Amazon Linux2中如何生成和使用Let's Encrypt的证书

在Amazon Linux中使用certbot来创建Let’s Encrypt的证书，步骤如下:

安装certbot

1
2
sudo amazon-linux-extras install epel
sudo yum install certbot python-certbot-nginx

设置certbot生成证书

1
sudo certbot certonly  -d *.examplexxx.com --manual --preferred-challenges dns

其中:

  • certonly: 指只生成证书而不部署
  • -d *.examplexxx.com: 指需要生成的是examplexxx.com的通配域名
  • --manual: 指指定交互方式
  • --preferred-challenges dns: 指使用dns方式验证，(泛域名/通配域名只能通过此方式进行)

命令输出结果:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): carl.shen@examplexxx.com 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: n
Account registered.
Requesting a certificate for *.examplexxx.com
Performing the following challenges:
dns-01 challenge for examplexxx.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.examplexxx.com with the following value:
k5lqqiY2x3U_ER6oXnmXQvSAUO_l3Lo7W7fpczhblR4
Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Waiting for verification...
Cleaning up challenges
IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/examplexxx.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/examplexxx.com/privkey.pem
   Your certificate will expire on 2022-10-03. To obtain a new or
   tweaked version of this certificate in the future, simply run
   certbot again. To non-interactively renew *all* of your
   certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:
   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le
$

依次需要的操作如下:

  • 填写联系邮箱: 此处填写的是carl.shen@examplexxx.com
  • 是否同意服务条款: 需要填写Yes
  • 是否要分享邮件给EFF， 可选Yes或者No, 这边填写的是No
  • 通配符域名需要添加DNS验证: 需要根据提示的信息在DNS中添加一个TXT记录，用来验证域名的所有权
    • 此处需要添加_acme-challenge.examplexxx.com的TXT记录为k5lqqiY2x3U_ER6oXnmXQvSAUO_l3Lo7W7fpczhblR4

结束后，生成的证书会存放在/etc/letsencrypt/live/目录下

  • 证书和链存放在: /etc/letsencrypt/live/examplexxx.com/fullchain.pem
  • 私钥文件存放在: /etc/letsencrypt/live/examplexxx.com/privkey.pem

nginx如何使用该证书

设置nginx使用对应的证书文件

1
2
ssl_certificate      /etc/letsencrypt/live/examplexxx.com/fullchain.pem;
ssl_certificate_key  /etc/letsencrypt/live/examplexxx.com/privkey.pem;

如何renew

Let’s Encrypt的证书只有三个月的有效期，所以需要经常更新。更新命令如下:

1
certbot renew --no-self-upgrade

可设置crontab命令每天更新:

1
39 1,13 * * * certbot renew --no-self-upgrade

不需要更新时，日志输出为:

1
2
3
4
5
6
7
8
9
10
11
12
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/examplexxx.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not yet due for renewal
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certificates are not due for renewal yet:
  /etc/letsencrypt/live/examplexxx.com/fullchain.pem expires on 2022-10-03 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Reference

留言

▲