网站升级 https 及优化，Nginx安装 SSL 证书篇

Linux 服务器运维

SSL 介绍

https 早已成为当今 web 主流，最近给自己的网站升级了 https。
Let’s Encrypt是一个非盈利性的证书颁发机构，为1.8亿个网站提供TLS证书。它是开源，并且完全免费的，它颁发的证书已经被几乎所有的浏览器所认可。

本文用到的脚本是 acmesh-official/acme.sh

准备

环境

操作环境：Ubuntu 18.04 x64
webserver：Nginx

域名

需要自己在服务商购买域名，本文不表

安装脚本 acmesh-official/acme.sh

在线安装

    curl https://get.acme.sh | sh

官方推荐的方法，如果担心网站被运营商劫持，可以使用以下 git 方法

从 git 仓库安装

clone git 仓库:

[root@Ubuntu:~]# git clone https://github.com/acmesh-official/acme.sh.git
Cloning into 'acme.sh'...
remote: Enumerating objects: 49, done.
remote: Counting objects: 100% (49/49), done.
remote: Compressing objects: 100% (34/34), done.
remote: Total 10098 (delta 30), reused 30 (delta 15), pack-reused 10049
Receiving objects: 100% (10098/10098), 3.92 MiB | 18.41 MiB/s, done.
Resolving deltas: 100% (5951/5951), done.

执行安装脚本

[root@Ubuntu:~]# cd ./acme.sh/
[root@Ubuntu:acme.sh]# crontab -l
no crontab for root
[root@Ubuntu:acme.sh]# ./acme.sh --install
[Thu Feb 20 01:55:27 CST 2020] It is recommended to install socat first.
[Thu Feb 20 01:55:27 CST 2020] We use socat for standalone server if you use standalone mode.
[Thu Feb 20 01:55:27 CST 2020] If you don't use standalone mode, just ignore this warning.
[Thu Feb 20 01:55:27 CST 2020] Installing to /root/.acme.sh
[Thu Feb 20 01:55:27 CST 2020] Installed to /root/.acme.sh/acme.sh
[Thu Feb 20 01:55:27 CST 2020] Installing alias to '/root/.bashrc'
[Thu Feb 20 01:55:27 CST 2020] OK, Close and reopen your terminal to start using acme.sh
[Thu Feb 20 01:55:27 CST 2020] Installing cron job
no crontab for root
no crontab for root
[Thu Feb 20 01:55:27 CST 2020] Good, bash is found, so change the shebang to use bash as preferred.
[Thu Feb 20 01:55:28 CST 2020] OK

安装详情

执行此安装脚本不要求必须使用 root 用户，建议使用。

当前用户至少要有执行 nginx 权限

安装程序将执行3个操作：

创建和复制acme.sh到你的主目录（$HOME）~/.acme.sh/ 所有证书也将放置在此文件夹中。
创建别名：acme.sh=~/.acme.sh/acme.sh.
如果需要，创建每日Cron作业以检查并更新证书。

安装过程中会自动为你创建 cronjob, 每天 0:00 点自动检测所有的证书, 如果快过期了, 需要更新, 则会自动更新证书(可执行 crontab -l 查看)。

[root@Ubuntu:acme.sh]# crontab -l
27 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

