在Ubuntu系统中生成授信域名https证件文件

HTTPS证书，通常被称为SSL证书，也被称为服务器证书/网站安全证书，是一种数字证书。它基于SSL/TLS协议，在客户端（浏览器）与服务端（网站服务器）之间搭建一条安全的加密通道，由HTTP明文协议升级为HTTPS加密协议，对两者之间交换的信息进行加密，确保传输数据不被泄露或篡改，保护网站安全。当网站部署了HTTPS证书后，其URL将以"https://"开头，且浏览器地址栏显示安全锁标识，不再出现"不安全"的警告。

下面来生成一下免费授信的https证书，授权过程中需要借助云平台的DNS域名解析验证有效证书。

准备

安装前首先更新系统依赖包

bash 复制代码

apt update

https证书生成

安装证书工具

bash 复制代码

apt install certbot

生成通配符证书

bash 复制代码

certbot certonly --manual --email <这里填写你自己的邮箱> -d *.<这里填写你自己的域名>

示例：
certbot certonly --manual --email [email protected] -d *.ecnfo.com

验证过程 step 1

bash 复制代码

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf. You must agree in
order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A #这里输入A，同意

验证过程 step 2

bash 复制代码

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y #这里输入Y，同意

验证过程 step 3

bash 复制代码

NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y #这里输入Y，同意

验证过程 step 4，到这一步需要通过云平台辅助验证（这里以阿里云为例）

bash 复制代码

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.ecnfo.com with the following value:

evklose2epIeMtagmtnOMhbVyGK8lHyEoGLpq9XIh5M

Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue

验证过程 step 4.1

打开阿里云控制台，搜索DNS云解析并打开域名解析页面

点击对应域名的解析设置

验证过程 step 4.2

添加一条解析txt解析记录保存即可

验证过程 step 5

bash 复制代码

云平台设置完成后，在终端回车后等待几十秒证书即可生成成功

Copy证书到指定的目录（到这里你的授信证书就已经生成好了）

这里将/path/替换为你自己的目录

bash 复制代码

cp /etc/letsencrypt/live/ecnfo.com/fullchain.pem /path/ecnfo.com.pem
cp /etc/letsencrypt/live/ecnfo.com/privkey.pem /path/ecnfo.com.key

证书自动续签

上面生成的证书有效期只有3个月，需要通过crontab做定时检测续签才能保证证书的长期有效
新建一个证书更新shell脚本

vim update_harbor_cert.sh

bash 复制代码

/usr/bin/certbot renew --quiet
cp /etc/letsencrypt/live/ecnfo.com/fullchain.pem /path/ecnfo.com.pem
cp /etc/letsencrypt/live/ecnfo.com/privkey.pem /path/ecnfo.com.key

在crontab添加定时任务，每个月的第一天检测证书有没有过期

bash 复制代码

0 0 1 * * /root/cmds/updates/certs/update_harbor_cert.sh