免费域名证书＋nginx开启https访问
越来越多的网站开始启用https访问，包括谷歌也表示提升https网站在搜索结果中的排名。
开启https首先需要有域名证书，大多都是要收费的，个人站在使用let‘s encrypt的免费证书就可以。
本站的证书效果：
生成办法：
第一步 下载域名证书工具
|
1 2 3 |
wget https://dl.eff.org/certbot-auto --no-check-certificate chmod +x ./certbot-auto ./certbot-auto -n |
第二步 生成证书，只需修改邮箱 网站根目录 域名就可以了。
执行生成证书命令前需要在nginx支持网站所有权验证
2.1 增加隐藏目录访问
|
1 2 3 |
location ~ /.well-known { allow all; } |
2.2 生成域名证书
|
1 |
./certbot-auto certonly --email tougao@nginx.cn --agree-tos --no-eff-email --webroot -w /home/www/nginx/ -d blog.redis.com.cn |
第三步 修改nginx 配置支持https方式访问
上一步生成的证书
/etc/letsencrypt/live/blog.redis.com.cn/fullchain.pem
/etc/letsencrypt/live/blog.redis.com.cn/privkey.pem
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 |
server { server_name nginx.cn; return 301 $scheme://blog.redis.com.cn$request_uri; } server { server_name blog.redis.com.cn; root /home/www/nginx/; return 301 https://blog.redis.com.cn$request_uri; error_log logs/nginx.error.log; index index.php; location /doc { index index.html; } location / { # This is cool because no php is touched for static content. # include the "?$args" part so non-default permalinks doesn't # break when using query string try_files $uri $uri/ /index.php?$args; } location ~* \.(log)$ { log_not_found off; } include location.conf; include agent_deny.conf; access_log /home/logs/nginx/default.log access; error_page 404 /404.html; } server { listen 443 ssl; server_name blog.redis.com.cn; root /home/www/nginx/; ssl_certificate /etc/letsencrypt/live/blog.redis.com.cn/fullchain.pem; #前面生成的证书，改一下里面的域名就行 ssl_certificate_key /etc/letsencrypt/live/blog.redis.com.cn/privkey.pem; #前面生成的密钥，改一下里面的域名就行 ssl_ciphers "EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5"; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; error_log logs/nginx.error.log; index index.php; location /doc { index index.html; } location / { # This is cool because no php is touched for static content. # include the "?$args" part so non-default permalinks doesn't # break when using query string try_files $uri $uri/ /index.php?$args; } location ~* \.(log)$ { log_not_found off; } include location.conf; include agent_deny.conf; access_log /home/logs/nginx/default.log access; error_page 404 /404.html; } |
第四步 定时更新证书
crontab 中增加定时任务，每15天更新一次证书
Let's Encrypt证书是有效期90天的，需要我们自己手工更新续期才可以
|
1 |
0 3 */15 * * /root/certbot-auto renew --disable-hook-validation --renew-hook "/etc/init.d/nginx reload" |
分类: nginx
帝王决战 架设www.46wy.cn
It's really very complex in this active life to listen news on TV, therefore I just use
web for that reason, and take the newest information.