我知道很多云上都有免费1年的SSL证书了，但是1年到了你还得手动去续期，域名多了那工作量就大了去了。我的环境是阿里云centos6,亲测centos7同样适用，一句命令即可！
Let's Encrypt 的最大贡献是它的 ACME 协议，第一份全自动服务器身份验证协议，以及配套的基础设施和客户端。
关于Let's Encrypt 上线的意义可以参考一下知乎
https://www.zhihu.com/question/36710815?sort=created
现在我们来使用certbot自动注册免费的SSL证书及基于ACME协议自动续期！
官网地址 https://certbot.eff.org/#centos6-nginx 可根据你的软件和系统版本
wget https://dl.eff.org/certbot-autochmod a+x certbot-auto
命令帮助
./certbot-auto --help all
一句话搞定SSL！前提是先解析并且找得到server_name
./certbot-auto --nginx certonly --nginx-server-root /usr/local/nginx/conf --nginx-ctl /usr/local/nginx/sbin/nginx -m "yunwei@1.com" -n --agree-tos --domains www.jklot.com
certbot默认的nginx配置是/etc/nginx/,像我们平常都是放在/usr/local/nginx/需要自定义一下
如果卡在安装python packages 上
cat ~/.pip/pip.conf[global]index-url=http://mirrors.aliyun.com/pypi/simple/[install]trusted-host=mirrors.aliyun.com
如果你没有加这些参数
-m "your@email.com" -n --agree-tos
那就需要手动应答了。。邮件你不要随便填啊，到时候快过期会给你一封邮件，还是很有用的
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel):
You must
agree in order to register with the ACME server 等等等。。。
最后，提示以下信息，则说明我们申请成功了。
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/www.jklot.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/www.jklot.com/privkey.pem
Your cert will expire on 2018-04-04. To obtain a new or tweaked
Nginx配置
server { listen 80; server_name www.jklot.com; rewrite ^/(.*)$ https://www.jklot.com/$1 permanent;}server { listen 443; server_name www.jklot.com; index index.html index.htm index.php; root /data/web/www.jklot.com/; ssl on; ssl_certificate /etc/letsencrypt/live/www.jklot.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/www.jklot.com/privkey.pem; ssl_session_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; ssl_prefer_server_ciphers on; 最后可以测试一下证书的安全性
https://www.ssllabs.com/ssltest/index.html
管理证书
./certbot-auto certificates
注销证书
./certbot-auto revoke --cert-path /etc/letsencrypt/live/www.jklot.com/cert.pem Saving debug log to /var/log/letsencrypt/letsencrypt.log-------------------------------------------------------------------------------Would you like to delete the cert(s) you just revoked?-------------------------------------------------------------------------------(Y)es (recommended)/(N)o: Y-------------------------------------------------------------------------------Deleted all files relating to certificate 1.jklot.com.--------------------------------------------------------------------------------------------------------------------------------------------------------------Congratulations! You have successfully revoked the certificate that was locatedat /etc/letsencrypt/live/www.jklot.com/cert.pem
./certbot-auto delete --cert-name www.jklot.com
手动续期
./certbot-auto renew
自动续期
添加到crontab里面
00 0,12 * * * root /usr/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && cd /root ; ./certbot-auto renew --renew-hook "/usr/local/nginx/sbin/nginx -s reload"
上面是certbot官网的定时，我也不清楚为啥要在弄个随机的小时内执行renew...
那这样岂不是可以无限申请了吗？实际上是有限制的。https://letsencrypt.org/docs/rate-limits/
如果你上面用不来，那使用在线申请Let's Encrypt 证书的网站吧 https://www.sslforfree.com