當(dāng)前是在mac下操作

安裝certbot

# mac下brew安裝即可
brew install certbot

• centos 安裝
  centos安裝文檔

申請(qǐng)泛解析證書

sudo certbot certonly --manual --preferred-challenges=dns -d  '*.yourdomain.com'

## 輸出
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for *.yourdomain.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name:

_asdfase.yourdomain.com.

with the following value:
## TXT解析值
有朋自遠(yuǎn)發(fā)來 不亦樂乎

## 此處提示注意驗(yàn)證是否已經(jīng)在域名服務(wù)商配置了TXT解析
Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/txt.yourdomain.com.
Look for one or more bolded line(s) below the line ';ANSWER'. It should show the
value(s) you've just added.
'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Press Enter to Continue

## 如果多次驗(yàn)證失敗 可能有技能冷卻時(shí)間 文檔說是1小時(shí)

An unexpected error occurred:
Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/failed-validation-limit/

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/youdomain.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/yourdomain.com/privkey.pem
This certificate expires on 2024-04-22.
These files will be updated when the certificate renews.

NEXT STEPS:
- This certificate will not be renewed automatically. Autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate's expiry date.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

驗(yàn)證證書是否有效

查看證書

sudo certbot certificates

## 輸出

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: yourdomain.como
    Serial Number: asdfasfasfasdfas
    Key Type: ECDSA
    Domains: *.yourdomain.com
    Expiry Date: 2024-04-22 09:45:32+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/yourdomain.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/yourdomain.com/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

默認(rèn)3個(gè)月有效期

設(shè)置自動(dòng)續(xù)期腳本

echo "0 0,12 * * * root $(command -v python3) -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo $(command -v certbot) renew - q”| sudo tee -a /etc/crontab > /dev/null

• 命令比較簡單 用chatgpt做下命令拆解注釋

    這是一個(gè)shell命令，用于在Linux系統(tǒng)中將Certbot自動(dòng)續(xù)訂證書的命令添加到crontab中。
  
    具體分析如下：
    
    echo命令用于輸出內(nèi)容到標(biāo)準(zhǔn)輸出。
    0 0,12 * * *部分是cron時(shí)間格式，指定了腳本運(yùn)行的頻率。這里表示在每天的0點(diǎn)和12點(diǎn)運(yùn)行。
    
    root表示以root用戶身份運(yùn)行腳本。
    
    $(command -v python3)是用于獲取Python3可執(zhí)行文件的路徑，并將其插入命令中。
    
    -c 'import random; import time; time.sleep(random.random() * 3600)'是通過Python代碼實(shí)現(xiàn)延遲執(zhí)行。這段代碼會(huì)通過import random導(dǎo)入random模塊，然后使用import time; time.sleep(random.random() * 3600)來隨機(jī)延時(shí)一定時(shí)間，以避免多個(gè)服務(wù)器同時(shí)請(qǐng)求續(xù)訂證書。
    
    sudo $(command -v certbot) renew -q是用于以root用戶身份運(yùn)行certbot的續(xù)訂命令。-q參數(shù)表示以靜默模式運(yùn)行，輸出更少的信息。
    
    sudo tee -a /etc/crontab > /dev/null用于將前面的命令的輸出追加到/etc/crontab文件中，并將標(biāo)準(zhǔn)輸出重定向到/dev/null來忽略輸出。這樣，命令的輸出信息將不會(huì)顯示在終端上。
    
    整個(gè)命令使用管道符（|）將輸出傳遞給sudo tee命令，并將其添加到/etc/crontab文件中。
    
    
    通過執(zhí)行這個(gè)命令，會(huì)將自動(dòng)續(xù)訂Certbot證書的任務(wù)添加到cron作業(yè)中，以在每天的0點(diǎn)和12點(diǎn)執(zhí)行。這樣就能夠自動(dòng)續(xù)訂證書，確保證書在到期前得到更新。
  

• 參考博客

https://ganzhixiong.com/p/95b00866/
letsencrypt官網(wǎng)文章來源地址http://www.zghlxwxcb.cn/news/detail-821416.html

到了這里，關(guān)于免費(fèi)SSL申請(qǐng)和自動(dòng)更新的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！