ubuntu部署ssl证书

证书安装

在进行证书安装前，需要将域名的 DNS 指定到你的 ubuntu 服务器节点上，ubuntu 安装 Let's Encrypt 证书步骤如下

安装 certbot 工具

apt update
apt install certbot python3-certbot-nginx

运行 certbot 命令进行证书安装

对于 nginx

certbot --nginx -d mydomain.com -d www.mydomain.com

对于 apache

certbot --apache -d mydomain.com -d www.mydomain.com

如果不填写邮箱的话，可以指定 certbot 参数 --register-unsafely-without-email，生成证书的输出如下

root@ubuntu:~# certbot --nginx -d mydomain.com -d www.mydomain.com --register-unsafely-without-email 
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: 
(Y)es/(N)o: y
Account registered.
Requesting a certificate for mydomain.com and www.mydomain.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/mydomain.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/mydomain.com/privkey.pem
This certificate expires on 2025-06-13.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for mydomain.com to /etc/nginx/nginx.conf
Successfully deployed certificate for www.mydomain.com to /etc/nginx/nginx.conf
Congratulations! You have successfully enabled HTTPS on https://mydomain.com and https://www.mydomain.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

自动续订证书

Let's Encrypt 证书的有效期为 90 天，需要定期续订避免过期，Certbot 会自动设置一个系统定时器，以自动续订证书

可以使用以下命令来测试证书续订

certbot renew --dry-run

输出信息如下

root@ubuntu:~# certbot renew --dry-run 
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/mydomain.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Simulating renewal of an existing certificate for mydomain.com and www.mydomain.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all simulated renewals succeeded: 
  /etc/letsencrypt/live/mydomain.com/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -