免费生成Nginx的Https使用的SSL证书

1、打开Free SSL Certificates Provider and ACME Tools 需要先注册

2、选择通配符证书，可以是二级或则三级通配符

      例如：*.yourdomain.com 或则*.yourdomain.com.cn

3、打开生成页面，一直下一步，会生成一个_xxxx.yourdomain.com.key的文件

4、安装工具，安装后需要重新进入linux才能使用

可以参考：ACME v2证书自动化快速入门

curl https://get.acme.sh | sh -s email=yourEmail

[root@localhost ~]# curl https://get.acme.sh | sh -s email=lenkty@live.cn
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1032    0  1032    0     0    498      0 --:--:--  0:00:02 --:--:--   499
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  214k  100  214k    0     0  23645      0  0:00:09  0:00:09 --:--:-- 21315
[Tue Dec  6 14:34:58 CST 2022] Installing from online archive.
[Tue Dec  6 14:34:58 CST 2022] Downloading https://github.com/acmesh-official/acme.sh/archive/master.tar.gz
[Tue Dec  6 14:35:04 CST 2022] Extracting master.tar.gz
[Tue Dec  6 14:35:04 CST 2022] It is recommended to install socat first.
[Tue Dec  6 14:35:04 CST 2022] We use socat for standalone server if you use standalone mode.
[Tue Dec  6 14:35:04 CST 2022] If you don't use standalone mode, just ignore this warning.
[Tue Dec  6 14:35:04 CST 2022] Installing to /root/.acme.sh
[Tue Dec  6 14:35:04 CST 2022] Installed to /root/.acme.sh/acme.sh
[Tue Dec  6 14:35:04 CST 2022] Installing alias to '/root/.bashrc'
[Tue Dec  6 14:35:04 CST 2022] OK, Close and reopen your terminal to start using acme.sh
[Tue Dec  6 14:35:04 CST 2022] Installing alias to '/root/.cshrc'
[Tue Dec  6 14:35:04 CST 2022] Installing alias to '/root/.tcshrc'
[Tue Dec  6 14:35:04 CST 2022] Installing cron job
no crontab for root
no crontab for root
[Tue Dec  6 14:35:04 CST 2022] Good, bash is found, so change the shebang to use bash as preferred.
[Tue Dec  6 14:35:05 CST 2022] OK
[Tue Dec  6 14:35:05 CST 2022] Install success!
[root@localhost ~]# acme.sh --issue -d *.dev.acadsoc.com  --dns dns_dp --server https://acme.freessl.cn/v2/DV90/directory/prplmhlees74erhlho6t
-bash: acme.sh: command not found
[root@localhost ~]# exit

生成证书

acme.sh --issue -d yourdomain.com  --dns dns_dp --server https://acme.freessl.cn/v2/DV90/directory/prplmhlees74erhlho6t

5、生成nginx证书

acme.sh --install-cert -d example.com \
--key-file       /etc/nginx/cert/key.pem  \
--fullchain-file /etc/nginx/cert/key/cert.pem \
--reloadcmd     "service nginx force-reload"

*/path/to/keyfile/in/nginx注意这个路径要真实存在

然后cd /path/to/keyfile/in/nginx 这个路径，可以把证书放在其它nginx项目使用

nginx https一般配置

	server {
			listen 443 ssl;
			#填写绑定证书的域名
			server_name yourdomain.com;
			#证书文件名称
			ssl_certificate  cert/cert.pem;
			#私钥文件名称
			ssl_certificate_key cert/key.pem;
			ssl_session_timeout 5m;
			ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
			ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
			ssl_prefer_server_ciphers on;
			location / {
					proxy_pass http://127.0.0.1:8080;
					index / ;
					proxy_set_header HOST $host;
					proxy_set_header X-Forwarded-Proto $scheme;
					proxy_set_header X-Real-IP $remote_addr;
					proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
					add_header 'Access-Control-Allow-Origin' '*';
					add_header 'Access-Control-Allow-Credentials' 'true';
			}
	}