缘起：云厂商卖的SSL证书太贵
概述：Let’s Encrypt
支持申请免费SSL证书的CA机构
- 支持提供免费SSL证书的CA机构有：
Let’s Encrypt
ZeroSSL
SSL For Free
Cloudflare
BuyPass
AWS
- 本文我们来试试 Let’s Encrypt 怎么用。
https://letsencrypt.org/zh-cn/getting-started/
Let’s Encrypt是一个提供 免费 SSL/TLS 证书 的认证机构（CA），旨在通过简化证书申请和安装过程来普及HTTPS加密，提升互联网安全性。
它由
Internet Security Research Group(ISRG) 运营，并在全球范围内免费提供数字证书，用于加密网站流量，防止数据在传输过程中被窃取或篡改。
Let’s Encrypt是一个非常受欢迎且实用的工具，能够帮助网站管理员免费获得SSL/TLS证书并轻松安装，尤其适用于那些希望以低成本保障网站安全的小型网站和个人项目。
然而，对于需要更高级别验证（如
EV证书）的大型网站或企业来说，Let’s Encrypt可能不完全符合需求。
申请需求
- 要在 CentOS 7 上使用 Let’s Encrypt 并通过 DNS 验证申请 SSL 证书，而不依赖 80 端口，可以选择
Certbot的 DNS 验证模式。
这种方法适用于可以访问域名的 DNS 管理，并手动添加验证记录。
完成验证后，您可以手动将生成的证书文件复制到目标机器上进行安装。
- 假定域名为:
xxx.yyy.com
安装步骤
Step1 安装 Certbot
- 在 CentOS 7 上安装 Certbot：
sudo yum install epel-release -y
sudo yum install certbot -y
Step2 使用 DNS 验证生成证书
- 启动 DNS 验证模式
sudo certbot certonly --manual --preferred-challenges dns -d xxx.yyy.com
--manual：表示手动输入 DNS 记录--preferred-challenges dns：指定使用 DNS 验证方式-d xxx.yyy.com：需要申请证书的域名
运行日志
[root@iZ2vch0mnibcoiyvvwc5yjZ ~]# sudo certbot certonly --manual --preferred-challenges dns -d xxx.yyy.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Enter email address (used for urgent renewal and security notices)(Enter 'c' to cancel): data-roads@foxmail.com
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf. You must agree in
order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.
Requesting a certificate for xxx.yyy.com
Performing the following challenges:
dns-01 challenge for xxx.yyy.com- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.xxx.yyy.com with the following value:hX5FAFXXInMBXXOCsgXXHNTNyJNdZ4xWI1CAxxQLynABefore continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to ContinueWaiting for verification...
Challenge failed for domain xxx.yyy.com
dns-01 challenge for xxx.yyy.com
Cleaning up challenges
Some challenges have failed.IMPORTANT NOTES:- The following errors were reported by the server:Domain: xxx.yyy.comType: dnsDetail: DNS problem: NXDOMAIN looking up TXT for_acme-challenge.xxx.yyy.com - check that a DNS record exists forthis domain//因没有配置 _acme-challenge.xxx.yyy.com 域名的 DNS 解析记录， 失败后重试：[root@xxxxxx ~]# sudo certbot certonly --manual --preferred-challenges dns -d xxx.yyy.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Requesting a certificate for xxx.yyy.com
Performing the following challenges:
dns-01 challenge for xxx.yyy.com- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.xxx.yyy.com with the following value:-nS5KXpkxersdfewwefewfewfewfeFMJ7QAN4kBefore continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Waiting for verification...
Cleaning up challengesIMPORTANT NOTES:- Congratulations! Your certificate and chain have been saved at:/etc/letsencrypt/live/xxx.yyy.com/fullchain.pemYour key file has been saved at:/etc/letsencrypt/live/xxx.yyy.com/privkey.pemYour certificate will expire on 2025-04-07. To obtain a new ortweaked version of this certificate in the future, simply runcertbot again. To non-interactively renew *all* of yourcertificates, run "certbot renew"- If you like Certbot, please consider supporting our work by:Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donateDonating to EFF: https://eff.org/donate-le
- Q1: Certbot 会提示创建一个特定的
DNS TXT记录来验证域名。您会看到类似以下的提示信息：
Please deploy a DNS TXT record under the name
_acme-challenge.api.moon.com with the following value:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXBefore continuing, verify the record is deployed.
