Let's-Encrypt acme.sh dnspod 生成免费ssl证书

2020-10-20 更新：2020-10-20

本教程基于Ubuntu 18.04.4 LTS

通过docker启动nginx服务

# 启动nginx注意开放443端口
docker run -d --restart unless-stopped \ 
--name nginx-server \
-p 80:80 -p 443:443 \
--network ngrok --ip 10.10.0.80 \
-v /data/.nginx/conf.d:/etc/nginx/conf.d \
-v /data/.nginx/letsencrypt:/etc/letsencrypt \
-v /var/log/nginx:/var/log/nginx \
nginx-server:1.16.0

acme.sh 申请Let’s-Encrypt SSL

使用acme.sh生成SSL证书

安装

1	$ curl https://get.acme.sh \| sh

DNS mode 申请证书

Automatic DNS API integration

Cloudflare Option: 免费域名不支持API访问，我放弃了

Currently Cloudflare doesn’t allow API access in free tld domain. You will get the Txt records insert failed. Make sure to verify your api token before editing dns_cf, you can alternatively use DNS manual mode if you are using free tld on cloudflare.

DNSPod.cn Option:

设置环境变量

1 2	export DP_Id="1234" export DP_Key="sADDsdasdgdsf"

Ok, let’s issue a cert now:

1	./acme.sh --issue --dns dns_dp -d ngrok.spring-cloud.tk

申请成功如下图:

通配符域名

1	./acme.sh --issue --dns dns_dp -d *.ngrok.spring-cloud.tk

ngrok.spring-cloud.tk.key (private.key)
fullchain.cer

复制证书到nginx下面

1	sudo cp -R /etc/letsencrypt/ /data/.nginx/letsencrypt

ngrok.spring-cloud.tk.conf 配置文件

ngrok通配符域名

注意ssl的proxy_pass指向到指定主机的80端口

server {
    listen       80;
    server_name  *.ngrok.spring-cloud.tk;

    #charset koi8-r;
    access_log  /var/log/nginx/ngrok.access.log  main;
    error_log  /var/log/nginx/ngrok.error.log  error;

    location / {
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       # proxy_pass http://172.31.46.195:8801;
        proxy_pass http://10.10.0.100:80;
   }
   access_log off;
   log_not_found off;

   error_page   500 502 503 504  /50x.html;
   location = /50x.html {
       root   /usr/share/nginx/html;
   }
}

server {
    listen 443 ssl;
    server_name *.ngrok.spring-cloud.tk;

    ssl_certificate   /etc/letsencrypt/fullchain.cer;
    ssl_certificate_key  /etc/letsencrypt/private.key;

    ssl_session_timeout 5m;

    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://10.10.0.100:80;
   }
   access_log off;
   log_not_found off;
}

Certbot’s DNS plugins 基于DNS插件没有尝试成功

|阅读量()

acme.sh 申请Let’s-Encrypt SSL

安装

DNS mode 申请证书

ngrok.spring-cloud.tk.conf 配置文件

Certbot’s DNS plugins 基于DNS插件 没有尝试成功

Certbot’s DNS plugins 基于DNS插件没有尝试成功