使用certbot为网站启用https

1. 安装certbot客户端

cd /usr/local/bin
wget https://dl.eff.org/certbot-auto
chmod a+x ./certbot-auto

2. 创建目录和配置nginx用于验证域名 

    mkdir -p /data/www/letsencrypt

    server {
        listen 80;
        server_name ~^(?<subdomain>.+).ninvfeng.com;

        location /.well-known/ {
            root /data/www/letsencrypt;
            allow all;
        }

        location / {
            return 301 https://$subdomain.ninvfeng.com$request_uri;
        }
    }

3. 生成证书

certbot-auto certonly --webroot -w /data/www/letsencrypt -d jianli.ninvfeng.com

 4. 配置nginx https

server {
    listen       443;
    server_name  jianli.ninvfeng.com;

    root /data/www/jianli;

    location / {
        index index.php index.html;
    }

    location ~ \.php$ {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    if (!-e $request_filename) {
        rewrite ^/(.*) /index.php?$1 last;
    }
    

    ssl on;
    ssl_certificate /etc/letsencrypt/live/jianli.ninvfeng.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/jianli.ninvfeng.com/privkey.pem;

    ssl_session_timeout  5m;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers   on;
}

该方法生成的证书有效期为90天, 在到期前我们需要执行以下命令更新证书

certbot-auto renew

0 0 1 * * certbot-auto renew  --quiet --renew-hook "nginx -s reload"