网站如何优化关键词排名,网站建设在线视频,用php做的网站必备那些文件,每个引子#xff1a; 最近在一篇文章中了解到EFF(电子前哨基金会)为了推广https协议#xff0c;成立了一个letsencrypt项目#xff0c;可以发放免费的证书#xff0c;此证书可以被大多数主流浏览器所信任#xff0c;这个邪恶的念头一爆发#xff0c;就让我走上了一条坎坷的不…引子 最近在一篇文章中了解到EFF(电子前哨基金会)为了推广https协议成立了一个letsencrypt项目可以发放免费的证书此证书可以被大多数主流浏览器所信任这个邪恶的念头一爆发就让我走上了一条坎坷的不归路。 准备工具:certbot环境:centOS7获取Certbot工具根据我在网上了解到的信息获取certbot工具有三种方法第一种是通过git在github中下载 git clone https://github.com/certbot/certbot.git 第二种是通过epel-release软件源这个软件源有许多yum中没有的软件包,包括certbot yum install epel-release yum install certbot 第三种是通过wget来进行下载 wget https://dl.eff.org/certbot-auto 由于钟爱github熟悉git所以直接使用git下载好了执行命令 git clone https://github.com/certbot/certbot.git   生成证书下载完了之后会创建一个certbot的目录 cd certbot certbot-auto certonly --standalone --email crisencrisen.org -d www.crisen.org 然后agree协议 静静等待生成证书即可出现下面提示就说明安装好了 IMPORTANT NOTES:- Congratulations! Your certificate and chain have been saved at/etc/letsencrypt/live/your.domain.com/fullchain.pem. Your certwill expire on 20XX-09-23. To obtain a new or tweaked version ofthis certificate in the future, simply run certbot again. Tonon-interactively renew *all* of your certificates, run certbotrenew- If you like Certbot, please consider supporting our work by:Donating to ISRG / Lets Encrypt: https://letsencrypt.org/donateDonating to EFF: https://eff.org/donate-le 证书会生成在/etc/letsencrypt/live目录下部署证书接着把证书的公钥和私钥配置到nginx的ssl目录下创建软链接 ln -s /etc/letsencrypt/live/www.crisen.org/fullchain.pem /usr/local/nginx/conf/ssl/www.crisen.org.crtln -s /etc/letsencrypt/live/www.crisen.org/privkey.pem /usr/local/nginx/conf/ssl/www.crisen.org.key 当然直接复制过去也是可行的 cp -i /etc/letsencrypt/live/www.crisen.org/fullchain.pem /usr/local/nginx/conf/ssl/www.crisen.org.crt cp -i /etc/letsencrypt/live/www.crisen.org/privkey.pem /usr/local/nginx/conf/ssl/www.crisen.org.key 接下来只要配置 nginx 的https服务就可以了 下面是我的nginx服务器配置文件 server {listen 80;listen 443 ssl http2;ssl_certificate /usr/local/nginx/conf/ssl/www.crisen.org.crt;ssl_certificate_key /usr/local/nginx/conf/ssl/www.crisen.org.key;ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_ciphers EECDHCHACHA20:EECDHAES128:RSAAES128:EECDHAES256:RSAAES256:EECDH3DES:RSA3DES:!MD5;ssl_prefer_server_ciphers on;ssl_session_timeout 10m;ssl_session_cache builtin:1000 shared:SSL:10m;ssl_buffer_size 1400;add_header Strict-Transport-Security max-age15768000;ssl_stapling on;ssl_stapling_verify on;ssl_trusted_certificate /usr/local/nginx/conf/ssl/www.crisen.org.crt;server_name www.crisen.org;access_log /data/wwwlogs/www.crisen.org_nginx.log combined;index index.html index.htm index.php;include /usr/local/nginx/conf/rewrite/none.conf;root /data/wwwroot/profiles;if ($ssl_protocol ) { return 301 https://$host$request_uri; } location ~ [^/]\.php(/|$) {#fastcgi_pass remote_php_ip:9000;fastcgi_pass unix:/dev/shm/php-cgi.sock;fastcgi_index index.php;include fastcgi.conf;}location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|ico)$ {expires 30d;access_log off;}location ~ .*\.(js|css)?$ {expires 7d;access_log off;} } nginx config 效果测试然后进入到www.crisen.org测试一下出现了可信任的证书 到此配置完毕 踩过的坑服务器操作系统版本过低开始的时候我的操作系统是centOS5.1版本的内置的python只有2.4结果没有办法启动certbot出现 因为certbot-auto是python写的并且必须要2.6以上的版本才可以 网上查看了许多文档也确定了certbot只支持更加现代的操作系统解决办法备份网站数据升级服务器操作系统转载于:https://www.cnblogs.com/crisenchou/p/5923419.html