https://certbot.eff.org/lets-encrypt/centosrhel8-nginx.html

https://blog.51cto.com/wzlinux/2385116

網上很多文章寫了各種方法，官網上有解釋，

其實各種方式都可以。Snap、certbot-auto、redhat下面（sudo dnf install）都可以。選一個即可。具體區別可以看下面的的英文。

我在這邊參考 https://blog.51cto.com/wzlinux/2385116出現無法獲取python2-certbot-nginx的問題。換到Snap來安裝。還是看官網的介紹來把。比較順利一點。

https://certbot.eff.org/lets-encrypt/centosrhel8-nginx.html

Alternate installation methods

If you are offline or your operating system doesn’t provide a package, you can use an alternate method for installingcertbot.

Snap

Most modern Linux distributions (basically any that use systemd) can install Certbot packaged as a snap. Snaps are available for x86_64, ARMv7 and ARMv8 architectures. The Certbot snap provides an easy way to ensure you have the latest version of Certbot with features like automated certificate renewal preconfigured.

You can find instructions for installing the Certbot snap athttps://certbot.eff.org/instructionsby selecting your server software and then choosing “snapd” in the “System” dropdown menu. (You should select “snapd” regardless of your operating system, as our instructions are the same across all systems.)

Certbot-Auto

Thecertbot-autowrapper script installs Certbot, obtaining some dependencies from your web server OS and putting others in a python virtual environment. You can download and run it as follows:

wget https://dl.eff.org/certbot-auto
sudo mv certbot-auto /usr/local/bin/certbot-auto
sudo chown root /usr/local/bin/certbot-auto
sudo chmod 0755 /usr/local/bin/certbot-auto
/usr/local/bin/certbot-auto --help

To remove certbot-auto, just delete it and the files it places under /opt/eff.org, along with any cronjob or systemd timer you may have created.

To check the integrity of thecertbot-autoscript, you can use these steps:

user@webserver:~$ wget -N https://dl.eff.org/certbot-auto.asc
user@webserver:~$ gpg2 --keyserver pool.sks-keyservers.net --recv-key A2CFB51FA275A7286234E7B24D17C995CD9775F2
user@webserver:~$ gpg2 --trusted-key 4D17C995CD9775F2 --verify certbot-auto.asc /usr/local/bin/certbot-auto

The output of the last command should look something like:

gpg: Signature made Wed 02 May 2018 05:29:12 AM IST
gpg:                using RSA key A2CFB51FA275A7286234E7B24D17C995CD9775F2
gpg: key 4D17C995CD9775F2 marked as ultimately trusted
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   2  signed:   2  trust: 0-, 0q, 0n, 0m, 0f, 2u
gpg: depth: 1  valid:   2  signed:   0  trust: 2-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2027-11-22
gpg: Good signature from "Let's Encrypt Client Team <[email protected]>" [ultimate]

Thecertbot-autocommand updates to the latest client release automatically. Sincecertbot-autois a wrapper tocertbot, it accepts exactly the same command line flags and arguments. For more information, seeCertbot command-line options.

For full command line help, you can type:

/usr/local/bin/certbot-auto --help all

Problems with Python virtual environment

On a low memory system such as VPS with less than 512MB of RAM, the required dependencies of Certbot will fail to build. This can be identified if the pip outputs contains something likeinternalcompilererror:Killed(programcc1). You can workaround this restriction by creating a temporary swapfile:

user@webserver:~$ sudo fallocate -l 1G /tmp/swapfile
user@webserver:~$ sudo chmod 600 /tmp/swapfile
user@webserver:~$ sudo mkswap /tmp/swapfile
user@webserver:~$ sudo swapon /tmp/swapfile

Disable and remove the swapfile once the virtual environment is constructed:

user@webserver:~$ sudo swapoff /tmp/swapfile
user@webserver:~$ sudo rm /tmp/swapfile

Running with Docker

Dockeris an amazingly simple and quick way to obtain a certificate. However, this mode of operation is unable to install certificates or configure your webserver, because our installer plugins cannot reach your webserver from inside the Docker container.

