免费SSL证书一键配置指南

目前发放免费 SSL 证书的机构有很多例如 Lets Encrypt 、TrustAsia 等我这里选择的是 Lets Encrypt第一步配置 Lets Encrypt 的docker composenetworks: default: name: data_default external: true services: # SSL证书续期 certbot-base: hostname: certbot image: certbot/certbot:v2.6.0 restart: no deploy: resources: limits: memory: 200M environment: - ACME_SERVERhttps://acme-v02.api.letsencrypt.org/directory entrypoint: sh command: -c certbot certonly --standalone -d $$CB_HOST --text --agree-tos --register-unsafely-without-email --server https://acme-v02.api.letsencrypt.org/directory --rsa-key-size 4096 --verbose --keep-until-expiring --preferred-challengeshttp --force-renewal volumes: - ./certbot/www/:/var/www/certbot/ - ./certbot/conf/:/etc/letsencrypt/ #二级域名配置 certbot-xx: extends: service: certbot-base environment: - CB_HOSTxx.xxx.com #三级域名配置依次类推也可以做泛域名配置 certbot-xx-xxx: extends: service: certbot-base environment: - CB_HOSTx.xx.xxx.com第二步自动更新脚本#!/bin/bash # 定义 compose 文件路径 COMPOSE_FILE/data/nginx/compose-cb.yml # 定义所有需要更新的服务列表 SERVICES( certbot-xx certbot-xx-xxx#新增一个三级域名依次类推加在后面实现自动更新 ) echo 开始更新证书... # 依次执行每个服务的更新 for service in ${SERVICES[]}; do echo 正在更新服务: $service /usr/bin/docker compose -f $COMPOSE_FILE up $service # 检查命令是否执行成功 if [ $? -ne 0 ]; then echo 错误: 服务 $service 更新失败 fi done echo 所有证书更新完成正在重启 nginx... # 重启 nginx /usr/bin/docker restart nginx # 检查 nginx 是否重启成功 if [ $? -eq 0 ]; then echo nginx 重启成功 else echo 错误: nginx 重启失败 fi echo 脚本执行完成第三步nginx配置server { listen 80; server_name *.xx.xxx.com;#放开80端口及模糊匹配三级域名 location / { return 301 https://$host$request_uri; } location /robots.txt { access_log off; return 200 User-agent: *\nDisallow: /\n; } location /.well-known/acme-challenge { set $certbot certbot:80; proxy_pass http://$certbot$request_uri; } }三级域名正常使用配置server { listen 443 ssl; server_name x.xx.xxx.com; ssl_certificate /etc/letsencrypt/live/x.xx.xxx.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/x.xx.xxx.com/privkey.pem; client_max_body_size 10240M; location / { proxy_set_header Host $host; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Referer $http_referer; proxy_pass http://root-zfrps-1:17004$request_uri; } }最后一步定时器# m h dom mon dow command 3 1 * * * /data/nginx/cb-update.sh /var/log/mycb.log 21自动生成的ssl证书