申请Let's Encrypt 免费SSL证书

最新推荐文章于 2025-08-13 16:29:18 发布

weixin_33978044

最新推荐文章于 2025-08-13 16:29:18 发布

阅读量102

点赞数

CC 4.0 BY-SA版权

文章标签：运维 python git

原文链接：https://my.oschina.net/stupidboyblog/blog/1930906

本文介绍如何使用Let'sEncrypt为网站部署免费的HTTPS证书，包括安装配置过程及续签命令。文中详细解释了如何通过Python环境和Git工具克隆Let'sEncrypt项目，并使用其提供的工具生成和管理证书。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

2019独角兽企业重金招聘Python工程师标准>>>

开发小程序，自己部署https, 这里选择的是 Let's Encrypt

优点：免费

缺点：有效时间是90天，但是还能重新生成

环境：git , python

操作：

git克隆：

git clone https://github.com/letsencrypt/letsencrypt

打开目录：

cd letsencrypt

生成证书：

./certbot-auto certonly --standalone --email admin@example.com -d example.com 

#首次配置需要配置E-mail
#如果你想使用一个没有完全插件支持的Web服务器，你仍然可以使用“standalone ”或“webroot”插件来获得证书。
#在创建的时候最好是先关闭WEB服务器，否则会报如下错误：
#  Problem binding to port 80: Could not bind to IPv4 or IPv6.

结果：

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/example.com/privkey.pem
   Your cert will expire on 2018-11-18. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

配置 nginx ：

#listen 443 #我这边会报错：SSL 接收到一个超出最大准许长度的记录。 错误代码：SSL_ERROR_RX_RECORD_TOO_LONG 
listen 443;
ssl on;

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/example.com/chain.pem;

这个证书是90天到期，下面是续签命令：

./certbot-auto -renew --dry-run

扩展：

查看帮助信息

# ./certbot-auto --help

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  certbot-auto [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

Certbot can obtain and install HTTPS/TLS/SSL certificates.  By default,
it will attempt to use a webserver both for obtaining and installing the
certificate. The most common SUBCOMMANDS and flags are:

obtain, install, and renew certificates:
    (default) run   Obtain & install a certificate in your current webserver
    certonly        Obtain or renew a certificate, but do not install it
    renew           Renew all previously obtained certificates that are near
expiry
    enhance         Add security enhancements to your existing configuration
   -d DOMAINS       Comma-separated list of domains to obtain a certificate for

  --apache          Use the Apache plugin for authentication & installation
  --standalone      Run a standalone webserver for authentication
  --nginx           Use the Nginx plugin for authentication & installation
  --webroot         Place files in a server's webroot folder for authentication
  --manual          Obtain certificates interactively, or using shell script
hooks

   -n               Run non-interactively
  --test-cert       Obtain a test certificate from a staging server
  --dry-run         Test "renew" or "certonly" without saving any certificates
to disk

manage certificates:
    certificates    Display information about certificates you have from Certbot
    revoke          Revoke a certificate (supply --cert-path)
    delete          Delete a certificate

manage your account with Let's Encrypt:
    register        Create a Let's Encrypt ACME account
  --agree-tos       Agree to the ACME server's Subscriber Agreement
   -m EMAIL         Email address for important account notifications

More detailed help:

  -h, --help [TOPIC]    print this message, or detailed help on a topic;
                        the available TOPICS are:

   all, automation, commands, paths, security, testing, or any of the
   subcommands or plugins (certonly, renew, install, register, nginx,
   apache, standalone, webroot, etc.)

附录：

官网地址：https://letsencrypt.org/

生成工具官网：https://certbot.eff.org/

开源项目地址：https://github.com/certbot/certbot

转载于:https://my.oschina.net/stupidboyblog/blog/1930906