centos 下安装 Let’s Encrypt 永久免费 TLS 证书 （SSL已过时，有漏洞）

原文地址：centos 下安装 Let’s Encrypt 永久免费 SSL 证书

lets encrypt github地址为：https://github.com/certbot/certbot

1.

    git clone https://github.com/letsencrypt/letsencrypt
    cd letsencrypt
    chmod +x letsencrypt-auto

安装证书：

./letsencrypt-auto certonly  --email 2358269014@qq.com -d fecshop.appfront.fancyecommerce.com -d fecshop.appfront.es.fancyecommerce.com    

d参数后面对应的是域名，在执行的过程中，我遭遇了下面的报错：

    Total size: 44 M
    Downloading Packages:
    Running rpm_check_debug
    ERROR with rpm_check_debug vs depsolve:
    libgdbm.so.2()(64bit) is needed by python-libs-2.6.6-66.el6_8.x86_64
    ** Found 7 pre-existing rpmdb problem(s), 'yum check' output follows:
    4:perl-5.10.1-141.el6_7.1.x86_64 has missing requires of libgdbm.so.2()(64bit)
    4:perl-devel-5.10.1-141.el6_7.1.x86_64 has missing requires of gdbm-devel
    polkit-0.96-5.el6_4.x86_64 has missing requires of libeggdbus-1.so.0()(64bit)
    2:postfix-2.6.6-6.el6_5.x86_64 has missing requires of libmysqlclient.so.16()(64bit)
    2:postfix-2.6.6-6.el6_5.x86_64 has missing requires of libmysqlclient.so.16(libmysqlclient_16)(64bit)
    2:postfix-2.6.6-6.el6_5.x86_64 has missing requires of mysql-libs
    python-libs-2.6.6-52.el6.x86_64 has missing requires of libgdbm.so.2()(64bit)
    Your transaction was saved, rerun it with: yum load-transaction /tmp/yum_save_tx-2017-04-07-22-1798AqLE.yumtx
    Could not install OS dependencies. Aborting bootstrap!

centos 6 需要安装 libgdbm.so.2

    wget http://mirror.centos.org/centos/6/os/x86_64/Packages/gdbm-1.8.0-39.el6.x86_64.rpm
    yum localinstall gdbm-1.8.0-39.el6.x86_64.rpm

完成后，重新执行上面的命令行：

    ./letsencrypt-auto certonly --standalone  --email 2358269014@qq.com -d fecshop.appfront.fancyecommerce.com -d fecshop.appfront.es.fancyecommerce.com -d img.appfront.fancyecommerce.com -d img.apphtml5.fancyecommerce.com -d img.fancyecommerce.com

下面的安装就比较顺利了，下面是我的log

    [root@iZ942k2d5ezZ certbot-master]# ./letsencrypt-auto certonly   --email 2358269014@qq.com -d fecshop.appfront.fancyecommerce.com -d fecshop.appfront.es.fancyecommerce.com
    /root/.local/share/letsencrypt/lib/python2.6/site-packages/cryptography/__init__.py:26: DeprecationWarning: Python 2.6 is no longer supported by the Python core team, please upgrade your Python. A future version of cryptography will drop support for Python 2.6
      DeprecationWarning
    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Failed to find executable apachectl in PATH: /usr/local/mysql/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
    How would you like to authenticate with the ACME CA?
    -------------------------------------------------------------------------------
    1: Place files in webroot directory (webroot)
    2: Spin up a temporary webserver (standalone)
    -------------------------------------------------------------------------------
    Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
    Obtaining a new certificate
    Performing the following challenges:
    tls-sni-01 challenge for fecshop.appfront.fancyecommerce.com
    tls-sni-01 challenge for fecshop.appfront.es.fancyecommerce.com
    -------------------------------------------------------------------------------
    Could not bind TCP port 443 because it is already in use by another process on
    this system (such as a web server). Please stop the program in question and then
    try again.
    -------------------------------------------------------------------------------
    (R)etry/(C)ancel: R
    -------------------------------------------------------------------------------
    Could not bind TCP port 443 because it is already in use by another process on
    this system (such as a web server). Please stop the program in question and then
    try again.
    -------------------------------------------------------------------------------
    (R)etry/(C)ancel: R
    Waiting for verification...
    Cleaning up challenges
    Generating key (2048 bits): /etc/letsencrypt/keys/0000_key-certbot.pem
    Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pem
    IMPORTANT NOTES:
     - Congratulations! Your certificate and chain have been saved at
       /etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/fullchain.pem.
       Your cert will expire on 2017-07-06. To obtain a new or tweaked
       version of this certificate in the future, simply run
       letsencrypt-auto again. To non-interactively renew *all* of your
       certificates, run "letsencrypt-auto renew"
     - If you like Certbot, please consider supporting our work by:
       Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
       Donating to EFF:                    https://eff.org/donate-le
    [root@iZ942k2d5ezZ certbot-master]# ls

在nginx中添加代码：

    listen 443 ssl;
            ssl on;
            ssl_certificate /etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/fullchain.pem;
            ssl_certificate_key /etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/privkey.pem;
            ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

注意上面的文件路径 ，将 fecshop.appfront.fancyecommerce.com 替换成您的文件路径。因为不同的域名生成的文件名字不同， nginx填写完的代码如下：

    server {
            listen     80  ;
            listen 443 ssl;
            ssl on;
            ssl_certificate /etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/fullchain.pem;
            ssl_certificate_key /etc/letsencrypt/live/fecshop.appfront.fancyecommerce.com/privkey.pem;
            ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    server_name fecshop.appfront.fancyecommerce.com fecshop.appfront.es.fancyecommerce.com;
        root  /www/web/develop/fecshop/appfront/web;
            server_tokens off;
        include none.conf;
        index index.php index.html index.htm;
        access_log /www/web_logs/access.log wwwlogs;
        error_log  /www/web_logs/error.log  notice;
        location ~ \.php$ {
                            fastcgi_pass   127.0.0.1:9000;
                            fastcgi_index  index.php;
                            include fcgi.conf;
            }
            location ~ /sitemap.xml
            {
                    if ($host  ~ .*appfront.es.fancyecommerce.com) {
                            rewrite ^/sitemap\.xml /sitemap_es.xml last;
                    }
            }
             location /fr/ {
                    index index.php;
                    if (!-e $request_filename){
                            rewrite . /fr/index.php last;
                      }
            }
             location /es/ {
                    index index.php;
                    if (!-e $request_filename){
                            rewrite . /es/index.php last;
                    }
            }
             location /cn/ {
                    index index.php;
                    if (!-e $request_filename){
                            rewrite . /cn/index.php last;
                    }
            }
             location /de/ {
                    index index.php;
                    if (!-e $request_filename){
                            rewrite . /de/index.php last;
                    }
            }
            location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ {
                    expires      30d;
            }
            location ~ .*\.(js|css)?$ {
                    expires      12h;
            }
            location /api {
                    rewrite /api/([a-z][0-9a-z_]+)/?$ /api.php?type=$1;
            }
    }

重启nginx，就可以放了https了

本文由 fecommerce 创作，采用 知识共享署名 3.0 中国大陆许可协议 进行许可。 可自由转载、引用，但需署名作者且注明文章出处。

打赏作者

微信