阿里云SSL证书到期更换指南（Nginx + Typecho）

一、备份当前证书（以防新证书有问题能秒回滚）

bash 复制代码

[root@rocky8 conf.d]#pwd
/apps/nginx/conf/conf.d
[root@rocky8 conf.d]#ll
total 12
drwxr-xr-x 2 root root   60 Aug  4 18:10 ssl
-rw-r--r-- 1 root root 5646 Sep  4 13:53 typecho.conf
-rw-r--r-- 1 root root 2526 Aug 16 12:40 typecho.conf.bak
[root@rocky8 conf.d]#
[root@rocky8 conf.d]#cp -a /apps/nginx/conf/conf.d/ssl/ /apps/nginx/conf/conf.d/ssl.bak.$(date +%F)


#确认备份在了：
[root@rocky8 conf.d]#ls /apps/nginx/conf/conf.d/ssl.bak.2026-10-31/
chenchengpei.cn.key  chenchengpei.cn.pem

二、确认证书文件

阿里云SSL证书下载后通常包含两个文件：

证书文件（.pem 或 .crt）

私钥文件（.key）

上传证书到服务器‌：

bash 复制代码

# 上传证书文件并解压
[root@rocky8 conf.d]#ll
total 20
-rw-r--r-- 1 root root 4597 Oct 31 17:22 28200918_www.chenchengpei.cn_nginx.zip
drwxr-xr-x 2 root root   60 Aug  4 18:10 ssl
drwxr-xr-x 2 root root   60 Aug  4 18:10 ssl.bak.2026-10-31
-rw-r--r-- 1 root root 5646 Sep  4 13:53 typecho.conf
-rw-r--r-- 1 root root 2526 Aug 16 12:40 typecho.conf.bak

[root@rocky8 conf.d]#unzip 28200918_www.chenchengpei.cn_nginx.zip 

[root@rocky8 conf.d]#ls -la 28200918_www.chenchengpei.cn_nginx/
total 8
drwxrwxrwx 2 root root   68 Oct 31 16:12 .
drwxr-xr-x 5 root root  175 Oct 31 17:29 ..
-rw-rw-rw- 1 root root 1679 Oct 31 16:06 www.chenchengpei.cn.key
-rw-rw-rw- 1 root root 3842 Oct 31 16:06 www.chenchengpei.cn.pem

三、覆盖

bash 复制代码

[root@rocky8 conf.d]#cp 28200918_www.chenchengpei.cn_nginx/www.chenchengpei.cn.pem ssl/chenchengpei.cn.pem

[root@rocky8 conf.d]#cp 28200918_www.chenchengpei.cn_nginx/www.chenchengpei.cn.key ssl/chenchengpei.cn.key

#修改证书权限
[root@rocky8 conf.d]#chmod 600 ssl/*.key
[root@rocky8 conf.d]#chmod 644 ssl/*.pem
[root@rocky8 conf.d]#chown nginx:nginx ssl/*


#确认覆盖结果
[root@rocky8 conf.d]#ls -la ssl/
total 8
drwxr-xr-x 2 root  root    60 Aug  4 18:10 .
drwxr-xr-x 5 root  root   175 Oct 31 17:29 ..
-rw------- 1 nginx nginx 1679 Oct 31 17:37 chenchengpei.cn.key
-rw-r--r-- 1 nginx nginx 3842 Oct 31 17:37 chenchengpei.cn.pem

四、测试 + 热加载

bash 复制代码

[root@rocky8 conf.d]#nginx -t && nginx -s reload
nginx: the configuration file /apps/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /apps/nginx/conf/nginx.conf test is successful

#没报错就说明配置没问题、平滑加载成功。

五、验证新证书生效

bash 复制代码

[root@rocky8 conf.d]#echo | openssl s_client -servername www.chenchengpei.cn -connect 127.0.0.1:443 2>/dev/null | openssl x509 -noout -dates -subject
notBefore=Oct 31 00:00:00 2026 GMT
notAfter=Jan 28 23:59:59 2027 GMT
subject=CN = www.chenchengpei.cn

#证书生效时间是 2026年10月31日
#证书过期时间是 2027年1月28日

六、顺手清一下临时文件

bash 复制代码

[root@rocky8 conf.d]#rm -rf /apps/nginx/conf/conf.d/28200918_www.chenchengpei.cn_nginx /apps/nginx/conf/conf.d/28200918_www.chenchengpei.cn_nginx.zip

七、验证网站访问正常

bash 复制代码

#验证 SSL和HSTS 安全头
[root@rocky8 conf.d]#curl -I https://www.chenchengpei.cn
HTTP/2 200 
server: nginx
date: Sat, 31 Oct 2026 10:07:43 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
expires: Sat, 31 Oct 2026 10:07:42 GMT
cache-control: no-cache
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
pragma: no-cache
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:;

[root@rocky8 conf.d]#curl -I https://www.chenchengpei.cn | grep -i strict
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
strict-transport-security: max-age=63072000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin