SSL证书这么用

Wesley13
• 阅读 732

HTTPS 化

近日,谷歌工程师宣布将在2018年第二季度发布的Chrome 67中禁止一切使用不安全来源的呈现API(Presentation API)。 Presentation API, 即呈现API,是一个能使网页内容访问演示文稿显示并呈现自身的W3C标准技术。它允许设备在第二屏幕上显示内容,例如投影机或电视机。 Presentation API更显着的用途之一是谷歌在Chrome,Android和Chrome Cast设备上提供的“Casting”功能。

Let's Encrypt

https://letsencrypt.org/ Let's Encrypt 项目由 EFF、 Mozilla、Akamai、密歇根大学和思科等组织发起,由非营利组织互联网安全研究集团(Internet Security Research Group)经营,其使命是让每个网站都能使用 HTTPS 加密。 Let's Encrypt 项目宣布它已签发了超过 1 亿个证书。

SSL证书这么用

下载客户端

https://github.com/certbot/certbot/releases

    wget https://github.com/certbot/certbot/archive/v0.15.0.tar.gz

    tar -xvf v0.15.0.tar.gz

    cd certbot-0.15.0

三种安装模式

    ./letsencrypt-auto --help

Manual

    // 在非目标服务器上执行模式
    --manual          Obtain certificates interactively, or using shell script hooks

执行如下命令

    ./letsencrypt-auto certonly --manual -d gg.fabself.net


Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for gg.fabself.net

-------------------------------------------------------------------------------
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
-------------------------------------------------------------------------------
(Y)es/(N)o:Y

Yes 过后有如下提示:

Make sure your web server displays the following content at
http://gg.fabself.net/.well-known/acme-challenge/LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw before continuing:

LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw.3h_8AoI_OjBsHFko6XV4wNW6f_WlyXhoaEsne5R6Zw0

If you don't have HTTP server configured, you can run the following
command on the target server (as root):

mkdir -p /tmp/certbot/public_html/.well-known/acme-challenge
cd /tmp/certbot/public_html
printf "%s" LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw.3h_8AoI_OjBsHFko6XV4wNW6f_WlyXhoaEsne5R6Zw0 > .well-known/acme-challenge/LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw
# run only once per server:
$(command -v python2 || command -v python2.7 || command -v python2.6) -c \
"import BaseHTTPServer, SimpleHTTPServer; \
s = BaseHTTPServer.HTTPServer(('', 80), SimpleHTTPServer.SimpleHTTPRequestHandler); \
s.serve_forever()"
-------------------------------------------------------------------------------
Press Enter to Continue

在回车之前,按以上提示登录到 目标服务器,执行以上脚本 再回到操作机器上回车,可以看到如下:

Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/gg.fabself.net/fullchain.pem. Your cert will
   expire on 2017-10-01. To obtain a new or tweaked version of this
   certificate in the future, simply run letsencrypt-auto again. To
   non-interactively renew *all* of your certificates, run
   "letsencrypt-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

证书已经签好,并放在了指定目录下 /etc/letsencrypt/live

tree 一下看看文件列表

sudo tree /etc/letsencrypt/live/

/etc/letsencrypt/live/
└── gg.fabself.net
    ├── README
    ├── cert.pem -> ../../archive/gg.fabself.net/cert1.pem
    ├── chain.pem -> ../../archive/gg.fabself.net/chain1.pem
    ├── fullchain.pem -> ../../archive/gg.fabself.net/fullchain1.pem
    └── privkey.pem -> ../../archive/gg.fabself.net/privkey1.pem

Standalone

        //在目标主机上操作模式
     --standalone      Run a standalone webserver for authentication

执行如下命令,执行命令之前确保 nginx/Apache 已关闭

    ./letsencrypt-auto certonly --standalone -d gg.fabself.net

很速度

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for gg.fabself.net
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/gg.fabself.net/fullchain.pem. Your cert will
   expire on 2017-10-01. To obtain a new or tweaked version of this
   certificate in the future, simply run letsencrypt-auto again. To
   non-interactively renew *all* of your certificates, run
   "letsencrypt-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le


sudo tree /etc/letsencrypt/live
/etc/letsencrypt/live
`-- gg.fabself.net
    |-- cert.pem -> ../../archive/gg.fabself.net/cert1.pem
    |-- chain.pem -> ../../archive/gg.fabself.net/chain1.pem
    |-- fullchain.pem -> ../../archive/gg.fabself.net/fullchain1.pem
    |-- privkey.pem -> ../../archive/gg.fabself.net/privkey1.pem
    `-- README

Webroot

    //在目标主机上,nginx/Apache 启动的状态下,指定文件目录操作模式
    --webroot         Place files in a server's webroot folder for authentication

执行如下命令

    ./letsencrypt-auto certonly --webroot -w  /usr/share/nginx/html -d gg.fabself.net


Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for gg.fabself.net
Using the webroot path /usr/share/nginx/html for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/gg.fabself.net/fullchain.pem. Your cert will
   expire on 2017-10-01. To obtain a new or tweaked version of this
   certificate in the future, simply run letsencrypt-auto again. To
   non-interactively renew *all* of your certificates, run
   "letsencrypt-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le


sudo tree /etc/letsencrypt/live
/etc/letsencrypt/live
`-- gg.fabself.net
    |-- cert.pem -> ../../archive/gg.fabself.net/cert1.pem
    |-- chain.pem -> ../../archive/gg.fabself.net/chain1.pem
    |-- fullchain.pem -> ../../archive/gg.fabself.net/fullchain1.pem
    |-- privkey.pem -> ../../archive/gg.fabself.net/privkey1.pem
    `-- README

证书部署

证书描述 cert.pem 申请的服务器证书文件

privkey.pem 服务器证书对应的私钥

chain.pem 除服务器证书外,浏览器解析所需的其他全部证书,比如根证书和中间证书

fullchain.pem 包含服务器证书的全部证书链文件

** nginx 配置**

打开 nginx.conf,配置 443 端口及证书路径

    server {
        listen 443;
        server_name gg.fabself.net;

        root /usr/share/nginx/html;
        index index.html index.htm;
        ssl on;
        ssl_certificate /etc/letsencrypt/live/gg.fabself.net/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/gg.fabself.net/privkey.pem;
        ssl_session_timeout 5m;
        ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
        ssl_prefer_server_ciphers on;

        location / {
                try_files $uri $uri/ =404;
        }
    }

配置 80 端口重定向至 433

    server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on;
        root /usr/share/nginx/html;
        index index.html index.htm;
        server_name gg.fabself.net;
        return 301 https://$server_name$request_uri;
    }

就这样简单,HTTPS 配置成功

SSL证书这么用

证书有效期 90 天

更新证书

自动更新需要在 目标主机 上进行,选用 standaloneWebroot模式比较适用

    ./letsencrypt-auto renew

如果提示如下,说明证书还没有过期,就耐心等待

-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/gg.fabself.net.conf
-------------------------------------------------------------------------------
Cert not yet due for renewal

The following certs are not due for renewal yet:
  /etc/letsencrypt/live/gg.fabself.net/fullchain.pem (skipped)
No renewals were attempted.


考虑更自动化的方式,可以把 `./letsencrypt-auto renew` 加入到 `crontab` 中,可以每天更新两次保障
点赞
收藏
评论区
推荐文章
blmius blmius
3年前
MySQL:[Err] 1292 - Incorrect datetime value: ‘0000-00-00 00:00:00‘ for column ‘CREATE_TIME‘ at row 1
文章目录问题用navicat导入数据时,报错:原因这是因为当前的MySQL不支持datetime为0的情况。解决修改sql\mode:sql\mode:SQLMode定义了MySQL应支持的SQL语法、数据校验等,这样可以更容易地在不同的环境中使用MySQL。全局s
Karen110 Karen110
3年前
一篇文章带你了解JavaScript日期
日期对象允许您使用日期(年、月、日、小时、分钟、秒和毫秒)。一、JavaScript的日期格式一个JavaScript日期可以写为一个字符串:ThuFeb02201909:59:51GMT0800(中国标准时间)或者是一个数字:1486000791164写数字的日期,指定的毫秒数自1970年1月1日00:00:00到现在。1\.显示日期使用
皕杰报表之UUID
​在我们用皕杰报表工具设计填报报表时,如何在新增行里自动增加id呢?能新增整数排序id吗?目前可以在新增行里自动增加id,但只能用uuid函数增加UUID编码,不能新增整数排序id。uuid函数说明:获取一个UUID,可以在填报表中用来创建数据ID语法:uuid()或uuid(sep)参数说明:sep布尔值,生成的uuid中是否包含分隔符'',缺省为
待兔 待兔
3个月前
手写Java HashMap源码
HashMap的使用教程HashMap的使用教程HashMap的使用教程HashMap的使用教程HashMap的使用教程22
Jacquelyn38 Jacquelyn38
3年前
2020年前端实用代码段,为你的工作保驾护航
有空的时候,自己总结了几个代码段,在开发中也经常使用,谢谢。1、使用解构获取json数据let jsonData  id: 1,status: "OK",data: 'a', 'b';let  id, status, data: number   jsonData;console.log(id, status, number )
Wesley13 Wesley13
3年前
00:Java简单了解
浅谈Java之概述Java是SUN(StanfordUniversityNetwork),斯坦福大学网络公司)1995年推出的一门高级编程语言。Java是一种面向Internet的编程语言。随着Java技术在web方面的不断成熟,已经成为Web应用程序的首选开发语言。Java是简单易学,完全面向对象,安全可靠,与平台无关的编程语言。
Stella981 Stella981
3年前
Django中Admin中的一些参数配置
设置在列表中显示的字段,id为django模型默认的主键list_display('id','name','sex','profession','email','qq','phone','status','create_time')设置在列表可编辑字段list_editable
Stella981 Stella981
3年前
JOptionPane修改图标
1.在Linux平台下.JOptionPane会显示Java默认的图标,在window平台不显示图标,如何替换这个图标了?2JOptionPane.setIcon(Icon)修改的是内容区域的icon,而不是左上角的Icon.所以需要通过修改Jdialog/Frame的图标来达到修改默认图标的问题.3.代码:if(JOptio
Wesley13 Wesley13
3年前
MySQL部分从库上面因为大量的临时表tmp_table造成慢查询
背景描述Time:20190124T00:08:14.70572408:00User@Host:@Id:Schema:sentrymetaLast_errno:0Killed:0Query_time:0.315758Lock_
Python进阶者 Python进阶者
9个月前
Excel中这日期老是出来00:00:00,怎么用Pandas把这个去除
大家好,我是皮皮。一、前言前几天在Python白银交流群【上海新年人】问了一个Pandas数据筛选的问题。问题如下:这日期老是出来00:00:00,怎么把这个去除。二、实现过程后来【论草莓如何成为冻干莓】给了一个思路和代码如下:pd.toexcel之前把这