- 登录自己的 DNS 提供商控制台，在
xxx.yyy.com的DNS配置中添加一个TXT记录：
名称：acme-challenge.xxx.yyy.com
类型：TXT
值：Certbot 提供的值（如上所示的随机字符串）
等待几分钟，确保新添加的
DNS记录已经传播。您可以使用以下命令确认 DNS 记录是否生效：
# 安装 nslookup
sudo yum install bind-utils# dns 验证
nslookup -type=TXT _acme-challenge.xxx.yyy.com
运行日志
[root@iZ2vch0mnibcoiyvvwc5yjZ ~]# nslookup -type=TXT _acme-challenge.xxx.yyy.com
Server: 10.10.132.101
Address: 10.10.132.101#53Non-authoritative answer:
_acme-challenge.xxx.yyy.com text = "-nS5KXpkxersdfewwefewfewfewfeFMJ7QAN4k"Authoritative answers can be found from:
- 一旦
DNS记录生效并验证成功，返回到Certbot命令窗口，并按下回车键继续。Certbot 会自动完成验证，并生成 SSL 证书文件。
Step3 找到生成的证书文件
- 验证成功后，
Certbot会将证书文件存放在/etc/letsencrypt/live/xxx.yyy.com/目录下，包括以下文件：
fullchain.pem：完整的证书链privkey.pem：私钥文件
[root@xxx ~]# ll /etc/letsencrypt/live/xxx.yyy.com/
总用量 4
lrwxrwxrwx 1 root root 36 1月 8 00:41 cert.pem -> ../../archive/xxx.yyy.comn/cert1.pem
lrwxrwxrwx 1 root root 37 1月 8 00:41 chain.pem -> ../../archive/xxx.yyy.com/chain1.pem
lrwxrwxrwx 1 root root 41 1月 8 00:41 fullchain.pem -> ../../archive/xxx.yyy.com/fullchain1.pem
lrwxrwxrwx 1 root root 39 1月 8 00:41 privkey.pem -> ../../archive/xxx.yyy.com/privkey1.pem
-rw-r--r-- 1 root root 692 1月 8 00:41 README
Step4 将SSL证书文件复制到目标服务器
- 使用
scp或其他工具将生成的证书文件复制到目标服务器，比如：
scp /etc/letsencrypt/live/xxx.yyy.com/fullchain.pem user@target_server:/path/to/nginx/ssl/
scp /etc/letsencrypt/live/xxx.yyy.com/privkey.pem user@target_server:/path/to/nginx/ssl/
Step5 在目标服务器上配置 Nginx 使用证书
- 在目标服务器上，编辑 Nginx 配置文件以使用新的证书：
server {listen 443 ssl;server_name api.moon.com;ssl_certificate /path/to/nginx/ssl/fullchain.pem;ssl_certificate_key /path/to/nginx/ssl/privkey.pem;# 其他 Nginx 配置
}
保存文件并重新加载 Nginx 配置：
sudo nginx -s reload
Y 注意事项
注意更新证书(间隔90天)
Let’s Encrypt证书的有效期为 90 天。
之后，可以在原服务器上再次申请新的证书，然后将新的证书文件传输到目标服务器进行更新。
K 总结
Let’s Encrypt是一个提供免费SSL/TLS证书的认证机构（CA），旨在通过简化证书申请和安装过程来普及 HTTPS 加密，提升互联网安全性- 同类型的机构还有
ZeroSSL、SSL For Free、Cloudflare、BuyPass等等，腾讯云和AWS也有针对自己产品的SSL免费证书 - 使用
Let’s Encrypt申请SSL证书非常简单，可以选择 DNS-01 验证或者 HTTP-01 验证 - 如果证书用于本机的
Nginx或者Apache，还可以设置自动更新，这样就免除了服务有可能中断的麻烦 - 生成证书的命令 :
sudo certbot certonly --manual --preferred-challenges dns -d xxx.yyy.com
X 参考文献
- 使用 Let’s Encrypt 获取免费SSL证书 - CSDN 【推荐】
Let’s Encrypt
https://letsencrypt.org/zh-cn/getting-started/