安装后，必须关闭当前终端，然后重新打开以使别名生效。

之后可以准备颁发证书了

显示帮助信息：

[root@Ubuntu:acme.sh]# acme.sh -h

申请签发 SSL 证书

acme.sh 实现了 acme 协议支持的所有验证协议. 一般有两种方式验证: http 和 dns 验证

本文不建议用 dns 方式申请， dns 手动模式，不能自动更新证书。在续订证书时，您必须手动向域中添加新的 txt 记录。

Nginx模式

由于网站运行的是 nginx 服务器，acme.sh 可以使用 nginx 服务器颁发证书。颁发证书后，acme.sh 会还原 nginx conf，请放心。

官方提供以下命令

acme.sh  --issue  -d example.com  --nginx

有时，无法自动找到nginx conf文件，您可以指定以下文件之一：

acme.sh  --issue  -d example.com  --nginx /etc/nginx/nginx.conf

您还可以指定网站conf：

acme.sh  --issue  -d example.com  --nginx /etc/nginx/conf.d/example.com.conf

执行看到以下结果即成功

[root@Ubuntu:~]# acme.sh  --issue  -d www.kangxuanpeng.com --nginx
[Thu Feb 20 01:59:28 CST 2020] Creating domain key
[Thu Feb 20 01:59:28 CST 2020] The domain key is here: /root/.acme.sh/www.kangxuanpeng.com/www.kangxuanpeng.com.key
[Thu Feb 20 01:59:28 CST 2020] Single domain='www.kangxuanpeng.com'
[Thu Feb 20 01:59:28 CST 2020] Getting domain auth token for each domain
[Thu Feb 20 01:59:29 CST 2020] Getting webroot for domain='www.kangxuanpeng.com'
[Thu Feb 20 01:59:29 CST 2020] Verifying: www.kangxuanpeng.com
[Thu Feb 20 01:59:29 CST 2020] Nginx mode for domain:www.kangxuanpeng.com
[Thu Feb 20 01:59:29 CST 2020] Found conf file: /etc/nginx/sites-enabled/www.kangxuanpeng.com.conf
[Thu Feb 20 01:59:29 CST 2020] Backup /etc/nginx/sites-enabled/www.kangxuanpeng.com.conf to /root/.acme.sh/www.kangxuanpeng.com/backup/www.kangxuanpeng.com.nginx.conf
[Thu Feb 20 01:59:29 CST 2020] Check the nginx conf before setting up.
[Thu Feb 20 01:59:29 CST 2020] OK, Set up nginx config file
[Thu Feb 20 01:59:29 CST 2020] nginx conf is done, let's check it again.
[Thu Feb 20 01:59:29 CST 2020] Reload nginx
[Thu Feb 20 01:59:34 CST 2020] Success
[Thu Feb 20 01:59:34 CST 2020] Restoring from /root/.acme.sh/www.kangxuanpeng.com/backup/www.kangxuanpeng.com.nginx.conf to /etc/nginx/sites-enabled/www.kangxuanpeng.com.conf
[Thu Feb 20 01:59:34 CST 2020] Reload nginx
[Thu Feb 20 01:59:34 CST 2020] Verify finished, start to sign.
[Thu Feb 20 01:59:34 CST 2020] Lets finalize the order, Le_OrderFinalize: https://acme-v02.api.letsencrypt.org/acme/finalize/78572851/2382115231
[Thu Feb 20 01:59:35 CST 2020] Download cert, Le_LinkCert: https://acme-v02.api.letsencrypt.org/acme/cert/03e350b1498cdf3776887b8ffebf902dc4b7
[Thu Feb 20 01:59:35 CST 2020] Cert success.
...
-----END CERTIFICATE-----
[Thu Feb 20 01:59:35 CST 2020] Your cert is in  /root/.acme.sh/www.kangxuanpeng.com/www.kangxuanpeng.com.cer 
[Thu Feb 20 01:59:35 CST 2020] Your cert key is in  /root/.acme.sh/www.kangxuanpeng.com/www.kangxuanpeng.com.key 
[Thu Feb 20 01:59:35 CST 2020] The intermediate CA cert is in  /root/.acme.sh/www.kangxuanpeng.com/ca.cer 
[Thu Feb 20 01:59:35 CST 2020] And the full chain certs is there:  /root/.acme.sh/www.kangxuanpeng.com/fullchain.cer

生成 `dhparam.pem` 文件

[root@Ubuntu:sites-enabled]# openssl dhparam -out /root/.acme.sh/dhparam.pem 2048
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
...

ssl_dhparam 之后要 restart nginx，不能用nginx -s reload

将证书安装到 Nginx

官方不建议直接使用以上生成的证书 生成证书后，您可能希望将证书安装/复制到Apache / Nginx或其他服务器。您必须使用此命令将证书复制到目标文件，请勿使用 ~/.acme.sh/ 文件夹中的证书文件，这些文件仅供内部使用，将来文件夹结构可能会更改。

[root@Ubuntu:~]# acme.sh --install-cert -d www.kangxuanpeng.com \
> --keypath /etc/nginx/ssl-key-files/www.kangxuanpeng.com.key \
> --fullchainpath /etc/nginx/ssl-key-files/www.kangxuanpeng.com.key.pem \
> --reloadcmd "nginx -s reload"
[Thu Feb 20 02:30:33 CST 2020] Installing key to:/etc/nginx/ssl-key-files/www.kangxuanpeng.com.key
[Thu Feb 20 02:30:33 CST 2020] Installing full chain to:/etc/nginx/ssl-key-files/www.kangxuanpeng.com.key.pem
[Thu Feb 20 02:30:33 CST 2020] Run reload cmd: nginx -s reload
[Thu Feb 20 02:30:33 CST 2020] Reload success

命令格式为：
acme.sh --install-cert -d example.com \
--key-file       /path/to/keyfile/in/nginx/key.pem  \
--fullchain-file /path/to/fullchain/nginx/cert.pem \
--reloadcmd     "nginx -s reload"
只有域名是必需的，所有其他参数都是可选的。
现有文件的所有权和许可信息将保留。您可以预先创建文件以定义所有权和权限。
将证书/密钥安装/复制到生产Apache或Nginx路径。
默认情况下，证书将每60天更新一次（可配置）。一旦证书被更新，在Apache / Nginx的服务将自动被重新装载命令：nginx -s reload
请注意：reloadcmd非常重要。该证书可以自动更新，但是如果没有正确的“ reloadcmd”，该证书可能无法刷新到您的服务器（例如nginx或apache），那么您的网站将无法在60天内显示更新的证书。

更改 Nginx 配置

启用 SSL，监听 443端口并且配置证书位置

http {
    ...
    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;
    ...
}

server {
    listen 80;
    listen 443 ssl;

    server_name www.kangxuanpeng.com;
    if ($scheme = http) {
        return 301 https://$server_name$request_uri;
    }

    ssl_certificate_key     /etc/nginx/ssl-key-files/www.kangxuanpeng.com.key;
    ssl_certificate     /etc/nginx/ssl-key-files/www.kangxuanpeng.com.key.pem;
    # ssl_dhparam
    ssl_dhparam             /etc/nginx/ssl-key-files/dhparam.pem;
    ...
}

检查 Nginx 配置是否正确后重启

[root@Ubuntu:sites-enabled]# nginx -s reload //或者 service nginx restart

验证 SSL

访问 ssllabs.com 输入你的域名，检查 SSL 的配置是否都正常：

https://www.ssllabs.com/ssltest/analyze.html?d=www.kangxuanpeng.com&hideResults=on&latest

确保验证结果有 A 以上，否则根据提示调整问题

自动续期

Let's Encrypt 的证书有效期是 90 天的，你需要定期 renew 重新申请，这部分 acme.sh 以及帮你做了，在安装的时候往 crontab 增加了一行每天执行的命令 acme.sh --cron:
27 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

手动验证

[root@Ubuntu:nginx]# "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh"
[Thu Feb 20 17:08:49 CST 2020] ===Starting cron===
[Thu Feb 20 17:08:49 CST 2020] Renew: 'blog.kangxuanpeng.com'
[Thu Feb 20 17:08:49 CST 2020] Skip, Next renewal time is: Sun Apr 19 18:00:48 UTC 2020
[Thu Feb 20 17:08:49 CST 2020] Add '--force' to force to renew.
[Thu Feb 20 17:08:49 CST 2020] Skipped blog.kangxuanpeng.com
[Thu Feb 20 17:08:49 CST 2020] Renew: 'kangxuanpeng.com'
[Thu Feb 20 17:08:49 CST 2020] Skip invalid cert for: kangxuanpeng.com
[Thu Feb 20 17:08:49 CST 2020] Skipped kangxuanpeng.com
[Thu Feb 20 17:08:49 CST 2020] Renew: 'me.kangxuanpeng.com'
[Thu Feb 20 17:08:49 CST 2020] Skip, Next renewal time is: Sun Apr 19 19:04:51 UTC 2020
[Thu Feb 20 17:08:49 CST 2020] Add '--force' to force to renew.
[Thu Feb 20 17:08:49 CST 2020] Skipped me.kangxuanpeng.com
[Thu Feb 20 17:08:49 CST 2020] Renew: 'www.kangxuanpeng.com'
[Thu Feb 20 17:08:49 CST 2020] Skip, Next renewal time is: Sun Apr 19 17:59:35 UTC 2020
[Thu Feb 20 17:08:49 CST 2020] Add '--force' to force to renew.
[Thu Feb 20 17:08:49 CST 2020] Skipped www.kangxuanpeng.com
[Thu Feb 20 17:08:49 CST 2020] ===End cron===

