Let's-Encrypt生成免费ssl证书

任何人都可以基于 ACME 协议实现一个客户端，官方推荐的客户端是Certbot

# 启动nginx注意开放443端口
docker run -d --restart unless-stopped --name nginx -p 80:80 -p 1935:1935 -p 443:443 -v /data/.nginx/letsencrypt:/etc/letsencrypt  -v /data/.nginx/conf.d:/etc/nginx/conf.d -v /var/log/nginx:/var/log/nginx registry.cn-hangzhou.aliyuncs.com/985/nginx-1.16.0:rtmp

您看到时，该文档可能已经过时，最新的cloudflare客户端不支持免费域名使用API，需手工加入TXT记录

生成ssl证书

~/.secrets/certbot/cloudflare.ini

dns_cloudflare_email = xxxx
dns_cloudflare_api_key = xxxx

# 生成单个域名
sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini \
  --dns-cloudflare-propagation-seconds 60 \
  -d ngrok.spring-cloud.tk

# 通配符域名
sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini \
  --dns-cloudflare-propagation-seconds 60 \
  -d *.ngrok.spring-cloud.tk

生成证书后复制到相应的目录

sudo cp -R /etc/letsencrypt/ /data/.nginx/letsencrypt

ngrok.conf

server {
    listen 443 ssl;
    server_name ngrok.spring-cloud.tk;

    ssl_certificate   /etc/letsencrypt/live/ngrok.spring-cloud.tk/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/ngrok.spring-cloud.tk/privkey.pem;

    ssl_session_timeout 5m;

    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    client_max_body_size 50m;
    location / {
        root   html;
        index  index.html index.htm;
    }
}

server {
    listen       80;
    server_name  ngrok.spring-cloud.tk;

    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        root   html;
        index  index.html index.htm;
    }
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
}

ngrok通配符域名

注意ssl的proxy_pass指向到宿主机的8080端口

server {
    listen 443 ssl;
    server_name *.ngrok.spring-cloud.tk;

    ssl_certificate   /etc/letsencrypt/live/ngrok.spring-cloud.tk-0001/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/ngrok.spring-cloud.tk-0001/privkey.pem;

    ssl_session_timeout 5m;

    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://172.31.35.66:8080;
   }
   access_log off;
   log_not_found off;
}

server {
    listen       80;
    server_name  *.ngrok.spring-cloud.tk;

    #charset koi8-r;

    location / {
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://172.31.35.66:8080;
   }
   access_log off;
   log_not_found off;
}

参考文献

https://certbot-dns-cloudflare.readthedocs.io/en/stable/

赏

谢谢你请我吃糖果

支付宝

微信