SSL证书这么用

HTTPS 化

近日，谷歌工程师宣布将在2018年第二季度发布的Chrome 67中禁止一切使用不安全来源的呈现API(Presentation API)。 Presentation API, 即呈现API，是一个能使网页内容访问演示文稿显示并呈现自身的W3C标准技术。它允许设备在第二屏幕上显示内容，例如投影机或电视机。 Presentation API更显着的用途之一是谷歌在Chrome，Android和Chrome Cast设备上提供的“Casting”功能。

Let's Encrypt

https://letsencrypt.org/ Let's Encrypt 项目由 EFF、 Mozilla、Akamai、密歇根大学和思科等组织发起，由非营利组织互联网安全研究集团（Internet Security Research Group）经营，其使命是让每个网站都能使用 HTTPS 加密。 Let's Encrypt 项目宣布它已签发了超过 1 亿个证书。

图片.png

下载客户端

https://github.com/certbot/certbot/releases

1    wget https://github.com/certbot/certbot/archive/v0.15.0.tar.gz
2
3    tar -xvf v0.15.0.tar.gz
4
5    cd certbot-0.15.0

三种安装模式

1    ./letsencrypt-auto --help
2

Manual

1    // 在非目标服务器上执行模式
2    --manual          Obtain certificates interactively, or using shell script hooks

执行如下命令

1    ./letsencrypt-auto certonly --manual -d gg.fabself.net
2
3
4Saving debug log to /var/log/letsencrypt/letsencrypt.log
5Obtaining a new certificate
6Performing the following challenges:
7http-01 challenge for gg.fabself.net
8
9-------------------------------------------------------------------------------
10NOTE: The IP of this machine will be publicly logged as having requested this
11certificate. If you're running certbot in manual mode on a machine that is not
12your server, please ensure you're okay with that.
13
14Are you OK with your IP being logged?
15-------------------------------------------------------------------------------
16(Y)es/(N)o:Y

Yes 过后有如下提示：

1Make sure your web server displays the following content at
2http://gg.fabself.net/.well-known/acme-challenge/LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw before continuing:
3
4LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw.3h_8AoI_OjBsHFko6XV4wNW6f_WlyXhoaEsne5R6Zw0
5
6If you don't have HTTP server configured, you can run the following
7command on the target server (as root):
8
9mkdir -p /tmp/certbot/public_html/.well-known/acme-challenge
10cd /tmp/certbot/public_html
11printf "%s" LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw.3h_8AoI_OjBsHFko6XV4wNW6f_WlyXhoaEsne5R6Zw0 > .well-known/acme-challenge/LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw
12# run only once per server:
13$(command -v python2 || command -v python2.7 || command -v python2.6) -c \
14"import BaseHTTPServer, SimpleHTTPServer; \
15s = BaseHTTPServer.HTTPServer(('', 80), SimpleHTTPServer.SimpleHTTPRequestHandler); \
16s.serve_forever()"
17-------------------------------------------------------------------------------
18Press Enter to Continue

在回车之前，按以上提示登录到 目标服务器，执行以上脚本再回到操作机器上回车，可以看到如下：

1Waiting for verification...
2Cleaning up challenges
3
4IMPORTANT NOTES:
5 - Congratulations! Your certificate and chain have been saved at
6   /etc/letsencrypt/live/gg.fabself.net/fullchain.pem. Your cert will
7   expire on 2017-10-01. To obtain a new or tweaked version of this
8   certificate in the future, simply run letsencrypt-auto again. To
9   non-interactively renew *all* of your certificates, run
10   "letsencrypt-auto renew"
11 - If you like Certbot, please consider supporting our work by:
12
13   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
14   Donating to EFF:                    https://eff.org/donate-le

证书已经签好，并放在了指定目录下 /etc/letsencrypt/live

tree 一下看看文件列表

1sudo tree /etc/letsencrypt/live/
2
3/etc/letsencrypt/live/
4└── gg.fabself.net
5    ├── README
6    ├── cert.pem -> ../../archive/gg.fabself.net/cert1.pem
7    ├── chain.pem -> ../../archive/gg.fabself.net/chain1.pem
8    ├── fullchain.pem -> ../../archive/gg.fabself.net/fullchain1.pem
9    └── privkey.pem -> ../../archive/gg.fabself.net/privkey1.pem

Standalone

1        //在目标主机上操作模式
2     --standalone      Run a standalone webserver for authentication

