免费https证书安装（Nginx）

前言

对于站点来说，使用https访问能增强数据传输的安全性，避免一些安全事故，同时拥有了https认证，在主流浏览器中都被被标记为可信任的安全的网站，也能加强搜索引擎的对https站点的收录。

笔者使用的是Let’s Encrypt的免费https证书，是有有效期的，不过是可以免费续签的，在有效期达到之前会有邮件发到你的注册邮箱中，提醒你快到期了。

续签的步骤也很简单，下面的步骤中会提到。

步骤

下载安装

第三行的命令是关键步骤，一些参数需要你作修改：--email 你的邮箱、-w 站点主目录、-d 你的域名。

[root@host certbot]#git clone https://github.com/certbot/certbot
[root@host certbot]#cd certbot/
[root@host certbot]#./certbot-auto certonly --webroot --agree-tos -v -t --email youmail@mail.com -w /usr/local/nginx/html/ -d www.example.com
……
IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/www.example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/www.example.com/privkey.pem
   Your cert will expire on 2019-02-19. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le
[root@host certbot]# openssl dhparam -out /etc/ssl/certs/dhparams.pem 2048
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
................................................................................+........................+.............

Nginx配置

主要是ssl_certificate、ssl_certificate_key的参数，指定到上面生成的文件。

server {
    listen       443 ssl;
    server_name  localhost;
    charset utf-8;
    ssl_certificate      /etc/letsencrypt/live/www.example.com/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/www.example.com/privkey.pem;
    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;
    ssl_dhparam /etc/ssl/certs/dhparams.pem;
    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;
    location / {
        # 这里我是做了端口转发，你可以不必修改
        proxy_pass http://localhost:4000;
    }
}

证书更新

如果证书快到期了，可以使用这条命令免费续签

[root@host certbot]# ./certbot-auto renew