Ubuntu 18.04 Install Certbot Nginx 自動更新憑證 - IT 484

Ubuntu 18.04 Install Certbot Nginx 自動更新憑證 – IT 484

Post author:若雪
Post published:2022-08-29
Post category:IT / Certbot
Post comments:0 Comments
Post last modified:2023-01-13

從套件庫安裝憑證機器人，在免費憑證三個月到期前，自動更新憑證，可以使用 apt-get 來達成，這是最簡單的方法。

Table of Contents

功能簡介

Certbot 是一個易於使用的 SSL 憑證機器人，可以從獲取免費憑證，並將其部署到 Web Server 。

Ubuntu 18.04 Install Certbot Nginx

從套件庫，使用 apt-get 命令安裝，Certbot Nginx Plugin。

apt-get update
apt-get -y install software-properties-common
add-apt-repository ppa:certbot/certbot
apt-get update
apt-get -y install python-certbot-nginx

DNS 設定

請到申請的網域註冊商，登入帳號管理網域，將網域指向目標主機 IP。

申請憑證

設定 Nginx 的所在目錄，及將 sample 改成你的網域與信箱，使用 certbot 命令申請。

certbot --agree-tos certonly --nginx --nginx-server-root /etc/nginx -d sample.cc -d www.sample.cc -m sample@cc

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel):

選 1，自行設定 https，申請成功後，顯示如下訊息。

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/sample.cc/fullchain.pem. Your cert will
   expire on 2023-04-30. To obtain a new or tweaked version of this
   certificate in the future, simply run certbot again with the
   "certonly" option. To non-interactively renew *all* of your
   certificates, run "certbot renew"

組態設定

vim /etc/nginx/conf.d/sample.conf

server {
    listen 443 ssl;
    server_name www.sample.cc;

	ssl_certificate /etc/letsencrypt/live/sample.cc/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/sample.cc/privkey.pem;
	include /etc/letsencrypt/options-ssl-nginx.conf;
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}