linux中擷取/更新Let’s encrypt 認證的指令碼

調用 acme_tiny.py 認證、擷取、更新認證，不需要額外的依賴。

下載到本地

wget https://raw.githubusercontent.com/xdtianyu/scripts/master/lets-encrypt/letsencrypt.conf
wget https://raw.githubusercontent.com/xdtianyu/scripts/master/lets-encrypt/letsencrypt.sh
chmod +x letsencrypt.sh
設定檔

只需要修改 DOMAIN_KEY DOMAIN_DIR DOMAINS 為你自己的資訊

ACCOUNT_KEY=”letsencrypt-account.key”
DOMAIN_KEY=”example.com.key”
DOMAIN_DIR=”/var/www/example.com”
DOMAINS=”DNS:example.com,DNS:whatever.example.com”
執行過程中會自動產生需要的 key 檔案。

運行

./letsencrypt.sh letsencrypt.conf
注意

需要已經綁定網域名稱到 /var/www/example.com 目錄，即通過 http://example.com http://whatever.example.com 可以訪問到 /var/www/example.com 目錄，用於網域名稱的驗證

看到以下資訊表示產生/更新成功

Generate CSR…
Parsing account key…
Parsing CSR…
Registering account…
Already registered!
Verifying www.hdj.me…
www.hdj.me verified!
Signing certificate…
Certificate signed!
New cert: www.chained.crt has been generated
產生認證包括

-rw-r–r– 1 root root 3.2K Dec 28 17:04 letsencrypt-account.key
-rw-r–r– 1 root root 192 Dec 28 17:03 letsencrypt.conf
-rwxr-xr-x 1 root root 1.7K Dec 28 16:57 letsencrypt.sh
-rw-r–r– 1 root root 1.7K Dec 24 00:58 lets-encrypt-x1-cross-signed.pem
-rw-r–r– 1 root root 3.4K Dec 29 08:38 www.chained.crt
-rw-r–r– 1 root root 1.8K Dec 29 08:38 www.crt
-rw-r–r– 1 root root 920 Dec 29 08:37 www.csr
-rw-r–r– 1 root root 1.7K Dec 28 17:04 example.com.key
nginx配置

listen 443 ssl;
ssl_certificate /path/letsencrypt/www.chained.crt;
ssl_certificate_key /path/letsencrypt/example.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
cron 定時任務

每個月自動更新一次認證，可以在指令碼最後加入 service nginx reload等重新載入服務。

0 0 1 * * /etc/nginx/certs/letsencrypt.sh /etc/nginx/certs/letsencrypt.conf >> /var/log/lets-encrypt.log 2>&1