1. certbot安装

cd /usr/local/src

wget https://dl.eff.org/certbot-auto

chmod a+x certbot-auto

2. 认证方式

客户在申请 Let’s Encrypt 证书的时候，需要校验域名的所有权，证明操作者有权利为该域名申请证书，目前支持三种验证方式：

dns-01：给域名添加一个 DNS TXT 记录。

http-01：在域名对应的 Web 服务器下放置一个 HTTP well-known URL 资源文件。

tls-sni-01：在域名对应的 Web 服务器下放置一个 HTTPS well-known URL 资源文件。

3. 运行命令

 ./certbot-auto certonly  -d *.archerwong.cn -d archerwong.cn --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory

注意这里 -d archerwong.cn 最好写上，否则archerwong.cn将无法被信任，只有xxx.archerwong.cn这样的二级域名才被信任

介绍下相关参数：

certonly，表示安装模式，Certbot 有安装模式和验证模式两种类型的插件。

--manual  表示手动安装插件，Certbot 有很多插件，不同的插件都可以申请证书，用户可以根据需要自行选择

-d 为那些主机申请证书，如果是通配符，输入 *.newyingyong.cn（可以替换为你自己的域名）

--preferred-challenges dns，使用 DNS 方式校验域名所有权

--server，Let's Encrypt ACME v2 版本使用的服务器不同于 v1 版本，需要显示指定。

交互界面如下

[root@host src]# sudo  ./certbot-auto certonly  -d *.archerwong.cn -d archerwong.cn --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator manual, Installer None

Enter email address (used for urgent renewal and security notices) (Enter 'c' to

cancel): [email protected]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Please read the Terms of Service at

https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must

agree in order to register with the ACME server at

https://acme-v02.api.letsencrypt.org/directory

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(A)gree/(C)ancel: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Would you be willing to share your email address with the Electronic Frontier

Foundation, a founding partner of the Let's Encrypt project and the non-profit

organization that develops Certbot? We'd like to send you email about our work

encrypting the web, EFF news, campaigns, and ways to support digital freedom.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: Y

Obtaining a new certificate

Performing the following challenges:

dns-01 challenge for archerwong.cn

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

NOTE: The IP of this machine will be publicly logged as having requested this

certificate. If you're running certbot in manual mode on a machine that is not

your server, please ensure you're okay with that.

Are you OK with your IP being logged?

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: (Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Please deploy a DNS TXT record under the name

_acme-challenge.archerwong.cn with the following value:

apQPzp-NYZ0md_D_2_fKr465Il3dDbdR_BlOSOJTYAo

Before continuing, verify the record is deployed.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Press Enter to Continue

注意这里我把交互页面截断，很重要，先不要回车，将上面的txt值，填到你的域名解析里面，等确认生效后再回车，我填写如下

letsencrypt证书-使用certbot申请wildcard证书-LMLPHP

然后测试是否生效

$ dig  -t txt  _acme-challenge.archerwong.cn @8.8.8.8

; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7_4.1 <<>> -t txt _acme-challenge.archerwong.cn @8.8.8.8

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25704

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 512

;; QUESTION SECTION:

;_acme-challenge.archerwong.cn.	IN	TXT

;; ANSWER SECTION:

_acme-challenge.archerwong.cn. 599 IN	TXT	"apQPzp-NYZ0md_D_2_fKZ465Il3dDbdR_BlOSOJTYbo"

;; Query time: 306 msec

;; SERVER: 8.8.8.8#53(8.8.8.8)

;; WHEN: Mon Dec 17 21:34:43 CST 2018

;; MSG SIZE  rcvd: 114

确认生效后，按回车键，交互界面继续

Waiting for verification...

