安装certbot,这是官方推荐的专门为Let’s encrypt制作的一个管理证书工具,可以通过它来生成证书管理更新Let’s encrypt证书。
wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto
mv certbot-auto /usr/local/bin/
然后运行,domainname就是你自己的域名
certbot-auto certonly -d 'domainname' --manual --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory
第一次运行需要填写域名到期的通知地地址,然后各种同意,最后会出现一个添加DNS的提示
-------------------------------------------------------------------------------
(A)gree/(C)ancel: A
-------------------------------------------------------------------------------
(Y)es/(N)o: N
-------------------------------------------------------------------------------
Are you OK with your IP being logged?
(Y)es/(N)o: Y
-------------------------------------------------------------------------------
Please deploy a DNS TXT record under the name
_acme-challenge.domainname.com with the following value:
FTctTRfyr6zmfwtI7Gcv7Omgj5Jf202UgCJ-NIX3GtE
Before continuing, verify the record is deployed.
-------------------------------------------------------------------------------
Press Enter to Continue
需要添加完域名解析后才能继续
记录类型:TXT
主机记录:_acme-challenge.domainname.com
记录值:FTctTRfyr6zmfwtI7Gcv7Omgj5Jf202UgCJ-NIX3GtE
然后就获得证书了
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/yaojie.space/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/yaojie.space/privkey.pem
Your cert will expire on 2020-01-26. To obtain a new or tweaked
version of this certificate in the future, simply run certbot-auto
again. To non-interactively renew *all* of your certificates, run
"certbot-auto renew"
有了证书之后就可以配置nginx了,配置很简单可以在网上查到,记得防火墙打开端口,我配置好了之后发现还是不行,telnet 域名 443后,发现connection refused。
其实证书有泛域名的,只是当时手抖,写成了申请单域名的,暂时就这么用也没关系。
这个链接是centos7,防火墙相关的操作
https://www.cnblogs.com/yanglang/p/10711826.html
参考资料: