CentOS7免费SSL证书及自动展期
This post shows you how to obtain a wildcard SSL certificate for free (which values at least $50) from Let’s Encrypt on CentOS 7.x Linux, and get it setup to renew by itself with an automated script.
至于什么是SSL证书，有什么用，这里不赘述了。大致上，一个泛域名（通配符）DV证书，价值怎么也在CNY 2000/年开外，注意是按年缴费；企业型（OV）证书则更贵，年费肯定不下万。因此别嫌命令行操作不好搞，有免费午餐已然相当给力，还要啥自行车。
按规矩，周知一下，证书发行方是Let’s Encrypt。之所以能送免（bai）费（piao）证书，据说主要是全自动。证书生成、发放、展期等操作，都经shell脚本完全自动化 —— 无人工就成本低，蛮好理解；至于抢了那几家拦路收费的生意，咱也捧个人场，起码希望他们能一直坚持做下去。
证书自动获取
来一台阿里云上的CentOS7，以非root（但具备sudo权限）用户连接，先下载certbot-auto脚本，并授以执行权限。
|
1 2 3 4 5 6 7 8 9 10 11 |
[py27@fisher-test ~]$ wget https://dl.eff.org/certbot-auto --2020-06-11 22:57:34-- https://dl.eff.org/certbot-auto 正在解析主机 dl.eff.org (dl.eff.org)... 151.101.228.201, 2a04:4e42:1a::201 正在连接 dl.eff.org ... 已连接。 已发出HTTP 请求，正在等待回应... 200 OK 长度：79897 (78K) [application/octet-stream] 正在保存至: “certbot-auto” 100%[===============================>] 79,897 5.73KB/s 用时13s 2020-06-11 22:57:50 (6.03 KB/s) - 已保存 “certbot-auto” [79897/79897]) |
然后以手工完成“挑战”（challenge）的方式，获取泛域名（通配符）DV证书，其中挑战选择DNS，也即按脚本要求，手工在域名解析中增加TXT记录 —— 以此证明此域名归属于申请者。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 |
[py27@fisher-test ~]$ ./certbot-auto certonly -d *.fisher.cn --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory Requesting to rerun ./certbot-auto with root privileges... ./certbot-auto has insecure permissions! To learn how to fix them, visit https://community.letsencrypt.org/t/certbot-auto-deployment-best-practices/91979/ Saving debug log to /var/log/letsencrypt/letsencrypt.log（这里存放获取证书全过程日志供参考） Plugins selected: Authenticator manual, Installer None Obtaining a new certificate Performing the following challenges: dns-01 challenge for fisher.cn - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - NOTE: The IP of this machine will be publicly logged as having requested this certificate. If you're running certbot in manual mode on a machine that is not your server, please ensure you're okay with that. Are you OK with your IP being logged?（作为申请数字证书的要求，是否可以记录本机IP） - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: Y - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please deploy a DNS TXT record under the name _acme-challenge.fisher.cn with the following value:（在域名中增加TXT解析，以完成“挑战”） MomldPnAKL4I8bL8FiwmqvJJdE7E97RH-ARf7PZgw88 Before continuing, verify the record is deployed. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Press Enter to Continue（此处暂停，登你的DNS，设置解析；搞定后此处回车）【注：过后可删除】 Waiting for verification... Cleaning up challenges IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at:（证书获取成功，存放位置如下） /etc/letsencrypt/live/fisher.cn/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/fisher.cn/privkey.pem Your cert will expire on 2020-09-11. To obtain a new or tweaked（证书过期时间，及更新方法） version of this certificate in the future, simply run certbot-auto again. To non-interactively renew *all* of your certificates, run "certbot-auto renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le |
那么证书如何将http通信升级为https，不同的后端有不同的代码实现方式。但就目前主流做法，大家倾向于让https通信脱离开发范畴，直接配置在httpd中，比如nginx config（或者apache之类均可）：
文章的脚注信息由WordPress的wp-posturl插件自动生成
完整阅读本篇»