One

主题

B

2、实战-使用Certbot签发免费ssl泛域名证书-20250302(成功测试) ​

image-20250302103639033

实战-使用Certbot签发免费ssl泛域名证书-20250302(成功测试) ​

目录 ​

[toc]

版权 ​

本着开源共享、共同学习的精神：

本文是在 博主Ruyu文章：《Ruyu-Blog 博客升级HTTPS》https:ecs服务器（得拥有1台云服务器）拥有一个自己域名（已经完成备案）注册一个阿里云账号

不涉及。

1、安装 Certbot ​

bash
yuminstallepel-release-yyuminstallsnapd-ysystemctlenable--nowsnapd.socketln-s/var/lib/snapd/snap/snapsnapinstall--classiccertbotln-s/snap/bin/certbot/usr/bin/certbot

2、手动申请https证书 ​

(手动添加dns记录方式)

bash
#作者命令certbot-d域名(可以使用*.代表所有二级域名) --manual--config-dirconfig--work-dirwork--logs-dirlogs--preferred-challengesdnscertonly#自己命令（使用这个命令即可），这里直接申请泛域名证书就好certbot-donedayxyy.cn-d*.onedayxyy.cn--manual--config-dirconfig--work-dirwork--logs-dirlogs--preferred-challengesdnscertonly2675263825@qq.com

后续根据提示进行邮箱填写、DNS的TXT记录验证、等等……

然后会得到两个关键文件，注意看提示信息的路径。

image-20240803062653952

这里稍微记录下一些细节：

到域名解析上那里添加解析验证记录：（验证同意后，这个记录值建议删除）

image-20240804092124050

image-20250301192726475

image-20250301231426685

image-20250303073612532

bash
Certificateissavedat:/root/config/live/onedayxyy.cn/fullchain.pemKeyissavedat:/root/config/live/onedayxyy.cn/privkey.pem[root@blog nginx]# ls -l /root/config/live/onedayxyy.cn/total4lrwxrwxrwx1rootroot36Mar307:34cert.pem->../../archive/onedayxyy.cn/cert1.pemlrwxrwxrwx1rootroot37Mar307:34chain.pem->../../archive/onedayxyy.cn/chain1.pemlrwxrwxrwx1rootroot41Mar307:34fullchain.pem->../../archive/onedayxyy.cn/fullchain1.pemlrwxrwxrwx1rootroot39Mar307:34privkey.pem->../../archive/onedayxyy.cn/privkey1.pem-rw-r--r--1rootroot692Mar307:34README[root@blog nginx]#

以上生成好证书。

3、配置https到网站 ​

使用生成的https证书配置到nginx和cdn里。(切记，每个cdn下如果使用了https都要配置证书的哦！！！)

