- 安裝
可選配置：啟動EPEL存儲庫 非必要項
yum install -y epel-release
yum clean all
yum makecache
#啟用可選通道 可以不配置
yum -y install yum-utils
yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional
必要配置參數(shù)：安裝certbot
yum -y install certbot python2-certbot-nginx
- 配置nginx
upstream proxy {
server 127.0.0.1:9000;
}
server {
listen 443;
server_name test.test.com;
location ~ ^/(base|admin|web|assets|auth|user) {
proxy_redirect off;
proxy_set_header X-Proxy-Client-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://proxy;
}
location / {
root /data/camc/public/dist;# project path
try_files $uri /index.html;# if not match,go to the save page
index index.html index.htm;
}
error_page 404 /404.html;
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}
#http直接重定向到https
server {
listen 80;
server_name test.test.com;
rewrite ^(.*)$ https://$host$1 permanent;
}
或是一個正常的偵聽80端口的也可以，重點是下一步生成證書，
3. 生成證書
3.1自動配置nginx
運行如下命令會自動下載證書并配置nginx。
certbot --nginx
會列表nginx下的域名列表，從其中選擇2中配置的域名，會自動生成ssl文件并配置好443端口
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: h**.app
2: a**.app
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
3.2 手動配置nginx
運行如下命令會自動下載證書但需要自己配置nginx。
certbot certonly --nginx
若nginx未安裝在默認(rèn)路徑(/etc/nginx or /usr/local/etc/nginx)下需自己指定nginx路徑，到conf目錄文章來源：http://www.zghlxwxcb.cn/news/detail-601649.html
certbot certonly --nginx --nginx-server-root=/root/nginx/conf
- 自動更新
sudo crontab -e
0 0 1 * * /usr/bin/certbot renew >> /var/log/le-renew.log
重啟crontab，使配置生效
sudo /bin/systemctl restart crond.service文章來源地址http://www.zghlxwxcb.cn/news/detail-601649.html
到了這里，關(guān)于Centos Certbot 使用的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
