如何向Let‘s Encrypt申请免费证书

安装certbot

官方推荐snap安装方式，作为centos8系统，需要手动安装snap再安装certbot

 dnf install epel-release
yum install snapd
systemctl enable --now snapd.socket
ln -s /var/lib/snapd/snap /snap
exit
#需要退出，然后重新ssh，最好就是重启一下系统
sudo snap install core; sudo snap refresh core
yum remove certbot
snap install --classic certbot
ln -s /snap/bin/certbot /usr/bin/certbot

至此，certbot安装完毕！！

certbot申请证书

#只申请证书，不更改nginx文件
$ certbot certonly --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): xxxxx@xxxxx.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.

Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: bot.abc.com
2: bot2.abc.com
3: bot3.abc.com
4: nexus.abc.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 4
Requesting a certificate for nexus.abc.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/nexus.abc.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/nexus.abc.com/privkey.pem
This certificate expires on 2021-09-16.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#这个测试一下自动更新证书是否正常
$ certbot renew --dry-run

### 证书如何自动更新的，全靠这个renew服务
$ systemctl list-units --all --type=service --no-pager | grep certbo
  snap.certbot.renew.service             loaded    inactive dead    Service for snap application certbot.renew