执行如下命令，执行命令之前确保 nginx／Apache 已关闭

    ./letsencrypt-auto certonly --standalone -d gg.fabself.net

很速度

1Saving debug log to /var/log/letsencrypt/letsencrypt.log
2Obtaining a new certificate
3Performing the following challenges:
4tls-sni-01 challenge for gg.fabself.net
5Waiting for verification...
6Cleaning up challenges
7
8IMPORTANT NOTES:
9 - Congratulations! Your certificate and chain have been saved at
10   /etc/letsencrypt/live/gg.fabself.net/fullchain.pem. Your cert will
11   expire on 2017-10-01. To obtain a new or tweaked version of this
12   certificate in the future, simply run letsencrypt-auto again. To
13   non-interactively renew *all* of your certificates, run
14   "letsencrypt-auto renew"
15 - If you like Certbot, please consider supporting our work by:
16
17   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
18   Donating to EFF:                    https://eff.org/donate-le
19
20
21sudo tree /etc/letsencrypt/live
22/etc/letsencrypt/live
23`-- gg.fabself.net
24    |-- cert.pem -> ../../archive/gg.fabself.net/cert1.pem
25    |-- chain.pem -> ../../archive/gg.fabself.net/chain1.pem
26    |-- fullchain.pem -> ../../archive/gg.fabself.net/fullchain1.pem
27    |-- privkey.pem -> ../../archive/gg.fabself.net/privkey1.pem
28    `-- README

Webroot

1    //在目标主机上，nginx/Apache 启动的状态下，指定文件目录操作模式
2    --webroot         Place files in a server's webroot folder for authentication

执行如下命令

1    ./letsencrypt-auto certonly --webroot -w  /usr/share/nginx/html -d gg.fabself.net
2
3
4Saving debug log to /var/log/letsencrypt/letsencrypt.log
5Obtaining a new certificate
6Performing the following challenges:
7http-01 challenge for gg.fabself.net
8Using the webroot path /usr/share/nginx/html for all unmatched domains.
9Waiting for verification...
10Cleaning up challenges
11
12IMPORTANT NOTES:
13 - Congratulations! Your certificate and chain have been saved at
14   /etc/letsencrypt/live/gg.fabself.net/fullchain.pem. Your cert will
15   expire on 2017-10-01. To obtain a new or tweaked version of this
16   certificate in the future, simply run letsencrypt-auto again. To
17   non-interactively renew *all* of your certificates, run
18   "letsencrypt-auto renew"
19 - If you like Certbot, please consider supporting our work by:
20
21   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
22   Donating to EFF:                    https://eff.org/donate-le
23
24
25sudo tree /etc/letsencrypt/live
26/etc/letsencrypt/live
27`-- gg.fabself.net
28    |-- cert.pem -> ../../archive/gg.fabself.net/cert1.pem
29    |-- chain.pem -> ../../archive/gg.fabself.net/chain1.pem
30    |-- fullchain.pem -> ../../archive/gg.fabself.net/fullchain1.pem
31    |-- privkey.pem -> ../../archive/gg.fabself.net/privkey1.pem
32    `-- README

证书部署

证书描述 cert.pem 申请的服务器证书文件

privkey.pem 服务器证书对应的私钥

chain.pem 除服务器证书外，浏览器解析所需的其他全部证书，比如根证书和中间证书

fullchain.pem 包含服务器证书的全部证书链文件

** nginx 配置**

打开 nginx.conf，配置 443 端口及证书路径

1    server {
2        listen 443;
3        server_name gg.fabself.net;
4
5        root /usr/share/nginx/html;
6        index index.html index.htm;
7        ssl on;
8        ssl_certificate /etc/letsencrypt/live/gg.fabself.net/fullchain.pem;
9        ssl_certificate_key /etc/letsencrypt/live/gg.fabself.net/privkey.pem;
10        ssl_session_timeout 5m;
11        ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
12        ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
13        ssl_prefer_server_ciphers on;
14
15        location / {
16                try_files $uri $uri/ =404;
17        }
18    }

配置 80 端口重定向至 433

1    server {
2        listen 80 default_server;
3        listen [::]:80 default_server ipv6only=on;
4        root /usr/share/nginx/html;
5        index index.html index.htm;
6        server_name gg.fabself.net;
7        return 301 https://$server_name$request_uri;
8    }

就这样简单，HTTPS 配置成功

图片.png

证书有效期 90 天

更新证书

自动更新需要在 目标主机 上进行，选用 standalone 或 Webroot模式比较适用

    ./letsencrypt-auto renew

如果提示如下，说明证书还没有过期，就耐心等待

1-------------------------------------------------------------------------------
2Processing /etc/letsencrypt/renewal/gg.fabself.net.conf
3-------------------------------------------------------------------------------
4Cert not yet due for renewal
5
6The following certs are not due for renewal yet:
7  /etc/letsencrypt/live/gg.fabself.net/fullchain.pem (skipped)
8No renewals were attempted.
9
10
11考虑更自动化的方式，可以把 `./letsencrypt-auto renew` 加入到 `crontab` 中，可以每天更新两次保障