1.nginx配置https证书 ​

cat /etc/nginx/nginx.conf（不做变动，仅仅查看）

bash
userroot;worker_processesauto;error_log/var/log/nginx/error.log;pid/run/nginx.pid;# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.include/usr/share/nginx/modules/*.conf;events{worker_connections1024;}http{gzipon;# 启用 gzip 压缩gzip_varyon;# 根据请求中的 `Accept-Encoding` 响应头决定是否启用 gzipgzip_proxiedany;# 在所有代理请求中启用压缩gzip_typestext/plaintext/cssapplication/jsonapplication/javascripttext/xmlapplication/xmlapplication/xml+rsstext/javascript;# 指定哪些类型的响应需要压缩gzip_comp_level5;# 压缩等级（范围是 1-9，高级别意味着更好的压缩但会消耗更多 CPU 资源）gzip_min_length256;# 只对超过给定长度的响应启用压缩log_formatmain'$remote_addr - $remote_user [$time_local] "$request"''$status $body_bytes_sent "$http_referer"''"$http_user_agent""$http_x_forwarded_for"';access_log/var/log/nginx/access.logmain;sendfileon;tcp_nopushon;tcp_nodelayon;keepalive_timeout65;types_hash_max_size4096;include/etc/nginx/mime.types;default_typeapplication/octet-stream;# Load modular configuration files from the /etc/nginx/conf.d directory.# See http:# for more information.include/etc/nginx/conf.d/*.conf;charsetutf-8;# Settings for a TLS enabled server.}
  • 主域名配置文件：vim /etc/nginx/conf.d/onedayxyy.cn.conf
bash
[root@blog certs]# cat /etc/nginx/conf.d/onedayxyy.cn.conf server{listen80;server_nameonedayxyy.cnwww.onedayxyy.cn;#配置https重定向return301https:}server{listen443ssl;server_nameonedayxyy.cnwww.onedayxyy.cn;root/root/rsync/rsync-vue/dist;location/{indexindex.htmlindex.htm;} location/images{alias/images;indexindex.html;valid_referersnoneblocked*.onedayxyy.cnonedayxyy.cn*.gitee.comgitee.comlocalhost127.0.0.1;if($invalid_referer ) {# 如不满足，指定访问如下资源rewrite^/https:return403;}}location/home{alias/root/home3.0/;indexindex.htmlindex.htm;}location/wiki{alias/root/rsync/rsync-docusaurus/build;indexindex.htmlindex.htm;}location/newyear{alias/root/rsync/rsync-qianduan-demo/qianduan-demo/newyear;indexindex.htmlindex.htm;}location/error{autoindexon;# 启用目录索引alias/FdangDaoLianImages;indexindex.html;# 默认显示index.html文件，如果没有则列出目录内容} ssl_certificate/root/config/live/onedayxyy.cn/fullchain.pem;ssl_certificate_key/root/config/live/onedayxyy.cn/privkey.pem;ssl_session_timeout5m;ssl_protocolsTLSv1.1TLSv1.2TLSv1.3;ssl_ciphersEECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;ssl_prefer_server_cipherson;add_headerStrict-Transport-Security"max-age=31536000";access_log/var/log/nginx/onedayxyy.cn.https.log;}
  • wiki配置文件：vim /etc/nginx/conf.d/wiki.onedayxyy.cn.conf
bash
[root@blog certs]# cat /etc/nginx/conf.d/wiki.onedayxyy.cn.confserver{listen80;server_namewiki.onedayxyy.cn;#配置https重定向return301https:}server{listen443ssl;server_namewiki.onedayxyy.cn;root/root/rsync/rsync-vitepress/dist;location/{indexindex.htmlindex.htm;} location/images{alias/images;indexindex.html;valid_referersnoneblocked*.onedayxyy.cnonedayxyy.cn*.gitee.comgitee.comlocalhost127.0.0.1;if($invalid_referer ) {# 如不满足，指定访问如下资源rewrite^/https:return403;}}location/home{alias/root/home3.0/;indexindex.htmlindex.htm;}location/wiki{alias/root/rsync/rsync-docusaurus/build;indexindex.htmlindex.htm;}location/newyear{alias/root/rsync/rsync-qianduan-demo/qianduan-demo/newyear;indexindex.htmlindex.htm;}location/error{autoindexon;# 启用目录索引alias/FdangDaoLianImages;indexindex.html;# 默认显示index.html文件，如果没有则列出目录内容} ssl_certificate/root/config/live/onedayxyy.cn/fullchain.pem;ssl_certificate_key/root/config/live/onedayxyy.cn/privkey.pem;ssl_session_timeout5m;ssl_protocolsTLSv1.1TLSv1.2TLSv1.3;ssl_ciphersEECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;ssl_prefer_server_cipherson;add_headerStrict-Transport-Security"max-age=31536000";access_log/var/log/nginx/wiki.onedayxyy.cn.https.log;}
  • 重启nginx

nginx -s reload

2.cdn配置https证书 ​

特别注意：

申请的这个https证书也要同时配置到自己的cdn对应域名的https那里（复制公钥和私钥到阿里云账号cdn），否则网站https是不生效的。

image-20250302102623039

image-20250302102637845

image-20250302102712776

image-20250302102726590

其它域名一样的配置。

看下自己域名解析：

image-20250302103058420

4、验证 ​

完美。😃

https:t="1711730357270" class="icon" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" p-id="4392" width="16" height="16" >打赏支持