彩运网网址-彩运网网上登录

nginx使用let’s encrypt https证书并启用http2的使用记

nginx使用let’s encrypt https证书并启用http2的使用记录

let’s encrypt 使用记录

安装certbot说明

certbot官网上的文档关于centos6和7的部分在本次安装过程中发现一个python问题,在centos6下python安装的2.6,centbot使用2.6的python运行不成功;centos7下自带python是2.7,如果未安装pip,则需要手动安装,pip安装后,6和7上的certbot才能正常运行下载python

wget -c https://www.python.org/ftp/python/2.7.12/Python-2.7.12.tgz

安装python2.7

cd Python-2.7.12/./configure --prefix=/usr/localmakemake altinstall

安装pip

wget -c https://bootstrap.pypa.io/get-pip.pypython2.7 get-pip.py

安装certbot

wget https://dl.eff.org/certbot-autochmod a+x certbot-auto

运行获取证书

./certbot-auto certonly --standalone -d devservice.crazypandacam.com -d devadmin.crazypandacam.com -d devweb.crazypandacam.comIMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at   /etc/letsencrypt/live/devservice.crazypandacam.com/fullchain.pem.   Your cert will expire on 2017-01-07. To obtain a new or tweaked   version of this certificate in the future, simply run certbot-auto   again. To non-interactively renew *all* of your certificates, run   "certbot-auto renew" - If you lose your account credentials, you can recover through   e-mails sent to [email protected] - Your account credentials have been saved in your Certbot   configuration directory at /etc/letsencrypt. You should make a   secure backup of this folder now. This configuration directory will   also contain certificates and private keys obtained by Certbot so   making regular backups of this folder is ideal. - If you like Certbot, please consider supporting our work by:   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate   Donating to EFF:                    https://eff.org/donate-leYou have mail in /var/spool/mail/root./certbot-auto certonly --standalone -d testservice.crazypandacam.com -d testadmin.crazypandacam.com -d testweb.crazypandacam.comIMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at   /etc/letsencrypt/live/testservice.crazypandacam.com/fullchain.pem.   Your cert will expire on 2017-01-07. To obtain a new or tweaked   version of this certificate in the future, simply run certbot-auto   again. To non-interactively renew *all* of your certificates, run   "certbot-auto renew" - If you like Certbot, please consider supporting our work by:   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate   Donating to EFF:                    https://eff.org/donate-le

升级nginx开始http2 支持

建立如下文件:vi /etc/yum.repos.d/nginx.repo

[nginx]name=nginx repobaseurl=http://nginx.org/packages/centos/$releasever/$basearch/gpgcheck=0enabled=1

执行

yum update nginx

具体配置文件参考mozilla的最佳实践

具体配置示例:pixcar的实际配置

因为pixcar需要 同时支持http和https及http2,所以具体配置和mozilla的最佳实践有改动

 server_name        pixcargoluk.com;    listen 443 ssl http2;    listen [::]:443 ssl http2;    ssl_session_timeout 1d;    ssl_session_cache shared:SSL:50m;    ssl_session_tickets off;    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;    ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';    ssl_prefer_server_ciphers on;    add_header Strict-Transport-Security max-age=15768000;    ssl_stapling on;    ssl_stapling_verify on;    ssl_certificate    /etc/letsencrypt/live/service.crazypandacam.com/fullchain.pem;    ssl_certificate_key /etc/letsencrypt/live/service.crazypandacam.com/privkey.pem;

自动renewal证书

crontab 增加一行

# Automating renewal Let's Encrypt certificates0 0 * * * /usr/local/bin/certbot-auto renew --quiet

后来运行验证发现,原web服务要停掉才能用此命令更新,修改为如下

# Automating renewal Let's Encrypt certificates0 0 * * * /usr/local/bin/certbot-auto renew --pre-hook "service nginx stop" --post-hook "service nginx start"

以上是centos6及以前,如果是centos7的话,换成如下

0 0 * * * /usr/local/bin/certbot-auto renew --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx"

http://www.bkjia.com/HTML5/1206392.htmlwww.bkjia.comtruehttp://www.bkjia.com/HTML5/1206392.htmlTechArticlenginx使用let’s encrypt https证书并启用http2的使用记录 let’s encrypt 使用记录 安装certbot说明 certbot官网上的文档关于centos6和7的部分在本次安装...

本文由彩运网网址发布于网络安全,转载请注明出处:nginx使用let’s encrypt https证书并启用http2的使用记

相关阅读