Traefik - 自动签发Let‘s Encrypt 免费ssl证书

---

环境信息

• 操作系统：CentOS 7.9
• Traefik版本：2.10.3
• Traefik安装目录：/usr/local/traefik

Traefik配置修改

静态配置

# 添加或修改 traefik静态配置文件 certificatesResolvers 部分内容
cat /usr/local/traefik/traefik.yaml
entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
    http:
      tls:
        # 通过 路由部分的host自动生成证书(Let's Encrypt)
        certResolver: leresolver
        ## foobar为自定义的一堆tls选项设置的集合的别名
        #options: foobar
        # example.com 替换成你自己的域名
        domains:
          - main: "example.com"
            sans:
            - "*.example.com"

certificatesResolvers:
    leresolver:
      acme:
        email: <通知邮箱>
        storage: acme.json
        dnsChallenge:
          provider: "cloudflare"
          delayBeforeCheck: 10

动态配置

# 添加或修改 traefik静态配置文件 http.routers.entryPoints部分内容
# 添加或修改 traefik静态配置文件 http.routers.tls部分内容(可选)
# example.com替换成自己的域名
$ cat /usr/local/traefik/conf.d/provider.yaml
http:
  routers:
    lm-demo:
      entryPoints:
        - "web"
        - "websecure"
      ## 只给单个路由匹配的域名生成tls证书时只在路由处开启tls配置即可
      #tls:
      #  certResolver: leresolver
      #  domains:
      #    - main: "example.com"
      #      sans:
      #      - "*.example.com"
      rule: "HostRegexp(`{subdomain:[a-z-_]*}.example.com`) && PathPrefix(`/demo`)"
      service: http-lm-demo
      
  services:
    http-lm-demo:
      loadBalancer:
        #healthCheck:
        #  path: /
        #  interval: "60s"
        #  timeout: "3s"
        servers:
          - url: http://127.0.0.1:8000

环境变量

# 配置域名所在dns解析平台所需账号凭据， 示例中是cloudflare平台
$ cat /usr/local/traefik/acme.env 
CF_API_EMAIL="xxx"		# Cloudflare 邮箱
CF_API_KEY="xxx"	# Cloudflare api key

systemd配置

$ cat /etc/systemd/system/traefik.service 
...

[Service]
EnvironmentFile=/usr/local/traefik/acme.env

...

# 重启traefik
$ systemctl daemon-reload
$ systemctl restart traefik.service

验证

• 查看日志

# 查看安装目录下是否生成acme.json， 并且内容是否已有 Certificates 部分内容， 为null则还未成功
$ grep -A 3 'Certificates' /usr/local/traefik/acme.json

• 浏览器访问: https://www.example.com/demo
  

• 签发失败的情况

# 如果签发失败可以查看运行日志
$ tail -n 50 /data/logs/traefik/traefik.log