博客

NS acme.example.com ns1.digitalocean.com. 1800
NS acme.example.com ns2.digitalocean.com. 1800
NS acme.example.com ns3.digitalocean.com. 1800

CNAME _acme-challenge.example.com acme.example.com. 1800
CNAME _acme-challenge.example.org acme.example.com. 1800

export DO_API_KEY=blablablablabla 你的一长串 API Key 

acme.sh --dns dns_dgon --issue -d example.com -d \*.example.com -d example.org -d \*.example.org --domain-alias @.acme.example.com

acme.sh --dns dns_dgon --issue -d example.com -d \*.example.com --domain-alias @.acme.example.com
acme.sh --dns dns_dgon --issue -d example.org -d \*.example.org --domain-alias @.acme.example.com

acme.sh --dns dns_dgon --issue -d \*.example.com --domain-alias @.acme.example.com
acme.sh --dns dns_dgon --issue -d \*.example.org --domain-alias @.acme.example.com

curl https://get.acme.sh | sh

wget -O - https://get.acme.sh | sh

source ~/.bashrc

root@sb-blog ~ # acme.sh --help
https://github.com/Neilpang/acme.sh
v2.7.8
Usage: acme.sh  command ...[parameters]....
Commands:
  --help, -h               Show this help message.
  --version, -v            Show version info.
  --install                Install acme.sh to your system.
  --uninstall              Uninstall acme.sh, and uninstall the cron job.
  --upgrade                Upgrade acme.sh to the latest code from https://github.com/Neilpang/acme.sh.
  --issue                  Issue a cert.
  --signcsr                Issue a cert from an existing csr.
  --deploy                 Deploy the cert to your server.
  --install-cert           Install the issued cert to apache/nginx or any other server.
  --renew, -r              Renew a cert.
  --renew-all              Renew all the certs.
  --revoke                 Revoke a cert.
  --remove                 Remove the cert from list of certs known to acme.sh.
  --list                   List all the certs.
  --showcsr                Show the content of a csr.
  --install-cronjob        Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
  --uninstall-cronjob      Uninstall the cron job. The 'uninstall' command can do this automatically.
  --cron                   Run cron job to renew all the certs.
  --toPkcs                 Export the certificate and key to a pfx file.
  --toPkcs8                Convert to pkcs8 format.
  --update-account         Update account info.
  --register-account       Register account key.
  --deactivate-account     Deactivate the account.
  --create-account-key     Create an account private key, professional use.
  --create-domain-key      Create an domain private key, professional use.
  --createCSR, -ccsr       Create CSR , professional use.
  --deactivate             Deactivate the domain authz, professional use.

Parameters:
  --domain, -d   domain.tld         Specifies a domain, used to issue, renew or revoke etc.
  --challenge-alias domain.tld      The challenge domain alias for DNS alias mode: https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
  --domain-alias domain.tld         The domain alias for DNS alias mode: https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
  --force, -f                       Used to force to install or force to renew a cert immediately.
  --staging, --test                 Use staging server, just for test.
  --debug                           Output debug info.
  --output-insecure                 Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for secure.
  --webroot, -w  /path/to/webroot   Specifies the web root folder for web root mode.
  --standalone                      Use standalone mode.
  --stateless                       Use stateless mode, see: https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode
  --apache                          Use apache mode.
  --dns [dns_cf|dns_dp|dns_cx|/path/to/api/file]   Use dns mode or dns api.
  --dnssleep  [120]                  The time in seconds to wait for all the txt records to take effect in dns api mode. Default 120 seconds.

  --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
  --accountkeylength, -ak [2048]    Specifies the account key length.
  --log    [/path/to/logfile]       Specifies the log file. The default is: "/root/.acme.sh/acme.sh.log" if you don't give a file path here.
  --log-level 1|2                   Specifies the log level, default is 1.
  --syslog [0|3|6|7]                Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.

  These parameters are to install the cert to nginx/apache or anyother server after issue/renew a cert:

  --cert-file                       After issue/renew, the cert will be copied to this path.
  --key-file                        After issue/renew, the key will be copied to this path.
  --ca-file                         After issue/renew, the intermediate cert will be copied to this path.
  --fullchain-file                  After issue/renew, the fullchain cert will be copied to this path.

  --reloadcmd "service nginx reload" After issue/renew, it's used to reload the server.

