Nginx免費SSL證明書自動設定
阿新 • • 發佈：2021-06-20
- 按照自動設定工具
$ apt-get update
$ sudo apt-get install certbot
$ apt-get install python3-certbot-nginx
- 配置Nginx
/etc/nginx/conf.d
server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www/html;
server_name example.com www.example.com;
}
- 更新配置
nginx -t && nginx -s reload
- 自動生成SSL並配置
$ sudo certbot --nginx -d example.com -d www.example.com
- 出現下面訊息代表配置成功
Congratulations! You have successfully enabled https://example.com and https://www.example.com ------------------------------------------------------------------------------------- IMPORTANT NOTES: Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/example.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/example.com//privkey.pem Your cert will expire on 2017-12-12.
- 檢視更新後的配置檔案
server { listen 80 default_server; listen [::]:80 default_server; root /var/www/html; server_name example.com www.example.com; listen 443 ssl; # managed by Certbot # RSA certificate ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot # Redirect non-https traffic to https if ($scheme != "https") { return 301 https://$host$request_uri; } # managed by Certbot }
- 到期自動更新設定
每天0點check是不是剩下30天期限，然後更新
crontab -e
0 12 * * * /usr/bin/certbot renew --quiet