Nginx免费SSL证明书自动设置

1. 按照自动设置工具

$ apt-get update
$ sudo apt-get install certbot
$ apt-get install python3-certbot-nginx


2. 配置Nginx
   
   /etc/nginx/conf.d

server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www/html;
server_name example.com www.example.com;
}


3. 更新配置

nginx -t && nginx -s reload


4. 自动生成SSL并配置

$ sudo certbot --nginx -d example.com -d www.example.com


• 如果只生成证书可以用

sudo certbot certonly --nginx


5. 出现下面消息代表配置成功

Congratulations! You have successfully enabled https://example.com and https://www.example.com
-------------------------------------------------------------------------------------
IMPORTANT NOTES:
Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/example.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/example.com//privkey.pem
Your cert will expire on 2017-12-12.


6. 查看更新后的配置文件

server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www/html;
server_name example.com www.example.com;
listen 443 ssl; # managed by Certbot
# RSA certificate
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
# Redirect non-https traffic to https
if ($scheme != "https") {
return 301 https://$host$request_uri;
} # managed by Certbot
}


7. 到期自动更新设置
   
   每天0点check是不是剩下30天期限，然后更新

crontab -e
0 12 * * * /usr/bin/certbot renew --quiet


每天成就一小步，积累下来就是一大步。

转发本文请注明出处，谢谢您的阅读与分享！