centos 下安装 Let’s Encrypt 永久免费 SSL 证书

lets encrypt github地址为：https://github.com/certbot/certbot

1.

git clone https://github.com/letsencrypt/letsencrypt
cd letsencrypt
chmod +x letsencrypt-auto

 

./letsencrypt-auto certonly  --email 2358269014@qq.com -d fecshop.appfront.fancyecommerce.com -d fecshop.appfront.es.fancyecommerce.com

-d参数后面对应的是域名，在执行的过程中，我遭遇了下面的报错：

Total size: 44 M
Downloading Packages:
Running rpm_check_debug
ERROR with rpm_check_debug vs depsolve:
libgdbm.so.2()(64bit) is needed by python-libs-2.6.6-66.el6_8.x86_64
** Found 7 pre-existing rpmdb problem(s), 'yum check' output follows:
4:perl-5.10.1-141.el6_7.1.x86_64 has missing requires of libgdbm.so.2()(64bit)
4:perl-devel-5.10.1-141.el6_7.1.x86_64 has missing requires of gdbm-devel
polkit-0.96-5.el6_4.x86_64 has missing requires of libeggdbus-1.so.0()(64bit)
2:postfix-2.6.6-6.el6_5.x86_64 has missing requires of libmysqlclient.so.16()(64bit)
2:postfix-2.6.6-6.el6_5.x86_64 has missing requires of libmysqlclient.so.16(libmysqlclient_16)(64bit)
2:postfix-2.6.6-6.el6_5.x86_64 has missing requires of mysql-libs
python-libs-2.6.6-52.el6.x86_64 has missing requires of libgdbm.so.2()(64bit)
Your transaction was saved, rerun it with: yum load-transaction /tmp/yum_save_tx-2017-04-07-22-1798AqLE.yumtx
Could not install OS dependencies. Aborting bootstrap!

centos 6 需要安装 libgdbm.so.2

wget http://mirror.centos.org/centos/6/os/x86_64/Packages/gdbm-1.8.0-39.el6.x86_64.rpm
yum localinstall gdbm-1.8.0-39.el6.x86_64.rpm

完成后，重新执行上面的命令行：

./letsencrypt-auto certonly --standalone  --email 2358269014@qq.com -d fecshop.appfront.fancyecommerce.com -d fecshop.appfront.es.fancyecommerce.com -d img.appfront.fancyecommerce.com -d img.apphtml5.fancyecommerce.com -d img.fancyecommerce.com

 

下面的安装就比较顺利了，下面是我的log

[root@iZ942k2d5ezZ certbot-master]# ./letsencrypt-auto certonly   --email 2358269014@qq.com -d fecshop.appfront.fancyecommerce.com -d fecshop.appfront.es.fancyecommerce.com
/root/.local/share/letsencrypt/lib/python2.6/site-packages/cryptography/__init__.py:26: DeprecationWarning: Python 2.6 is no longer supported by the Python core team, please upgrade your Python. A future version of cryptography will drop support for Python 2.6
  DeprecationWarning
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Failed to find executable apachectl in PATH: /usr/local/mysql/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin

How would you like to authenticate with the ACME CA?
-------------------------------------------------------------------------------
1: Place files in webroot directory (webroot)
2: Spin up a temporary webserver (standalone)
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for fecshop.appfront.fancyecommerce.com
tls-sni-01 challenge for fecshop.appfront.es.fancyecommerce.com

-------------------------------------------------------------------------------
Could not bind TCP port 443 because it is already in use by another process on
this system (such as a web server). Please stop the program in question and then
try again.
-------------------------------------------------------------------------------
(R)etry/(C)ancel: R

-------------------------------------------------------------------------------
Could not bind TCP port 443 because it is already in use by another process on
this system (such as a web server). Please stop the program in question and then
try again.
-------------------------------------------------------------------------------
(R)etry/(C)ancel: R
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/0000_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pem

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/fullchain.pem.
   Your cert will expire on 2017-07-06. To obtain a new or tweaked
   version of this certificate in the future, simply run
   letsencrypt-auto again. To non-interactively renew *all* of your
   certificates, run "letsencrypt-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

[root@iZ942k2d5ezZ certbot-master]# ls

在nginx中添加代码：

listen 443 ssl;
        ssl on;
        ssl_certificate /etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/privkey.pem;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