Most users should use the instructions atcertbot.eff.org. You should only use Docker if you are sure you know what you are doing and have a good reason to do so.

You should definitely read theWhere are my certificates?section, in order to know how to manage the certs manually.Our ciphersuites pageprovides some information about recommended ciphersuites. If none of these make much sense to you, you should definitely use the installation method recommended for your system atcertbot.eff.org, which enables you to use installer plugins that cover both of those hard topics.

If you’re still not convinced and have decided to use this method, from the server that the domain you’re requesting a certficate for resolves to,install Docker, then issue a command like the one found below. If you are using Certbot with theStandaloneplugin, you will need to make the port it uses accessible from outside of the container by including something like-p80:80or-p443:443on the command line beforecertbot/certbot.

sudo docker run -it --rm --name certbot \
            -v "/etc/letsencrypt:/etc/letsencrypt" \
            -v "/var/lib/letsencrypt:/var/lib/letsencrypt" \
            certbot/certbot certonly

Running Certbot with thecertonlycommand will obtain a certificate and place it in the directory/etc/letsencrypt/liveon your system. Because Certonly cannot install the certificate from within Docker, you must install the certificate manually according to the procedure recommended by the provider of your webserver.

There are also Docker images for each of Certbot’s DNS plugins available athttps://hub.docker.com/u/certbotwhich automate doing domain validation over DNS for popular providers. To use one, just replacecertbot/certbotin the command above with the name of the image you want to use. For example, to use Certbot’s plugin for Amazon Route 53, you’d usecertbot/dns-route53. You may also need to add flags to Certbot and/or mount additional directories to provide access to your DNS API credentials as specified in theDNS plugin documentation.

For more information about the layout of the/etc/letsencryptdirectory, seeWhere are my certificates?.

Operating System Packages

Arch Linux

sudo pacman -S certbot

Debian

If you run Debian Buster or Debian testing/Sid, you can easily install certbot packages through commands like:

sudo apt-get update
sudo apt-get install certbot

If you run Debian Stretch, we recommend you use the packages in Debian backports repository. First you’ll have to follow the instructions athttps://backports.debian.org/Instructions/to enable the Stretch backports repo, if you have not already done so. Then run:

sudo apt-get install certbot -t stretch-backports

In all of these cases, there also packages available to help Certbot integrate with Apache, nginx, or various DNS services. If you are using Apache or nginx, we strongly recommend that you install thepython-certbot-apacheorpython-certbot-nginxpackage so that Certbot can fully automate HTTPS configuration for your server. A full list of these packages can be found through a command like:

apt search 'python-certbot*'

They can be installed by running the same installation command above but replacingcertbotwith the name of the desired package.

Ubuntu

If you run Ubuntu, certbot can be installed using:

sudo apt-get install certbot

Optionally to install the Certbot Apache plugin, you can use:

sudo apt-get install python-certbot-apache

Fedora

sudo dnf install certbot python2-certbot-apache

FreeBSD

• Port:cd/usr/ports/security/py-certbot&&makeinstallclean
• Package:pkginstallpy27-certbot

Gentoo

The official Certbot client is available in Gentoo Portage. From the official Certbot plugins, three of them are also available in Portage. They need to be installed separately if you require their functionality.

emerge -av app-crypt/certbot
emerge -av app-crypt/certbot-apache
emerge -av app-crypt/certbot-nginx
emerge -av app-crypt/certbot-dns-nsone

Note

Theapp-crypt/certbot-dns-nsonepackage has a different maintainer than the other packages and can lag behind in version.

NetBSD

• Build from source:cd/usr/pkgsrc/security/py-certbot&&makeinstallclean
• Install pre-compiled package:pkg_addpy27-certbot

OpenBSD

• Port:cd/usr/ports/security/letsencrypt/client&&makeinstallclean
• Package:pkg_addletsencrypt

Other Operating Systems

OS packaging is an ongoing effort. If you’d like to package Certbot for your distribution of choice please have a look at thePackaging Guide.