https://zhangdapeng.dev/tags/certbot/Recent content in Certbot on Dapeng ZhangHugo -- gohugo.ioen-usThu, 10 Jul 2025 10:57:46 +0000https://zhangdapeng.dev/p/certbot-shi-yong-zong-jie/Thu, 10 Jul 2025 10:57:46 +0000https://zhangdapeng.dev/p/certbot-shi-yong-zong-jie/<p>官方宣称certbot</p> <blockquote> <p>使用EFF的Certbot在您的网站上自动启用HTTPS，部署Let&rsquo;s Encrypt的证书。</p> </blockquote> <blockquote> <p>Automatically enable HTTPS on your website with EFF&rsquo;s Certbot, deploying Let&rsquo;s Encrypt certificates.</p> </blockquote> <h2 id="给指定域名生成免费ssl证书方式">给指定域名生成免费ssl证书方式 </h2><p>举个例子比如我要给我的www.gowhich.com生成证书可以使用如下，命令</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>certbot certonly --webroot -w /home/wwwroot/gowhich/web -d www.gowhich.com </span></span></code></pre></div><p>和</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>certbot certonly --standalone --preferred-challenges http -d www.gowhich.com </span></span></code></pre></div><p>前提，你的域名必须已经解析成功，是否解析成功可以通过下面命令测试</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>nslookup www.gowhich.com </span></span></code></pre></div><p>会得到类似如下信息</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>Server: 172.18.0.1 </span></span><span style="display:flex;"><span>Address: 172.18.0.1#53 </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span>Non-authoritative answer: </span></span><span style="display:flex;"><span>Name: www.gowhich.com </span></span><span style="display:flex;"><span>Address: xxx.xxx.xxx.xxx <span style="color:#75715e"># ip地址</span> </span></span></code></pre></div><p>下面说生成证书的命令</p> <p>第一个命令，certbot会到你项目创建一个文件，然后通过访问你的域名来访问进行网站验证，通过后则生成证书 第二个命令则是通过启动内部服务，来检测验证网站，最后生成一个证书</p> <p>我个人的项目比较多，使用的语言也多，Yii开发的项目在使用第一个命令生成证书的时候是没有问题的，但是第一个命令在Flask开发的项目中会遇到问题，提示访问不了文件，可能是路由的问题导致的，暂时没有找到解决思路，但是我们不可能因为一个证书去修改一个项目，如果改的话我觉得也是大费周折，还好certbot提供了第二种方式，只不过会需要暂时停止80端口的访问，这个对于跟人项目而言问题还好不是很严重，所以这里推荐第二种命令的方式。</p>https://zhangdapeng.dev/p/certbot-mian-fei-https-zheng-shu-an-zhuang/Thu, 03 Jul 2025 17:37:31 +0000https://zhangdapeng.dev/p/certbot-mian-fei-https-zheng-shu-an-zhuang/<h2 id="install-certbot-安装certbot">Install certbot 安装certbot </h2><p>安装步骤可到这里 <a class="link" href="https://certbot.eff.org/#debianjessie-nginx" target="_blank" rel="noopener" >https://certbot.eff.org/#debianjessie-nginx</a> 根据自己的服务器情况选择具体的安装版本</p> <h2 id="配置证书">配置证书 </h2><p>可以使用如下命令，这样的好处是我们可以在下次进行自动更新证书的话，可以方便的处理证书</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>certbot certonly --webroot -w /home/wwwroot/www1.gowhich.com/web -d gowhich.com -d www.gowhich.com </span></span></code></pre></div><p>注意这里的webroot路径一定是你静态文件能够被访问到的，不然，无法进行证书验证</p> <p>比如我的另外一个域名可以这样设置【Flask项目】</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>certbot certonly --webroot -w /home/wwwroot/www.walkerfree.com/walkerfree/static -d walkerfree.com -d www.walkerfree.com </span></span></code></pre></div><p>输出如下：</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>Saving debug log to /var/log/letsencrypt/letsencrypt.log </span></span><span style="display:flex;"><span>Starting new HTTPS connection <span style="color:#f92672">(</span>1<span style="color:#f92672">)</span>: acme-v01.api.letsencrypt.org </span></span><span style="display:flex;"><span>Obtaining a new certificate </span></span><span style="display:flex;"><span>Performing the following challenges: </span></span><span style="display:flex;"><span>http-01 challenge <span style="color:#66d9ef">for</span> walkerfree.com </span></span><span style="display:flex;"><span>http-01 challenge <span style="color:#66d9ef">for</span> www.walkerfree.com </span></span><span style="display:flex;"><span>Using the webroot path /home/wwwroot/www.walkerfree.com/walkerfree/static <span style="color:#66d9ef">for</span> all unmatched domains. </span></span><span style="display:flex;"><span>Waiting <span style="color:#66d9ef">for</span> verification... </span></span><span style="display:flex;"><span>Cleaning up challenges </span></span><span style="display:flex;"><span>Generating key <span style="color:#f92672">(</span><span style="color:#ae81ff">2048</span> bits<span style="color:#f92672">)</span>: /etc/letsencrypt/keys/0003_key-certbot.pem </span></span><span style="display:flex;"><span>Creating CSR: /etc/letsencrypt/csr/0003_csr-certbot.pem </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span>IMPORTANT NOTES: </span></span><span style="display:flex;"><span> - Congratulations! Your certificate and chain have been saved at </span></span><span style="display:flex;"><span> /etc/letsencrypt/live/walkerfree.com/fullchain.pem. Your cert will </span></span><span style="display:flex;"><span> expire on 2018-01-22. To obtain a new or tweaked version of this </span></span><span style="display:flex;"><span> certificate in the future, simply run certbot again. To </span></span><span style="display:flex;"><span> non-interactively renew *all* of your certificates, run <span style="color:#e6db74">&#34;certbot </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> renew&#34;</span> </span></span><span style="display:flex;"><span> - If you like Certbot, please consider supporting our work by: </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> Donating to ISRG / Let<span style="color:#960050;background-color:#1e0010">&#39;</span>s Encrypt: https://letsencrypt.org/donate </span></span><span style="display:flex;"><span> Donating to EFF: https://eff.org/donate-le </span></span></code></pre></div><p>然后就可以进行nginx配置了</p> <p>当我们不希望每次都来自己更新，或者自己忘记了更新，证书过期了，不就很危险了，执行下面的命令试试 是否可以正常的自动更新，如果可以的话 我们就把此命令加入我们的定时任务中就可以了</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo certbot renew --dry-run </span></span></code></pre></div><p>加入定时任务</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#ae81ff">30</span> <span style="color:#ae81ff">2</span> * * <span style="color:#ae81ff">1</span> /usr/bin/certbot renew &gt;&gt; /var/log/certbot-renew.log </span></span></code></pre></div><p>每周一半夜2点30分执行renew任务。</p> <hr> <p><strong>2019-02-20补充</strong></p> <p>通过下面命令可以通过certbot自己的服务器来验证证书 - 这个只在自己的网站不支持验证证书的情况下使用</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>certbot certonly --standalone --preferred-challenges http -d walkerfree.com -d www.walkerfree.com </span></span></code></pre></div><p>注意：前提可能需要将自己本地监听80端口的服务器暂时停掉一会</p>