注意上面的文件路径 ，将 fecshop.appfront.fancyecommerce.com 替换成您的文件路径。因为不同的域名生成的文件名字不同，

nginx填写完的代码如下：

server {
        listen     80  ;
        listen 443 ssl;
        ssl on;
        ssl_certificate /etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/privkey.pem;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
server_name fecshop.appfront.fancyecommerce.com fecshop.appfront.es.fancyecommerce.com;
    root  /www/web/develop/fecshop/appfront/web;
        server_tokens off;
    include none.conf;
    index index.php index.html index.htm;
    access_log /www/web_logs/access.log wwwlogs;
    error_log  /www/web_logs/error.log  notice;
    location ~ \.php$ {
                        fastcgi_pass   127.0.0.1:9000;
                        fastcgi_index  index.php;
                        include fcgi.conf;
        }

        location ~ /sitemap.xml
        {
                if ($host  ~ .*appfront.es.fancyecommerce.com) {
                        rewrite ^/sitemap\.xml /sitemap_es.xml last;
                }
        }

         location /fr/ {
                index index.php;
                if (!-e $request_filename){
                        rewrite . /fr/index.php last;
                  }
        }
         location /es/ {
                index index.php;
                if (!-e $request_filename){
                        rewrite . /es/index.php last;
                }
        }

         location /cn/ {
                index index.php;
                if (!-e $request_filename){
                        rewrite . /cn/index.php last;
                }
        }

         location /de/ {
                index index.php;
                if (!-e $request_filename){
                        rewrite . /de/index.php last;
                }
        }

        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ {
                expires      30d;
        }

        location ~ .*\.(js|css)?$ {
                expires      12h;
        }
        location /api {
                rewrite /api/([a-z][0-9a-z_]+)/?$ /api.php?type=$1;
        }


}

 

重启nginx，就可以访问https了

2自动续签

lets encrypt证书有三个月的到期时间。可以自动renew，步骤如下：

官方资料：https://certbot.eff.org/docs/using.html?highlight=renew#renewing-certificates

改写到期更新时间

vim /etc/letsencrypt/renewal/fecshop.appfront.fancyecommerce.com.conf

fecshop.appfront.fancyecommerce.com.conf是您生成的名字，这个根据您自己域名，不是我的这个名字，打开这个文件,
将第一行的注释去掉，修改为89days

renew_before_expiry = 89 days
version = 0.13.0

89days代表，多少天之前算过期，证书过期时间为90天，如果我设置了89，那么第二天就需要renew了，
如果您设置了30天，那么就是2个月后需要renew，如果时间没到，renew会提示失败。

改好文件后，进入letsencrypt 文件夹，执行

./certbot-auto renew   --force-renewal   --pre-hook "/etc/init.d/nginx stop" --post-hook "/etc/init.d/nginx start"

`–force-renewal`: 代表强制renew
`–pre-hook`: 是nginx关闭的命令，因为renew需要关闭nginx
`–post-hook`: 是nginx开启的命令，搞完证书后，开启nginx

自动续签可以使用crontab来完成，在linux中执行  crontab -e
添加代码：(www/web_logs/letsencry.log 为日志文件，您需要新建这个文件并设置可写)

06 06 * * * /www/web/test/lets/certbot-master/certbot-auto renew   --force-renewal   --pre-hook "/etc/init.d/nginx stop" --post-hook "/etc/init.d/nginx start" >> /www/web_logs/letsencry.log 2>&1

下面是我的日志：

[root@iZ942k2d5ezZ certbot-master]# ./certbot-auto renew   --force-renewal   --pre-hook "/etc/init.d/nginx stop" --post-hook "/etc/init.d/nginx start"


/root/.local/share/letsencrypt/lib/python2.6/site-packages/cryptography/__init__.py:26: DeprecationWarning: Python 2.6 is no longer supported by the Python core team, please upgrade your Python. A future version of cryptography will drop support for Python 2.6
  DeprecationWarning
Saving debug log to /var/log/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/fecshop.appfront.fancyecommerce.com.conf
-------------------------------------------------------------------------------
Running pre-hook command: /etc/init.d/nginx stop
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for fecshop.appfront.fancyecommerce.com
tls-sni-01 challenge for fecshop.appfront.es.fancyecommerce.com
tls-sni-01 challenge for img.appfront.fancyecommerce.com
tls-sni-01 challenge for img.apphtml5.fancyecommerce.com
tls-sni-01 challenge for img.fancyecommerce.com
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/0003_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0003_csr-certbot.pem

-------------------------------------------------------------------------------
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/fullchain.pem
-------------------------------------------------------------------------------

Congratulations, all renewals succeeded. The following certs have been renewed:
  /etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/fullchain.pem (success)
Running post-hook command: /etc/init.d/nginx start
[root@iZ942k2d5ezZ certbot-master]#

 

3.开启http2

可以更快的加载https，关于http2的资料为：http://www.jianshu.com/p/47d02f10757f

nginx安装的时候需要添加：

./configure   --with-http_v2_module

然后在nginx的ssl配置将listen 443 ssl ;改为：

listen 443 ssl http2;

这样就开启http2了，http2可以更快的加载。

http2的资料：

http://www.infoq.com/cn/news/2015/02/https-spdy-http2-comparison/

4.强制使用https，http访问进行跳转

server {
           listen       80;
           server_name  fecshop.appfront.fancyecommerce.com fecshop.appfront.es.fancyecommerce.com;
           rewrite ^(.*)$ https://$host$1 permanent;

}

 

其他参考地址：https://www.v2ex.com/t/310130