Let's Encrypt证书申请

安装certbot，这是官方推荐的专门为Let’s encrypt制作的一个管理证书工具，可以通过它来生成证书管理更新Let’s encrypt证书。

wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto
mv certbot-auto /usr/local/bin/

然后运行，domainname就是你自己的域名

certbot-auto certonly -d 'domainname' --manual --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory

第一次运行需要填写域名到期的通知地地址，然后各种同意，最后会出现一个添加DNS的提示

-------------------------------------------------------------------------------
(A)gree/(C)ancel: A
-------------------------------------------------------------------------------
(Y)es/(N)o: N
-------------------------------------------------------------------------------
Are you OK with your IP being logged?
(Y)es/(N)o: Y
-------------------------------------------------------------------------------
Please deploy a DNS TXT record under the name
_acme-challenge.domainname.com with the following value:

FTctTRfyr6zmfwtI7Gcv7Omgj5Jf202UgCJ-NIX3GtE

Before continuing, verify the record is deployed.
-------------------------------------------------------------------------------
Press Enter to Continue

需要添加完域名解析后才能继续

记录类型：TXT
主机记录：_acme-challenge.domainname.com
记录值：FTctTRfyr6zmfwtI7Gcv7Omgj5Jf202UgCJ-NIX3GtE

然后就获得证书了

 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/yaojie.space/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/yaojie.space/privkey.pem
   Your cert will expire on 2020-01-26. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"

有了证书之后就可以配置nginx了，配置很简单可以在网上查到，记得防火墙打开端口，我配置好了之后发现还是不行，telnet 域名 443后，发现connection refused。

其实证书有泛域名的，只是当时手抖，写成了申请单域名的，暂时就这么用也没关系。

这个链接是centos7，防火墙相关的操作

https://www.cnblogs.com/yanglang/p/10711826.html

参考资料：

https://github.com/Neilpang/acme.sh

https://linuxops.org/blog/linux/certbot.html