验证 acme.sh --cron 的流程

[root@Ubuntu:nginx]# acme.sh --cron -f
[Thu Feb 20 17:10:57 CST 2020] ===Starting cron===
[Thu Feb 20 17:10:57 CST 2020] Renew: 'blog.kangxuanpeng.com'
[Thu Feb 20 17:10:58 CST 2020] Single domain='blog.kangxuanpeng.com'
[Thu Feb 20 17:10:58 CST 2020] Getting domain auth token for each domain
[Thu Feb 20 17:10:59 CST 2020] Getting webroot for domain='blog.kangxuanpeng.com'
[Thu Feb 20 17:10:59 CST 2020] blog.kangxuanpeng.com is already verified, skip http-01.
[Thu Feb 20 17:10:59 CST 2020] Verify finished, start to sign.
[Thu Feb 20 17:10:59 CST 2020] Lets finalize the order, Le_OrderFinalize: https://acme-v02.api.letsencrypt.org/acme/finalize/78572851/2388621838
[Thu Feb 20 17:11:00 CST 2020] Download cert, Le_LinkCert: https://acme-v02.api.letsencrypt.org/acme/cert/0425b2165b01e91823130a37ee094b60fb66
...
[Thu Feb 20 17:11:06 CST 2020] Your cert is in  /root/.acme.sh/www.kangxuanpeng.com/www.kangxuanpeng.com.cer 
[Thu Feb 20 17:11:06 CST 2020] Your cert key is in  /root/.acme.sh/www.kangxuanpeng.com/www.kangxuanpeng.com.key 
[Thu Feb 20 17:11:06 CST 2020] The intermediate CA cert is in  /root/.acme.sh/www.kangxuanpeng.com/ca.cer 
[Thu Feb 20 17:11:06 CST 2020] And the full chain certs is there:  /root/.acme.sh/www.kangxuanpeng.com/fullchain.cer 
[Thu Feb 20 17:11:06 CST 2020] Installing key to:/etc/nginx/ssl-key-files/www.kangxuanpeng.com.key
[Thu Feb 20 17:11:06 CST 2020] Installing full chain to:/etc/nginx/ssl-key-files/www.kangxuanpeng.com.key.pem
[Thu Feb 20 17:11:06 CST 2020] Run reload cmd: nginx -s reload
[Thu Feb 20 17:11:06 CST 2020] Reload success
[Thu Feb 20 17:11:06 CST 2020] ===End cron===

至此配置 SSL 已完成

SSL 优化

chrome 证书缓存

如果配置不正确的时候用 chrome 打开网站，浏览器会缓存证书，证书配置正确后验证则需要清除浏览器证书缓存
chrome://net-internals

DNS CAA

添加一条 CAA 记录
CAA data 填写 0 issue "证书颁发机构域名"。
用 Let's Encrypt 颁发的免费证书，CAA data 部分直接填写 0 issue "letsencrypt.org" 即可。

ssl 缓存

修改配置 nginx 增加缓存配置

ssl_session_cache shared:SSL:20m; 
# SSL session 缓存区大小
# 这条语句加在server段里话，在SSL Lab的测试中识别不出来，因为它假设客户端不支持SNI协议，但实际上是可以加在server段的
 
ssl_session_tickets on;
# 开启浏览器的 Session Ticket 缓存
 
ssl_session_timeout 60m; 
# 过期时间，分钟

本文由 HongXunPan 创作，采用知识共享署名4.0 国际许可协议进行许可
本站文章除注明转载/出处外，均为本站原创或翻译，转载前请务必署名
最后编辑时间为: 2020-02-23 22:52:12