使用 .acme 申請 ECC, RSA 泛域名雙證書

使用 .acme 申請證書時，驗證域名支持多種方式
參考: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
這裡使用阿里雲雲解析 DNS 自動解析驗證域名

配置阿里雲密鑰#

# 阿里雲用戶密鑰(這裡建議使用只有DNS解析權限的子用戶)
export Ali_Key="<key>"
export Ali_Secret="<secret>"

創建 rsa 證書存儲目錄#

# rsa 目錄
mkdir -p /etc/letsencrypt/inbluemoon.com/rsa/

# ecc 目錄
mkdir -p /etc/letsencrypt/inbluemoon.com/ecc/

申請 rsa 證書#

./acme.sh --issue --dns dns_ali --keylength 2048 -d inbluemoon.com -d '*.inbluemoon.com'

將 rsa 證書安裝到指定目錄#

./acme.sh --installcert -d inbluemoon.com \
--key-file       /etc/letsencrypt/inbluemoon.com/rsa/privkey.pem  \
--fullchain-file /etc/letsencrypt/inbluemoon.com/rsa/fullchain.pem \
--cert-file      /etc/letsencrypt/inbluemoon.com/rsa/cert.pem \
--ca-file        /etc/letsencrypt/inbluemoon.com/rsa/chain.pem \
--reloadcmd     "nginx -s reload"

申請 ecc 證書#

./acme.sh --issue --keylength ec-256 --dns dns_ali -d inbluemoon.com -d '*.inbluemoon.com'

將 ecc 證書安裝到指定目錄#

./acme.sh --installcert --ecc -d inbluemoon.com \
--key-file       /etc/letsencrypt/inbluemoon.com/ecc/privkey.pem  \
--fullchain-file /etc/letsencrypt/inbluemoon.com/ecc/fullchain.pem \
--cert-file      /etc/letsencrypt/inbluemoon.com/ecc/cert.pem \
--ca-file        /etc/letsencrypt/inbluemoon.com/ecc/chain.pem \
--reloadcmd     "nginx -s reload"

自動續期#

./acme.sh --install-cronjob

Nginx 配置示例#

server {

    listen      443 ssl http2;
    server_name www.inbluemoon.com;

    # ECC Cert
    ssl_certificate             /etc/letsencrypt/inbluemoon.com/ecc/fullchain.pem;
    ssl_certificate_key         /etc/letsencrypt/inbluemoon.com/ecc/privkey.pem;
    
    # RSA Cert
    ssl_certificate             /etc/letsencrypt/inbluemoon.com/rsa/fullchain.pem;
    ssl_certificate_key         /etc/letsencrypt/inbluemoon.com/rsa/rsa/privkey.pem;
    
    ssl_session_cache           shared:SSL:10m;
    ssl_session_timeout         30m;
    ssl_protocols               TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers   on;
    ssl_ciphers                 ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE;

}