef6\u7684\u65f6\u5019\uff0c\u6211\u4eec\u9700\u8981\u5728\u5b89\u88c5PYTHON2.7<\/code>\u4ee5\u53caGIT<\/code>\uff0c\u9700\u8981\u5c06\u57df\u540d\u89e3\u6790\u5230\u5f53\u524dVPS\u4e3b\u673aIP\u4e2d\u3002<\/strong><\/p>\n\n\n\n

# \u83b7\u53d6Let's Encrypt\u7a0b\u5e8f\ngit clone https:\/\/github.com\/letsencrypt\/letsencrypt\ncd letsencrypt\n\n# \u7533\u8bf7Let's Encrypt\u8bc1\u4e66 \n# \u683c\u5f0f --email [\u90ae\u7bb1\u5730\u5740] -d [\u57df\u540d1] -d [\u57df\u540d2]\n.\/certbot-auto certonly --standalone --email xxx@mail.com -d itfinn.com -d www.itfinn.com<\/code><\/pre>\n\n\n\n
\n
\u5982\u679c80\u7aef\u53e3\u88ab\u5360\u7528\uff0c\u4f1a\u5bfc\u81f4\u7533\u8bf7\u8bc1\u4e66\u5931\u8d25\uff0c\u53ef\u4ee5\u5148\u628a\u5360\u752880\u7aef\u53e3\u7684\u5e94\u7528\u505c\u6b62\u3002<\/strong><\/p>\n<\/blockquote>\n\n\n\n
\u6bd4\u5982\u6211\u8fd9\u91cc\u5360\u752880\u7aef\u53e3\u7684\u662fNginx\uff1a<\/p>\n\n\n\n
nginx-s stop\n.\/certbot-auto certonly --standalone --email xxx@mail.com -d itfinn.com -d www.itfinn.com\nnginx<\/code><\/pre>\n\n\n\n
3. \u5e94\u7528<\/h2>\n\n\n\n
\u5728\u5b8c\u6210Let’s Encrypt\u8bc1\u4e66\u7684\u751f\u6210\u4e4b\u540e\uff0c\u6211\u4eec\u4f1a\u5728 \/etc\/letsencrypt\/live\/itfinn.com\/<\/code> \u57df\u540d\u76ee\u5f55\u4e0b\u67094\u4e2a\u6587\u4ef6\u5c31\u662f\u751f\u6210\u7684\u5bc6\u94a5\u8bc1\u4e66\u6587\u4ef6\u3002<\/p>\n\n\n\n
cert.pem  - Apache\u670d\u52a1\u5668\u7aef\u8bc1\u4e66\nchain.pem  - Apache\u6839\u8bc1\u4e66\u548c\u4e2d\u7ee7\u8bc1\u4e66\nfullchain.pem  - Nginx\u6240\u9700\u8981ssl_certificate\u6587\u4ef6\nprivkey.pem - \u5b89\u5168\u8bc1\u4e66KEY\u6587\u4ef6<\/code><\/pre>\n\n\n\n
\u5982\u679c\u6211\u4eec\u4f7f\u7528\u7684Nginx\u73af\u5883\uff0c\u90a3\u5c31\u9700\u8981\u7528\u5230fullchain.pem<\/code>\u548cprivkey.pem<\/code>\u4e24\u4e2a\u8bc1\u4e66\u6587\u4ef6<\/p>\n\n\n\n
\u914d\u7f6enginx\u542f\u7528\u8bc1\u4e66<\/h3>\n\n\n\n
\u5728\u914d\u7f6e\u6587\u4ef6\u4e0a\u65b0\u5efa\u4e00\u4e2aserver\u8bed\u5757\uff1a<\/p>\n\n\n\n
server {\n    listen 443 ssl;\n    server_name itfinn.com;\n\n    # SSL\u8bc1\u4e66\u8def\u5f84\n    ssl_certificate \/etc\/letsencrypt\/live\/itfinn.com\/fullchain.pem;\n    ssl_certificate_key \/etc\/letsencrypt\/live\/itfinn.com\/privkey.pem;\n\n    ssl_stapling on;\n    ssl_stapling_verify on;\n\n    access_log \/var\/log\/nginx\/sub.log combined;\n\n    location \/ {\n        # \u5185\u5bb9\u4e0e80\u7aef\u53e3\u7684server\u5757\u4e00\u6837, copy\u4e00\u4efd\u8fc7\u6765\n        [\u2026]\n    }\n}<\/code><\/pre>\n\n\n\n
\u91cd\u65b0\u8f7d\u5165nginx\uff1a<\/p>\n\n\n\n
nginx -s reload<\/code><\/pre>\n\n\n\n
\n
\u73b0\u5728 \u5728\u6d4f\u89c8\u5668\u4e2d\u8bbf\u95ee https:\/\/itfinn.com<\/a> \u548c https:\/\/www.itfinn.com<\/a> \u6d4b\u8bd5\u4e00\u4e0bHTTPS\u662f\u5426\u6b63\u5e38\u3001\u6d4f\u89c8\u5668\u6709\u6ca1\u6709\u62a5\u8bc1\u4e66\u9519\u8bef\u3002<\/strong><\/p>\n<\/blockquote>\n\n\n\n
HTTP\u91cd\u5b9a\u5411\u81f3HTTPS<\/h3>\n\n\n\n
\u628anginx\u914d\u7f6e\u6587\u4ef6\u4e2d80\u7aef\u53e3\u7684server\u8bed\u5757\u6539\u4e3a\u5982\u4e0b\uff1a<\/p>\n\n\n\n
server {\n    listen 80;\n    server_name itfinn.com;\n    #\u91cd\u5b9a\u5411\n    rewrite    ^ https:\/\/$host$request_uri? permanent;\n}<\/code><\/pre>\n\n\n\n
