Let’s Encrypt+Apache虚拟主机上设置

Apache在生成证书后也需要修改一下apache的配置文件 /usr/local/apache/conf/httpd.conf ,查找httpd-ssl将前面的#去掉。
然后再执行:
Apache 2.2如下:

cat >/usr/local/apache/conf/extra/httpd-ssl.conf<<EOF
Listen 443

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl

SSLCipherSuite EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5
SSLProxyCipherSuite EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5
SSLHonorCipherOrder on

SSLProtocol all -SSLv2 -SSLv3
SSLProxyProtocol all -SSLv2 -SSLv3
SSLPassPhraseDialog builtin

SSLSessionCache "shmcb:/usr/local/apache/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300

SSLMutex "file:/usr/local/apache/logs/ssl_mutex"

SSLStrictSNIVHostCheck on
NameVirtualHost *:443
EOF

Apache 2.4如下:

cat >/usr/local/apache/conf/extra/httpd-ssl.conf<<EOF
Listen 443

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl

SSLCipherSuite EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5
SSLProxyCipherSuite EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5
SSLHonorCipherOrder on

SSLProtocol all -SSLv2 -SSLv3
SSLProxyProtocol all -SSLv2 -SSLv3
SSLPassPhraseDialog builtin

SSLSessionCache "shmcb:/usr/local/apache/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300

Mutex sysvsem default

SSLStrictSNIVHostCheck on
EOF

并在对应apache虚拟主机配置文件的最后下面添加上SSL部分的配置文件:

<VirtualHost *:443>
	DocumentRoot /home/wwwroot/www.xiaokyun.com   #网站目录
	ServerName www.xiaokyun.com:443   #域名
	ServerAdmin admin@xiaokyun.com      #邮箱
	ErrorLog "/home/wwwlogs/www.xiaokyun.com-error_log"   #错误日志
	CustomLog "/home/wwwlogs/www.xiaokyun.com-access_log" common    #访问日志
	SSLEngine on
	SSLCertificateFile /etc/letsencrypt/live/www.xiaokyun.com/fullchain.pem   #改一下里面的域名就行
	SSLCertificateKeyFile /etc/letsencrypt/live/www.xiaokyun.com/privkey.pem    #改一下里面的域名就行

<Directory "/home/wwwroot/www.xiaokyun.com">   #网站目录
	SetOutputFilter DEFLATE
	Options FollowSymLinks
	AllowOverride All
	Order allow,deny
	Allow from all
	DirectoryIndex index.html index.php
</Directory>

</VirtualHost>

需将上述配置根据自己的实际情况修改后,添加到虚拟主机配置文件最后面。注意要重启apache使其实现。
执行:

/etc/init.d/httpd restart

重启Apache使其生效。

Let’s Encrypt+Nginx虚拟主机设置

完整配置如下:

server
{
listen 443 ssl; //如果需要spdy也可以加上,lnmp1.2及其后版本都默认支持spdy,lnmp1.3 nginx 1.9.5以上版本默认支持http2
server_name www.xiaokyun.com; //这里是你的域名
index index.html index.htm index.php default.html default.htm default.php;
root /home/wwwroot/www.xiaokyun.com; //网站目录
ssl_certificate /etc/letsencrypt/live/www.xiaokyun.com/fullchain.pem; //前面生成的证书,改一下里面的域名就行,不建议更换路径
ssl_certificate_key /etc/letsencrypt/live/www.xiaokyun.com/privkey.pem; //前面生成的密钥,改一下里面的域名就行,不建议更换路径
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;

include wordpress.conf; //这个是伪静态根据自己的需求改成其他或删除
#error_page 404 /404.html;
location ~ [^/].php(/|$)
{
# comment try_files $uri =404; to enable pathinfo
try_files $uri =404;
fastcgi_pass unix:/tmp/php-cgi.sock;
fastcgi_index index.php;
include fastcgi.conf; //lnmp 1.0及之前版本替换为include fcgi.conf;
#include pathinfo.conf;
}

location ~ .*.(gif|jpg|jpeg|png|bmp|swf)$
{
expires 30d;
}

location ~ .*.(js|css)?$
{
expires 12h;
}

access_log off;
}

需将上述配置根据自己的实际情况修改后,添加到虚拟主机配置文件最后面。

添加完需要执行:

