Ubuntu Linux部署免费HTTPS证书的步骤

Let’s Encrypt是免费的HTTPS证书,有效期是90天。到期后需要手动续期,或者编写一个定时任务自动去续期。

我当前所用Ubuntu版本为:

root@hgdm:~# lsb_release -a
LSB Version: security-11.1.0ubuntu2-noarch
Distributor ID: Ubuntu
Description: Ubuntu 20.04.3 LTS
Release: 20.04
Codename: focal
步骤1: 安装并启动nginx
$ sudo apt-get install nginx
$ sudo systemctl start nginx
具体可参考我之前写的:Ubuntu Linux 如何使用apt-get安装Nginx、MySQL、Redis、PHP。

步骤2
$ sudo apt install certbot python3-certbot-nginx
步骤3
假设需要部署HTTPS证书的域名为:m.xyz.com。

这个域名所对应的网站目录路径为:/data/web/m.xyz.com。

域名和网站目录所对应的nginx配置文件路径为:
/etc/nginx/conf.d/m.xyz.com.conf。

/etc/nginx/conf.d/m.xyz.com.conf这个配置文件的内容如下所示:

server {
listen 80 default_server;

 # 设置网站的域名为m.xyz.com
server_name m.xyz.com;

# 设置网站的目录路径
root /data/web/m.xyz.com;

index index.html index.htm;

location / {
    try_files $uri $uri/ =404;
}

}
不知道去哪里复制可重用的nginx配置?去这个路径找:
/etc/nginx/sites-available/default。

步骤4:重启nginx
必须重启nginx服务器,否则新增的网站配置不生效。

$ sudo systemctl restart nginx
域名m.xyz.com必须能通过网络访问,因为下一步执行certbot命令时,会在/data/web/m.xyz.com目录下创建一个隐藏的名称为
.well-known/acme-challenge的文件,然后在外网Let’s Encrypt访问
http://m.xyz.com/.well-known/acme-challenge。若Let’s Encrypt访问这个网址失败,那么Let’s Encrypt就会认为域名m.xyz.com不是你的,进而无法为m.xyz.com签发证书。

步骤5
$ sudo certbot certonly –webroot -w /data/web/m.xyz.com -d m.xyz.com
# 若是成功执行,最后一部分的输出信息为:
IMPORTANT NOTES:
– Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/m.xyz.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/m.xyz.com/privkey.pem
Your cert will expire on 2022-03-30. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew all of your certificates, run
“certbot renew”
– If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

这个命令的输出显示,生成了两个证书:

/etc/letsencrypt/live/m.xyz.com/fullchain.pem
/etc/letsencrypt/live/m.xyz.com/privkey.pem

/etc/letsencrypt/live/m.xyz.com目录是用于存放certbot命令生成的证书文件,但是,certbot生成的证书文件不止前面这两个,还有其他的。

root@hgdm:~# ls /etc/letsencrypt/live/m.xyz.com/
README cert.pem chain.pem fullchain.pem privkey.pem
这个目录里有三个证书文件是下面步骤配置nginx SSL时需要用到的:

第一个:/etc/letsencrypt/live/m.xyz.com/fullchain.pem
第二个:/etc/letsencrypt/live/m.xyz.com/privkey.pem
第三个:/etc/letsencrypt/live/m.xyz.com/chain.pem
步骤6 查找openssl的版本

方法1

$ openssl version
OpenSSL 1.1.1f 31 Mar 2020

方法2

$ dpkg -l | grep openssl
步骤7
使用mozilla提供的SSL配置生成器生成nginx SSL配置,然后复制到
/etc/nginx/conf.d/m.xyz.com.conf,并修改4个地方。

需要修改的4个地方为:

ssl_certificate:上文的certbot命令已生成这个文件,文件路径为/etc/letsencrypt/live/m.xyz.com/fullchain.pem。
ssl_certificate_key:上文的certbot命令已生成这个文件,文件路径为/etc/letsencrypt/live/m.xyz.com/privkey.pem。
ssl_dhparam:这个文件还没生成,先填写为预设的文件路径:/etc/nginx/ssl/dhparam.pem,下一步执行命令去生成。
ssl_trusted_certificate:上文的certbot命令已生成这个文件,文件路径为/etc/letsencrypt/live/m.xyz.com/chain.pem。

Ubuntu Linux部署免费HTTPS证书的步骤
SSL配置生成器生成的配置有4个地方需要修改

/etc/nginx/conf.d/m.xyz.com.conf被修改为:

generated 2021-12-30, Mozilla Guideline v5.6, nginx 1.18, OpenSSL 1.1.1f, intermediate configuration

https://ssl-config.mozilla.org/#server=nginx&version=1.18&config=intermediate&openssl=1.1.1f&guideline=5.6

server {
server_name m.xyz.com;
listen 80 default_server;
listen [::]:80 default_server;

location / {
    return 301 https://$host$request_uri;
}

}

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;