Cleaning up challenges

IMPORTANT NOTES:

 - Congratulations! Your certificate and chain have been saved at:

   /etc/letsencrypt/live/archerwong.cn/fullchain.pem

   Your key file has been saved at:

   /etc/letsencrypt/live/archerwong.cn/privkey.pem

   Your cert will expire on 2019-03-17. To obtain a new or tweaked

   version of this certificate in the future, simply run certbot-auto

   again. To non-interactively renew *all* of your certificates, run

   "certbot-auto renew"

 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate

   Donating to EFF:                    https://eff.org/donate-le

至此已经成功生成了wildcard证书，查看下证书

tree  /etc/letsencrypt/live/archerwong.cn

/etc/letsencrypt/live/archerwong.cn

├── cert.pem -> ../../archive/archerwong.cn/cert1.pem

├── chain.pem -> ../../archive/archerwong.cn/chain1.pem

├── fullchain.pem -> ../../archive/archerwong.cn/fullchain1.pem

├── privkey.pem -> ../../archive/archerwong.cn/privkey1.pem

└── README

生成证书后,配置 Nginx

打开 nginx server 配置文件加入如下设置：

server {

    listen 443

    ssl on;

    ssl_certificate /etc/letsencrypt/live/网站域名/fullchain.pem;

    ssl_certificate_key /etc/letsencrypt/live/网站域名/privkey.pem;

     ## 其他配置

}

强制跳转 https

https 默认是监听 443 端口的，没开启 https 访问的话一般默认是 80 端口。如果你确定网站 80 端口上的站点都支持 https 的话加入下面的配件可以自动重定向到 https

server {

    listen 80;

    server_name your.domain.com;

    return 301 https://$server_name$request_uri;

}

4. 更新

使用的库：letsencrypt通配符证书，其实这个库就是写了一个钩子，通过钩子来自动填写txt dns记录。当然这个库也可以方便的申请通配符证书，感谢作者的付出。

1：下载

$ git clone https://github.com/ywdblog/certbot-letencrypt-wildcardcertificates-alydns-au

$ cd certbot-letencrypt-wildcardcertificates-alydns-au

$ chmod 0777 au.sh autxy.sh python-version/au.sh

// 我是移动到了/etc/letsencrypt目录下，然后重命名manual-auth-hook

2：配置

目前该工具支持三种运行环境：

au.sh：操作阿里云 DNS hook shell（PHP 环境）。
autxy.sh：操作腾讯云 DNS hook shell（PHP 环境）。
python-version/au.py：操作阿里云 DNS hook shell（Python 2.7/3.6）,感谢 @Duke-Wu 的 PR。

这三种运行环境什么意思呢？就是可根据自己服务器环境和域名服务商选择任意一个 hook shell（操作的时候任选其一即可）。

DNS API 密钥：

alydns.php，修改 accessKeyId、accessSecrec 变量，阿里云 API key 和 Secrec 官方申请文档。
txydns.php，修改 txyaccessKeyId、txyaccessSecrec 变量，腾讯云 API 密钥官方申请文档。
python-version/alydns27.py，修改 ACCESS_KEY_ID、ACCESS_KEY_SECRET，阿里云 API key 和 Secrec 官方申请文档。

这个 API 密钥什么意思呢？由于需要通过 API 操作阿里云 DNS 或腾讯云 DNS 的记录，所以需要去域名服务商哪儿获取 API 密钥。

3：申请证书

特别说明： --manual-auth-hook 指定的 hook 文件三个任选其一（au.sh、autxy.sh、python-version/au.sh），其他操作完全相同。

测试是否有错误

$ ./certbot-auto certonly  -d *.example.com --manual --preferred-challenges dns  --manual-auth-hook /脚本目录/au.sh（autxy.sh 或 python-version/27.py，下面统一以 au.sh 介绍）  --dry-run

# 实际申请

$ ./certbot-auto certonly  -d *.example.com --manual --preferred-challenges dns  --manual-auth-hook /脚本目录/au.sh

这里我实际运行了测试

[root@host src]# ./certbot-auto certonly  -d *.archerwong.cn --manual --preferred-challenges dns  --manual-auth-hook /etc/letsencrypt/manual-auth-hook/autxy.sh --dry-run

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator manual, Installer None

Obtaining a new certificate

Performing the following challenges:

dns-01 challenge for archerwong.cn

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

NOTE: The IP of this machine will be publicly logged as having requested this

certificate. If you're running certbot in manual mode on a machine that is not

your server, please ensure you're okay with that.

Are you OK with your IP being logged?

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: y

Output from autxy.sh:

/etc/letsencrypt/manual-auth-hook/alydns.php

archerwong.cn_acme-challengevnc1ol1jxXcQnX8ggc40-HFXPdca7xTzhDZRDKzHla8

END

Waiting for verification...

