一、安装acme.sh(Let's Encrypt 客户端)
github:https://github.com/Neilpang/acme.sh
wget -O - https://get.acme.sh | sh
安装完成后,会自动增加任务用于证书的自动更新
注意:使用acme.sh不必在root下操作,但建议在root下操作
二、手工申请证书:
注:这种方法一般适用于DNS供应商不提供API的场景,且必须带有参数--yes-I-know-dns-manual-mode-enough-go-ahead-please,且不能自动续期
1、首先配置好要申请证书的域名,例如:*.myimportantdomain.com,一般为10分钟:
acme.sh --issue --dns -d \
*.myimportantdomain.com \
--yes-I-know-dns-manual-mode-enough-go-ahead-please
2、根据提示(会以绿色文字显示)在DNS中创建所申请域名的对应的TXT记录,并等待DNS记录生效,一般为10分钟:
Add the following TXT record:
Domain: '_acme-challenge.myimportantdomain.com'
TXT value: '123pXF6fDUM88pg14kY123D3AUc5Cd_YVYZ5znpnC38'
Please be aware that you prepend _acme-challenge. before your domain
so the resulting subdomain will be: _acme-challenge..myimportantdomain.com
Please add the TXT records to the domains, and re-run with --renew.
Please add '--debug' or '--log' to check more details.
See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh
3、等待DNS解析生效后,执行以下命令
acme.sh --renew --dns \
-d *.myimportantdomain.com
--yes-I-know-dns-manual-mode-enough-go-ahead-please
4、申请成功,会提示证书文件存放位置:
Your cert is in /root/.acme.sh/*.myimportantdomain.com/*.myimportantdomain.com.cer
Your cert key is in /root/.acme.sh/*.myimportantdomain.com/*.myimportantdomain.com.key
v2 chain.
The intermediate CA cert is in /root/.acme.sh/*.myimportantdomain.com/ca.cer
And the full chain certs is there: /root/.acme.sh/*.myimportantdomain.com/fullchain.cer
_on_issue_success
三、安装证书:
acme.sh --install-cert -d *.myimportantdomain.com \
--key-file /usr/local/nginx/conf/*.myimportantdomain.com.key \
--fullchain-file /usr/local/nginx/conf/*.myimportantdomain.com \
--reloadCmd "nginx -s restart"