python acme_使用 acme-tiny 工具生成 Let's Encrypt 的免费 SSL 证书

下载 acme-tiny

创建用户私钥和域名私钥 "创建用户私钥和域名私钥")创建用户私钥和域名私钥

mkdir -p /etc/ssl/letsencrypt/

cd /etc/ssl/letsencrypt/

openssl genrsa 4096 > account.key

openssl genrsa 4096 > domain.key

生成域名 csr 文件 "生成域名 csr 文件")生成域名 csr 文件

单域名

openssl req -new -sha256 -key domain.key -subj "/CN=www.yoursite.com" > domain.csr

多域名

ln -s /etc/pki/tls/openssl.cnf /etc/ssl/openssl.cnf

openssl req -new -sha256 -key domain.key -subj "/" -reqexts SAN -config domain.csr

配置 Web 站点的 challenge 文件 "配置 Web 站点的 challenge 文件")配置 Web 站点的 challenge 文件

mkdir -p /var/www/challenges/

#example for nginx

server {

listen 80;

server_name yoursite.com www.yoursite.com;

location /.well-known/acme-challenge/ {

alias /var/www/challenges/;

try_files $uri =404;

}

...the rest of your config

}

生成 signed 文件 "生成 signed 文件")生成 signed 文件

wget -c https://raw.githubusercontent.com/yangphere/acme-tiny/master/acme_tiny.py --no-check-certificate

python acme_tiny.py --account-key /etc/ssl/letsencrypt/account.key --csr /etc/ssl/letsencrypt/domain.csr --acme-dir /var/www/challenges/ > /etc/ssl/letsencrypt/signed.crt

生成证书链 "生成证书链")生成证书链

v1 版，兼容性差点

wget -O - https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem > /etc/ssl/letsencrypt/intermediate.pem

cat /etc/ssl/letsencrypt/signed.crt /etc/ssl/letsencrypt/intermediate.pem > /etc/ssl/letsencrypt/chained.pem

建议使用 v3 版

wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > /etc/ssl/letsencrypt/intermediate.pem

cat /etc/ssl/letsencrypt/signed.crt /etc/ssl/letsencrypt/intermediate.pem > /etc/ssl/letsencrypt/chained.pem

生成 dh 证书 "生成 dh 证书")生成 dh 证书

openssl dhparam -out dhparam.pem 2048

配置 nginx 使 SSL 证书生效 "配置 nginx 使 SSL 证书生效")配置 nginx 使 SSL 证书生效

server {

listen 443;

server_name yoursite.com, www.yoursite.com;

ssl on;

ssl_certificate /etc/ssl/letsencrypt/chained.pem;

ssl_certificate_key /etc/ssl/letsencrypt/domain.key;

ssl_session_timeout 5m;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;

ssl_session_cache shared:SSL:50m;

ssl_dhparam /etc/ssl/letsencrypt/dhparam.pem;

ssl_prefer_server_ciphers on;

...the rest of your config

}

server {

listen 80;

server_name yoursite.com, www.yoursite.com;

location /.well-known/acme-challenge/ {

alias /var/www/challenges/;

try_files $uri =404;

}

...the rest of your config

}

重启 nginx 服务 "重启 nginx 服务")重启 nginx 服务

service nginx reload

自动生成 SSL 证书 "自动生成 SSL 证书")自动生成 SSL 证书

由于 Let’s Encrypt 的证书只有 90 天的有效期，需要使用系统每个月生成一次。编辑 renew_cert.sh 文件

以下是 v1 版，兼容性差点

#!/usr/bin/shpython /etc/ssl/letsencrypt/acme_tiny.py --account-key /etc/ssl/letsencrypt/account.key --csr /etc/ssl/letsencrypt/domain.csr --acme-dir /var/www/challenges/ > /etc/ssl/letsencrypt/signed.crt || exit

wget -O - https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem > /etc/ssl/letsencrypt/intermediate.pem

cat /etc/ssl/letsencrypt/signed.crt /etc/ssl/letsencrypt/intermediate.pem > /etc/ssl/letsencrypt/chained.pem

service nginx reload

建议使用 v3 版

#!/usr/bin/shpython /etc/ssl/letsencrypt/acme_tiny.py --account-key /etc/ssl/letsencrypt/account.key --csr /etc/ssl/letsencrypt/domain.csr --acme-dir /var/www/challenges/ > /etc/ssl/letsencrypt/signed.crt || exit

wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > /etc/ssl/letsencrypt/intermediate.pem

cat /etc/ssl/letsencrypt/signed.crt /etc/ssl/letsencrypt/intermediate.pem > /etc/ssl/letsencrypt/chained.pem

service nginx reload

添加可执行权限

chmod +x renew_cert.sh

编辑 crontab 文件

crontab -e

加入如下内容

0 0 1 * * /etc/ssl/letsencrypt/renew_cert.sh 2>> /var/log/acme_tiny.log

重启 crontab 服务

service crond restart

测试一下 SSL 质量 "测试一下 SSL 质量")测试一下 SSL 质量