介绍
经过1天的研究，对比了StarCom的证书以及LetEncrypt免费证书的比较，最终决定采用LetEncrypt证书作为公司网站的https实现方式。
LetEncrypt证书优缺点
优点
1、开源免费，有众多的公司支持，如google等
缺点
1、每个证书只有90天的期限，需要手动的进行证书的更新。
准备的资料
1、服务器必须开放 443端口，阿里云服务器可以直接到安全组中添加一条规则来开放443端口
2、需要生成LetEncrypt证书
安装步骤
以下以给cptest.xxx.com上添加https为例子
第一步、下载证书执行脚本
//创建证书目录
# mkdir /data/wwwroot/ssl_file/letencrypt/cptest.xxx.com
//进入certs目录
# cd /data/wwwroot/ssl_file/letencrypt/cptest.xxx.com
//下载脚本配置文件# wget https://raw.githubusercontent.com/xdtianyu/scripts/master/lets-encrypt/letsencrypt.conf
//下载脚本配置文件
# wget https://raw.githubusercontent.com/xdtianyu/scripts/master/lets-encrypt/letsencrypt.sh//给予脚本755权限chmod +x letsencrypt.sh
第二步、配置域名配置文件
为了正确的使用https，在letencrypt.conf文件中需要正确的配置域名对应的文件目录路径，详细的配置letencrypt.conf文件配置如下。
# only modify the values, key files will be generated automaticly.ACCOUNT_KEY="letsencryptaccount.key"
DOMAIN_KEY="cptest.xxx.com.key"
// 注意这个地方一定要和域名的配置目录保持一致，否则生成证书会出错。DOMAIN_DIR="/data/wwwroot/testing/testing_server_test/public"
// DNS的配置
DOMAINS="DNS:cptest.xxx.com"
#ECC=TRUE#LIGHTTPD=TRUE
第三步、生成证书文件
通过第一步和第二步，我们的基础配置文件都已经配置完成，接下需要生成证书。执行命令
./letsencrypt.sh letsencrypt.conf
在执行的过程，脚本会自动的检验域名是否能够访问成功，若letsencrypt.conf文件中配置的域名与对应的访问路径不正确，则会报如下错误。
Generate account key...Generating RSA private key, 4096 bit long modulus.....................................................................++...........++e is 65537 (0x10001)Generate domain key...Generating RSA private key, 2048 bit long modulus.........+++.........................+++e is 65537 (0x10001)Generate CSR...cptest.csrParsing account key...Parsing CSR...Registering account...Registered!Verifying cptest.xxx.com...Traceback (most recent call last): File "/tmp/acme_tiny.py", line 198, inmain(sys.argv[1:])
File "/tmp/acme_tiny.py", line 194, in main
signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca)
File "/tmp/acme_tiny.py", line 123, in get_crt
wellknown_path, wellknown_url))
ValueError: Wrote file to /data/wwwroot/testing/testing_server_test/.well-known/acme-challenge/wRf1bolKp92cX4YdHKIEMf9DxGhtnP6GvvOvB6rY2F0, but couldn't download http://cptest.xxx.com/.well-known/acme-challenge/wRf1bolKp92cX4YdHKIEMf9DxGhtnP6GvvOvB6rY2F0
如果正确的配置，则提示如下
Generate account key...
Generating RSA private key, 4096 bit long modulus
..................................................................................................................................................................................++
........................................................................................................................................++
e is 65537 (0x10001)
Generate domain key...
Generating RSA private key, 2048 bit long modulus
......+++
...............................+++
e is 65537 (0x10001)
Generate CSR...cptest.csr
Parsing account key...
Parsing CSR...
Registering account...
Registered!
Verifying cptest.xxx.com...
cptest.xxx.com verified!
Signing certificate...
Certificate signed!
New cert: cptest.chained.crt has been generated
完成后会在当前目录下生成，如下文件
cptest.chained.crt
cptest.crt
cptest.csr
cptest.xxx.com.key
letsencrypt-account.key
letsencrypt.conf
letsencrypt.sh
lets-encrypt-x3-cross-signed.pem
第四步、在Nginx上配置SSL
完成上述步骤后，基本上生成证书的步骤已经完成，接下来就是要把https应用到对应的域名上，在nginx中配置如下
server {
#listen 80;
listen 443;
ssl on;
ssl_certificate /data/wwwroot/ssl_file/letencrypt/cptest.xxx.com/cptest.chained.crt;
ssl_certificate_key /data/wwwroot/ssl_file/letencrypt/cptest.xxx.com/cptest.xxx.com.key;
server_name cptest.xxx.com;
access_log /data/wwwlogs/nginx/cptest.xxx.com_nginx.log combined;
error_log /data/wwwlogs/nginx/cptest.xxx.com_errr_log;
index index.html index.htm index.php;
include /usr/local/tengine/conf/rewrite/other.conf;
root /data/wwwroot/testing/testing_server_test/public;
}
第五步、定时更新证书
至此，前面我们已经可以给域名配置好了https服务，但是由于LetEncrypt证书有效期只有90天，因此还需要使用定时任务来更新证书，在crontab中增加一条定时命令，让https证书在每月的1号自动进行更新，命令如下
0 0 1 * * /data/wwwroot/ssl_file/letencrypt/cptest.xxx.com/letsencrypt.sh /data/wwwroot/ssl_file/letencrypt/cptest.xxx.com/letsencrypt.conf >> /data/wwwlogs/letencrypt/cptest.xxx.com-lets-encrypt.log 2>&1
参考资料
https://lirongyao.com/lets-encrypt.html
http://blog.csdn.net/dingxl555/article/details/51749956