/etc/init.d/nginx reload

重新载入配置使其生效。

如果需要HSTS,可以加上

add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

Let’s Encrypt免费SSL证书续期

1、Let’s Encrypt免费SSL证书有效期是90天,也就是每三个月你就得续期一次。采用官方的方法获取到的免费SSL证书,你不需要更改Apache和Nginx配置代码,执行以下代码即可自动替换证书为新的(注意修改域名和邮箱):

./letsencrypt-auto certonly –renew-by-default –email admin@gmail.com -d xiaokyun.com -d www.xiaokyun.com

2、采用上面脚本快速获取Let’s Encrypt免费SSL证书的,在90天内再次执行命令即可:

./letsencrypt.sh letsencrypt.conf

3、cron 定时任务。每个月自动更新一次证书,可以在脚本最后加入 service nginx reload等重新加载服务。

0 0 1 * * /etc/nginx/certs/letsencrypt.sh /etc/nginx/certs/letsencrypt.conf >> /var/log/lets-encrypt.log 2>&1

Let’s Encrypt SSL证书一键脚本

1、利用脚本快速获取Let’s Encrypt SSL证书,调用 acme_tiny.py 认证、获取、更新证书,不需要额外的依赖。

项目主页:https://github.com/xdtianyu/scripts/tree/master/lets-encrypt

2、下载到本地:

wget https://raw.githubusercontent.com/xdtianyu/scripts/master/lets-encrypt/letsencrypt.conf
wget https://raw.githubusercontent.com/xdtianyu/scripts/master/lets-encrypt/letsencrypt.sh
chmod +x letsencrypt.sh

Let’s Encrypt下载脚本

3、配置文件。只需要修改 DOMAIN_KEY DOMAIN_DIR DOMAINS 为你自己的信息

ACCOUNT_KEY=”letsencrypt-account.key”
DOMAIN_KEY=”xiaokyun.com.key”
DOMAIN_DIR=”/var/www/xiaokyun.com”
DOMAINS=”DNS:xiaokyun.com,DNS:www.xiaokyun.com”

4、已经绑定域名到 /var/www/www.xiaokyun.com 目录,即通过 http://xiaokyun.com 和 http://www.xiaokyun.com 可以访问到 /var/www/xiaokyun.com目录,用于域名的验证。

Let’s Encrypt安装使用教程

1、Let’s Encrypt官网:

1、官方网站:https://letsencrypt.org/
2、项目主页:https://github.com/letsencrypt/letsencrypt

2、安装Let’s Encrypt脚本依赖环境:(这一部分可以跳过,因为官方提供的Let’s Encrypt脚本会自动检测并安装)

# Debian
apt-get install git

# CentOS 6
yum install centos-release-SCL && yum update
yum install python27
scl enable python27 bash
yum install python27-python-devel python27-python-setuptools python27-python-tools python27-python-virtualenv
yum install augeas-libs dialog gcc libffi-devel openssl-devel python-devel
yum install python-argparse

# CentOS 7
yum install -y git python27
yum install -y augeas-libs dialog gcc libffi-devel openssl-devel python-devel
yum install python-argparse

3、查看自己的VPS主机到底是安装了哪个操作系统版本,可以执行命令:

cat /etc/issue 或者 cat /etc/redhat-release

4、获取Let’s Encrypt免费SSL证书很简单,你只需要执行以下命令,就会自动在你的VPS上生成SSL证书和私钥。

git clone https://github.com/letsencrypt/letsencrypt
cd letsencrypt
./letsencrypt-auto

执行上述命令后,会弹出对话框,同意用户协议。 接着会提示让你关闭Nginx或者Apache。 Let’s Encrypt需要用到80和443端口,所以你需要关闭那些占用这两个端口的应用。 Let’s Encrypt免费SSL证书获取成功了!