Cleaning up challenges

IMPORTANT NOTES:

 - The dry run was successful.

4：续期证书

1、对机器上所有证书 renew

$ ./certbot-auto renew  --manual --preferred-challenges dns  --manual-auth-hook /脚本目录/au.sh

实际更新下，结果如下

[root@host src]# ./certbot-auto renew --manual --preferred-challenges dns  --manual-auth-hook /etc/letsencrypt/manual-auth-hook/autxy.sh

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Processing /etc/letsencrypt/renewal/archerwong.cn.conf

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Cert not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

The following certs are not due for renewal yet:

  /etc/letsencrypt/live/archerwong.cn/fullchain.pem expires on 2019-03-18 (skipped)

No renewals were attempted.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[root@host src]# ./certbot-auto renew --manual --preferred-challenges dns  --manual-auth-hook /etc/letsencrypt/manual-auth-hook/autxy.sh --force-renewal

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Processing /etc/letsencrypt/renewal/archerwong.cn.conf

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Plugins selected: Authenticator manual, Installer None

Renewing an existing certificate

Performing the following challenges:

dns-01 challenge for archerwong.cn

dns-01 challenge for archerwong.cn

Output from autxy.sh:

/etc/letsencrypt/manual-auth-hook/alydns.php

archerwong.cn_acme-challengeapQPzp-NYaZfafamd_D_2_fKr46fafafaR_BlOSOJTYAo

END

Output from autxy.sh:

/etc/letsencrypt/manual-auth-hook/alydns.php

archerwong.cn_acme-challengeNnS-4PfafavlFuvgm1vjzfafafaD5Ux_JfQoohs

END

Waiting for verification...

Cleaning up challenges

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

new certificate deployed without reload, fullchain is

/etc/letsencrypt/live/archerwong.cn/fullchain.pem

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Congratulations, all renewals succeeded. The following certs have been renewed:

  /etc/letsencrypt/live/archerwong.cn/fullchain.pem (success)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2、对某一张证书进行续期

先看看机器上有多少证书：

$ ./certbot-auto certificates

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Found the following certs:

  Certificate Name: archerwong.cn-0001

    Domains: *.archerwong.cn archerwong.cn

    Expiry Date: 2019-03-17 13:24:57+00:00 (VALID: 89 days)

    Certificate Path: /etc/letsencrypt/live/archerwong.cn-0001/fullchain.pem

    Private Key Path: /etc/letsencrypt/live/archerwong.cn-0001/privkey.pem

  Certificate Name: test.archerwong.cn-0001

    Domains: test.archerwong.cn

    Expiry Date: 2019-03-18 05:36:23+00:00 (INVALID: TEST_CERT)

    Certificate Path: /etc/letsencrypt/live/test.archerwong.cn-0001/fullchain.pem

    Private Key Path: /etc/letsencrypt/live/test.archerwong.cn-0001/privkey.pem

  Certificate Name: archerwong.cn

    Domains: *.archerwong.cn

    Expiry Date: 2019-03-17 12:34:52+00:00 (VALID: 89 days)

    Certificate Path: /etc/letsencrypt/live/archerwong.cn/fullchain.pem

    Private Key Path: /etc/letsencrypt/live/archerwong.cn/privkey.pem

记住证书名，比如 archerwong.cn，然后运行下列命令 renew：

$ ./certbot-auto renew --cert-name archerwong.cn --manual-auth-hook /脚本目录/au.sh

3、加入 crontab

编辑文件 /etc/crontab :

1 1 */1 * * root certbot-auto renew --manual --preferred-challenges dns  --manual-auth-hook /脚本目录/au.sh

上面的意思是，每隔一天的一点一分运行一次脚本

crontab的文件格式

分时日月星期要运行的命令

第1列分钟0～59
第2列小时0～23（0表示子夜）
第3列日1～31
第4列月1～12
第5列星期0～7（0和7表示星期天）
第6列要运行的命令

参考：

https://www.jianshu.com/p/c5c9d071e395

https://github.com/ywdblog/certbot-letencrypt-wildcardcertificates-alydns-au