離央

離央

温良恭谦
github
telegram
steam
email

使用 .acme 申請 ECC, RSA 泛域名雙證書

使用 .acme 申請證書時,驗證域名支持多種方式
參考: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
這裡使用阿里雲雲解析 DNS 自動解析驗證域名

配置阿里雲密鑰#
# 阿里雲用戶密鑰(這裡建議使用只有DNS解析權限的子用戶)
export Ali_Key="<key>"
export Ali_Secret="<secret>"
創建 rsa 證書存儲目錄#
# rsa 目錄
mkdir -p /etc/letsencrypt/inbluemoon.com/rsa/

# ecc 目錄
mkdir -p /etc/letsencrypt/inbluemoon.com/ecc/
申請 rsa 證書#
./acme.sh --issue --dns dns_ali --keylength 2048 -d inbluemoon.com -d '*.inbluemoon.com'
將 rsa 證書安裝到指定目錄#
./acme.sh --installcert -d inbluemoon.com \
--key-file       /etc/letsencrypt/inbluemoon.com/rsa/privkey.pem  \
--fullchain-file /etc/letsencrypt/inbluemoon.com/rsa/fullchain.pem \
--cert-file      /etc/letsencrypt/inbluemoon.com/rsa/cert.pem \
--ca-file        /etc/letsencrypt/inbluemoon.com/rsa/chain.pem \
--reloadcmd     "nginx -s reload"
申請 ecc 證書#
./acme.sh --issue --keylength ec-256 --dns dns_ali -d inbluemoon.com -d '*.inbluemoon.com'
將 ecc 證書安裝到指定目錄#
./acme.sh --installcert --ecc -d inbluemoon.com \
--key-file       /etc/letsencrypt/inbluemoon.com/ecc/privkey.pem  \
--fullchain-file /etc/letsencrypt/inbluemoon.com/ecc/fullchain.pem \
--cert-file      /etc/letsencrypt/inbluemoon.com/ecc/cert.pem \
--ca-file        /etc/letsencrypt/inbluemoon.com/ecc/chain.pem \
--reloadcmd     "nginx -s reload"
自動續期#
./acme.sh --install-cronjob
Nginx 配置示例#
server {

    listen      443 ssl http2;
    server_name www.inbluemoon.com;

    # ECC Cert
    ssl_certificate             /etc/letsencrypt/inbluemoon.com/ecc/fullchain.pem;
    ssl_certificate_key         /etc/letsencrypt/inbluemoon.com/ecc/privkey.pem;
    
    # RSA Cert
    ssl_certificate             /etc/letsencrypt/inbluemoon.com/rsa/fullchain.pem;
    ssl_certificate_key         /etc/letsencrypt/inbluemoon.com/rsa/rsa/privkey.pem;
    
    ssl_session_cache           shared:SSL:10m;
    ssl_session_timeout         30m;
    ssl_protocols               TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers   on;
    ssl_ciphers                 ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE;

}
載入中......
此文章數據所有權由區塊鏈加密技術和智能合約保障僅歸創作者所有。