PanBlogs
用 acme.sh 脚本自动续签 ssl 证书
安装
shell
curl https://get.acme.sh | sh -s email=xxx@qq.comcurl https://get.acme.sh | sh -s email=xxx@qq.com申请证书（nginx）
要指定 nginx 的配置文件目录，不然会报错
shell
~/acme.sh/acme.sh --issue -d convert.72wo.com --nginx /www/server/nginx/conf/nginx.conf~/acme.sh/acme.sh --issue -d convert.72wo.com --nginx /www/server/nginx/conf/nginx.conf安装证书
shell
~/acme.sh/acme.sh --install-cert -d convert.72wo.com --key-file /www/server/panel/vhost/cert/convert.72wo.com/key.pem --fullchain-file /www/server/panel/vhost/cert/convert.72wo.com/cert.pem~/acme.sh/acme.sh --install-cert -d convert.72wo.com --key-file /www/server/panel/vhost/cert/convert.72wo.com/key.pem --fullchain-file /www/server/panel/vhost/cert/convert.72wo.com/cert.pem检查和续签+安装证书
加上--force就是强制的意思
shell
~/.acme.sh/acme.sh --cron --home /root/.acme.sh/ --force~/.acme.sh/acme.sh --cron --home /root/.acme.sh/ --forcenginx反向代理导致失败
https://juejin.cn/post/6844904138229153805
server {
listen 443 ssl;
listen [::]:443 ssl;
ssl_certificate /data/example.com.pem;
ssl_certificate_key /data/example.com.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
server_name example.com;
client_max_body_size 1000m;
location ^~ /.well-known/acme-challenge/ {
default_type "text/plain";
allow all;
root /var/www/example.com/;
}
location / {
proxy_redirect off;
proxy_pass http://xxxxxxx:8000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}server {
listen 443 ssl;
listen [::]:443 ssl;
ssl_certificate /data/example.com.pem;
ssl_certificate_key /data/example.com.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
server_name example.com;
client_max_body_size 1000m;
location ^~ /.well-known/acme-challenge/ {
default_type "text/plain";
allow all;
root /var/www/example.com/;
}
location / {
proxy_redirect off;
proxy_pass http://xxxxxxx:8000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}TIP
主要起作用的是 location ^~ /.well-known/acme-challenge/ ，acme在认证的时候会使用这个目录