\u91cd\u65b0\u8f7d\u5165nginx\u5373\u53ef\u3002<\/p>\n\n\n\n
\u81ea\u52a8\u66f4\u65b0\u8bc1\u4e66<\/h3>\n\n\n\n
\u56e0\u4e3aNginx\u53cd\u4ee3\u5360\u7528\u4e8680\u7aef\u53e3, \u6240\u4ee5\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u65f6\u9700\u8981\u5148\u628aNginx\u505c\u6b62, \u6267\u884c\u5b8c\u547d\u4ee4\u540e\u518d\u91cd\u542fNginx\uff1a<\/p>\n\n\n\n
nginx -s stop<\/code><\/pre>\n\n\n\n
\u4f60\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u8bed\u53e5\u6765\u66f4\u65b0\u6240\u6709\u8d85\u8fc760\u5929\u7684\u8bc1\u4e66\uff1a<\/p>\n\n\n\n
.\/certbot-auto renew<\/code><\/pre>\n\n\n\n
\u4e5f\u53ef\u4ee5\u628a\u66f4\u65b0\u547d\u4ee4\u5199\u5165\/etc\/crontab\uff0c\u5b9e\u73b0\u81ea\u52a8\u66f4\u65b0\uff1a<\/p>\n\n\n\n
# \u5199\u4e2a\u81ea\u52a8\u66f4\u65b0\u811a\u672c\uff1a  \nvim mod_ssl.sh\n\n#!\/bin\/bash\n\/usr\/sbin\/nginx -s stop\n\/root\/ssl\/letsencrypt\/certbot-auto renew --quiet\n\/usr\/sbin\/nginx\n\n# \u5199\u5165\/etc\/crontab\ncrontab -e\n0 * * *\/2 * \/bin\/sh \/root\/ssl\/letsencrypt\/mod_ssl.sh<\/code><\/pre>\n\n\n\n
\u6d4b\u8bd5\u66f4\u65b0\u64cd\u4f5c\uff1a<\/p>\n\n\n\n
.\/certbot-auto --dry-run renew<\/code><\/pre>\n\n\n\n
\u5f3a\u5236\u63d0\u524d\u66f4\u65b0\u8bc1\u4e66\uff1a<\/p>\n\n\n\n
.\/certbot-auto renew --force-renew<\/code><\/pre>\n\n\n\n
4. \u4f7f\u7528 acme.sh \u90e8\u7f72<\/h2>\n\n\n\n
\u4f7f\u7528 acme.sh \u90e8\u7f72 Let’s Encrypt \u901a\u8fc7\u963f\u91cc\u4e91 DNS \u9a8c\u8bc1\u65b9\u5f0f\u5b9e\u73b0\u6cdb\u57df\u540d HTTPS — \u4e91\u6de1\u7136<\/a><\/p>\n\n\n\n
acme.sh --issue --dns dns_ali -d *.itfinn.com -d itfinn.com \\\n--installcert \\\n--key-file \/root\/ssl\/all_domain\/itfinn.com\/privkey.key \\\n--fullchain-file \/root\/ssl\/all_domain\/itfinn.com\/fullchain.pem \\\n--reloadcmd \"nginx -s reload\"<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Let’s Encrypt\u4f5c\u4e3a\u4e00\u4e2a\u516c\u5171\u4e14\u514d\u8d39SSL\u7684\u9879\u76ee\u9010\u6e10\u88ab\u5e7f\u5927\u7528\u6237\u4f20\u64ad\u548c\u4f7f\u7528\uff0c\u662f\u7531Mozill […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-22","post","type-post","status-publish","format-standard","hentry","category-development"],"_links":{"self":[{"href":"https:\/\/itfinn.com\/index.php\/wp-json\/wp\/v2\/posts\/22","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itfinn.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itfinn.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itfinn.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itfinn.com\/index.php\/wp-json\/wp\/v2\/comments?post=22"}],"version-history":[{"count":1,"href":"https:\/\/itfinn.com\/index.php\/wp-json\/wp\/v2\/posts\/22\/revisions"}],"predecessor-version":[{"id":23,"href":"https:\/\/itfinn.com\/index.php\/wp-json\/wp\/v2\/posts\/22\/revisions\/23"}],"wp:attachment":[{"href":"https:\/\/itfinn.com\/index.php\/wp-json\/wp\/v2\/media?parent=22"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itfinn.com\/index.php\/wp-json\/wp\/v2\/categories?post=22"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itfinn.com\/index.php\/wp-json\/wp\/v2\/tags?post=22"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}