安装acme.sh
curl https://get.acme.sh | sh -s email=my@example.com
手动下载
curl https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh -o acme.sh
curl https://github.com/acmesh-official/acme.sh/archive/master.tar.gz -o master.tar.gz
执行acme.sh后 会在主目录创建.acme.sh目录
nginx添加验证
mkdir -p /var/www/letsencrypt
location ~ ^/.well-known/(acme-challenge|pki-validation)/ {
add_header Content-Type text/plain;
root /var/www/letsencrypt;
}
nginx -t
nginx -s reload
生成证书
sh acme.sh --issue --server letsencrypt -d 47.xx.xx.xx -w /var/www/letsencrypt --certificate-profile shortlived --days 3
--issue：申请证书
--server letsencrypt：使用 Let’s Encrypt 服务器
-d 47.xx.xx.xx：目标IP地址
--certificate-profile shortlived：申请一个短期证书
--days 3：证书的有效期3天 不确定有效, 申请的3天, 生成的7天
证书路径:
Your cert is in: /root/.acme.sh/47.xx.xx.xx_ecc/47.xx.xx.xx.cer
Your cert key is in: /root/.acme.sh/47.xx.xx.xx_ecc/47.xx.xx.xx.key
The intermediate CA cert is in: /root/.acme.sh/47.xx.xx.xx_ecc/ca.cer
And the full-chain cert is in: /root/.acme.sh/47.xx.xx.xx_ecc/fullchain.cer
nginx配置
#填写证书文件绝对路径
ssl_certificate /root/.acme.sh/47.xx.xx.xx_ecc/47.xx.xx.xx.cer;
#填写证书私钥文件绝对路径
ssl_certificate_key /root/.acme.sh/47.xx.xx.xx_ecc/47.xx.xx.xx.key;
添加crontab定时任务
crontab -e
0 0 * * * /root/.acme.sh/acme.sh --cron --home "/root/.acme.sh" > /dev/null
0 1 * * * nginx -s reload > /dev/null
可以写个脚本判断证书是否有更新, 有更新再reload nginx