# 第1个需被修改的地方(已改)
ssl_certificate /etc/letsencrypt/live/m.xyz.com/fullchain.pem;
# 第2个需被修改的地方(已改)
ssl_certificate_key /etc/letsencrypt/live/m.xyz.com/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
ssl_session_tickets off;

# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
# 第3个需被修改的地方(已改)
ssl_dhparam /etc/nginx/ssl/dhparam.pem;

# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;

# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;

# verify chain of trust of OCSP response using Root CA and Intermediate certs
# 第4个需被修改的地方(已改)
ssl_trusted_certificate /etc/letsencrypt/live/m.xyz.com/chain.pem;

# replace with the IP address of your resolver
resolver 127.0.0.1;

server_name m.xyz.com;
root /data/web/m.xyz.com;

location ~ \.py$ {
    return 403;
}

}
步骤8
执行以下命令,用于生成第7步nginx配置里预设的ssl_dhparam文件。下面第二个命令比较耗时,快的话需要等一两分钟,慢的话则更久。

$ sudo mkdir /etc/nginx/ssl
$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
步骤9:重启nginx
要想前面修改过的nginx配置生效,必须重启nginx服务。

$ sudo systemctl restart nginx
步骤10
打开浏览器,访问m.xyz.com,检查https是否生效了。若配置正确,nginx也重启了,也没有生效,可能需要等待一小会。

检查https是否生效的步骤如下图所示:

Ubuntu Linux部署免费HTTPS证书的步骤
查看证书是否生效第1步和第2步
Ubuntu Linux部署免费HTTPS证书的步骤
查看证书是否生效第3步
Ubuntu Linux部署免费HTTPS证书的步骤
查看证书是否生效第4步

步骤11:HTTPS证书到期了,需要更新证书
执行以下命令去更新HTTPS证书,且更新后必须重启nginx服务器,否则无法在浏览器看到HTTPS证书的失效日期被更新了。

$ sudo certbot renew

执行certbot renew命令后,必须重启nginx服务器,否则在浏览器查看不到HTTPS证书的失效日期被更新了

$ sudo systemctl restart nginx
最后 贴上完整的nginx配置
前端是nginx,后端是一个运行着django项目的gunicorn服务。

generated 2021-12-30, Mozilla Guideline v5.6, nginx 1.18, OpenSSL 1.1.1f, intermediate configuration

https://ssl-config.mozilla.org/#server=nginx&version=1.18&config=intermediate&openssl=1.1.1f&guideline=5.6

server {
server_name m.xyz.com;
listen 80 default_server;
listen [::]:80 default_server;

location / {
    return 301 https://$host$request_uri;
}

}

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;

ssl_certificate /etc/letsencrypt/live/m.xyz.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/m.xyz.com/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
ssl_session_tickets off;

# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
ssl_dhparam /etc/nginx/ssl/dhparam.pem;

# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;

# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;

# verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /etc/letsencrypt/live/m.xyz.com/chain.pem;

# replace with the IP address of your resolver
resolver 127.0.0.1;

server_name m.xyz.com;

# 找不到入口的请求(在gunicorn,/static, /media都没找到入口),最后访问/data/web/m.xyz.com_other这个目录,试试看是否能访问成功
root /data/web/m.xyz.com_other;

# 网站的js和css文件所在目录
location /static/ {
    alias /data/web/m.xyz.com/static/;
    add_header Cache-Control no-cache;
    expires -1; # kill cache;
    access_log        off;
    log_not_found     off;
}

# 网站的媒体文件所在的目录
location /media/ {
    alias /data/web/m.xyz.com/media/;
    expires max;
}

location ~ \.py$ {
    return 403;
}

# 将非文件的请求发给运行django项目的gunicorn服务,gunicorn服务的端口号为8999
location / { 
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-NginX-Proxy true;
    proxy_redirect off;
    if (!-f $request_filename) {
        proxy_pass http://127.0.0.1:8999;
        break;
    }
}

}

版权声明:本文内容由互联网用户自发贡献,该文观点仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌抄袭侵权/违法违规的内容, 请发送邮件至22018681@qq.com 举报,一经查实,本站将立刻删除。

(0)
打赏 微信扫一扫 微信扫一扫 支付宝扫一扫 支付宝扫一扫
森林服务号的头像森林服务号
上一篇 2022年4月10日 上午7:49
下一篇 2022年4月10日

相关推荐

发表回复

登录后才能评论