layui-box layui-code-view" style="margin-top: 0px; margin-bottom: 10px; padding: 9.5px; -webkit-tap-highlight-color: rgba(0, 0, 0, 0); white-space: pre-wrap; overflow-wrap: break-word; box-sizing: border-box; position: relative; font-size: 13px; border: 1px solid rgb(204, 204, 204); background-color: rgb(245, 245, 245); font-family: Menlo, Monaco, Consolas, "Courier New", monospace; overflow: auto; line-height: 1.42857; word-break: break-all; border-radius: 4px;">code
- centos设置Let's Encrypt并自动更新
-
- 假如就放在/home下
-
- wget https://GitHub.com/certbot/certbot/archive/master.zip
-
- unzip master.zip
-
- cd certbot-master/
-
- ./certbot-auto --help
-
- ./certbot-auto certonly --webroot --agree-tos -v -t --email xxxx@qq.com -w /data/xxxx -d xxxx.cn
- 假如报错，再履行一遍
-
- 然后天生的证书在/etc/letsencrypt/live/下
-
- 编辑Nginx设置文件
- server {
- listen 443;
- server_name mch.vduok.com;
- ssl on;
- root /var/www/vduok.com/merchant/web;
- index index.HTML index.php;
- ssl_certificate "/etc/letsencrypt/live/mch.vduok.com/fullchain.pem";
- ssl_certificate_key "/etc/letsencrypt/live/mch.vduok.com/privkey.pem";
- ssl_session_cache shared:SSL:1m;
- ssl_session_timeout 10m;
- ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
- ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
- ssl_prefer_server_ciphers on;
- location / {
- try_files $uri $uri/ /index.php$is_args$query_string;
- }
-
- location ~ \.php$ {
- try_files $uri =404;
- fastcgi_pass 127.0.0.1:9000;
- fastcgi_index index.php;
- fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
- include fastcgi_params;
- }
- location /storage/ {
- alias /var/www/vduok.com/storage/;
- }
- }
- server {
- server_name mch.vduok.com;
- location / {
- rewrite (.*) https://mch.vduok.com$1 permanent;
- }
- }
-
- service nginx reload
-
- 即可完成SSL的设置，有用期3个月，快到期会自动往上面的邮箱发邮件，背景renew续期即可
-
- /home/certbot-master/certbot-auto renew
-
- 完成续期
-
- 加入按时使命，设备了每周一清晨4点30自动更新证书，并自动重启nginx办事，证书在到期前30天内才能更新，过剩的更新会自动疏忽掉的，每周更新还有一个益处是更新能够会失利，这样最多还有4次的尝试机遇来保证不会过期.
-
- 建立剧本 renew-cert.sh
-
- #!/bin/bash
-
- /home/certbot-master/certbot-auto renew
-
- /sbin/service nginx reload
-
- 保存剧本，并赐与可履行权限
- chmod a+x renew-cert.sh
-
- 写入按时使命 crontab -e
- 30 4 * * 1 /home/renew-cert.sh >> /home/renew-cert.log 2>&1
-
- 保存并重启crontd
- service crond restart
-
- 完成自动更新证书