  --server SERVER                   ACME Directory Resource URI. (default: https://acme-v01.api.letsencrypt.org/directory)
  --accountconf                     Specifies a customized account config file.
  --home                            Specifies the home dir for acme.sh .
  --cert-home                       Specifies the home dir to save all the certs, only valid for '--install' command.
  --config-home                     Specifies the home dir to save all the configurations.
  --useragent                       Specifies the user agent string. it will be saved for future use too.
  --accountemail                    Specifies the account email, only valid for the '--install' and '--update-account' command.
  --accountkey                      Specifies the account key path, only valid for the '--install' command.
  --days                            Specifies the days to renew the cert when using '--issue' command. The max value is 60 days.
  --httpport                        Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
  --local-address                   Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
  --listraw                         Only used for '--list' command, list the certs in raw format.
  --stopRenewOnError, -se           Only valid for '--renew-all' command. Stop if one cert has error in renewal.
  --insecure                        Do not check the server certificate, in some devices, the api server's certificate may not be trusted.
  --ca-bundle                       Specifies the path to the CA certificate bundle to verify api server's certificate.
  --ca-path                         Specifies directory containing CA certificates in PEM format, used by wget or curl.
  --nocron                          Only valid for '--install' command, which means: do not install the default cron job. In this case, the certs will not be renewed automatically.
  --no-color                        Do not output color text.
  --ecc                             Specifies to use the ECC cert. Valid for '--install-cert', '--renew', '--revoke', '--toPkcs' and '--createCSR'
  --csr                             Specifies the input csr.
  --pre-hook                        Command to be run before obtaining any certificates.
  --post-hook                       Command to be run after attempting to obtain/renew certificates. No matter the obtain/renew is success or failed.
  --renew-hook                      Command to be run once for each successfully renewed certificate.
  --deploy-hook                     The hook file to deploy cert
  --ocsp-must-staple, --ocsp        Generate ocsp must Staple extension.
  --always-force-new-domain-key     Generate new domain key when renewal. Otherwise, the domain key is not changed by default.
  --auto-upgrade   [0|1]            Valid for '--upgrade' command, indicating whether to upgrade automatically in future.
  --listen-v4                       Force standalone/tls server to listen at ipv4.
  --listen-v6                       Force standalone/tls server to listen at ipv6.
  --openssl-bin                     Specifies a custom openssl bin location.
  --use-wget                        Force to use wget, if you have both curl and wget installed.

acme.sh --issue --standalone -d example.com -d www.example.com -d subdomain.example.com

mkdir -p /var/www/letsencrypt

server {
	listen 80 default_server;
	listen [::]:80 default_server;
	server_name _;

	location /.well-known/acme-challenge {
		root /var/www/letsencrypt;
	}

	location / {
		return 301 https://$host$request_uri;
	}
}

nginx -t && nginx -s reload

acme.sh --issue -d example.com -d www.example.com -d subdomain.example.com -w /var/www/letsencrypt

root@example ~ # acme.sh --issue -d example.com -d www.example.com -w /var/www/letsencrypt
[Tue Mar 20 15:50:37 HKT 2018] Domains have changed.
[Tue Mar 20 15:50:37 HKT 2018] Multi domain='DNS:example.com,DNS:www.example.com'
[Tue Mar 20 15:50:37 HKT 2018] Getting domain auth token for each domain
[Tue Mar 20 15:50:37 HKT 2018] Getting webroot for domain='example.com'
[Tue Mar 20 15:50:37 HKT 2018] Getting new-authz for domain='example.com'
[Tue Mar 20 15:50:38 HKT 2018] The new-authz request is ok.
[Tue Mar 20 15:50:38 HKT 2018] Getting webroot for domain='www.example.com'
[Tue Mar 20 15:50:38 HKT 2018] Getting new-authz for domain='www.example.com'
[Tue Mar 20 15:50:39 HKT 2018] The new-authz request is ok.
[Tue Mar 20 15:50:39 HKT 2018] example.com is already verified, skip http-01.
[Tue Mar 20 15:50:39 HKT 2018] Verifying:www.example.com
[Tue Mar 20 15:50:43 HKT 2018] Success
[Tue Mar 20 15:50:43 HKT 2018] Verify finished, start to sign.
[Tue Mar 20 15:50:44 HKT 2018] Cert success.
-----BEGIN CERTIFICATE-----
这里一长串就是证书文件输出
-----END CERTIFICATE-----
[Tue Mar 20 15:50:44 HKT 2018] Your cert is in  /root/.acme.sh/example.com/example.com.cer 
[Tue Mar 20 15:50:44 HKT 2018] Your cert key is in  /root/.acme.sh/example.com/example.com.key 
[Tue Mar 20 15:50:45 HKT 2018] The intermediate CA cert is in  /root/.acme.sh/example.com/ca.cer 
[Tue Mar 20 15:50:45 HKT 2018] And the full chain certs is there:  /root/.acme.sh/example.com/fullchain.cer

mkdir -p /etc/nginx/ssl

acme.sh --install-cert -d example.com \
--key-file       /etc/nginx/ssl/example.com.key  \
--fullchain-file /etc/nginx/ssl/example.com.crt \
--reloadcmd     "service nginx force-reload"

acme.sh --install-cert -d example.com \
--key-file       /etc/apache2/ssl/example.com.key  \
--fullchain-file /etc/apache2/ssl/example.com.crt \
--reloadcmd     "service apache2 force-reload"

openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

server {
	listen 443 ssl http2 default_server;
	listen [::]:443 ssl http2 default_server;

	server_name example.com;

	root /var/www/example.com;
	index index.html index.htm index.php;

# 我们采用强大的迪菲-赫尔曼密钥交换，生成命令 openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
	ssl_dhparam /etc/nginx/ssl/dhparam.pem;

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
	ssl_prefer_server_ciphers on;

	ssl_session_cache shared:SSL:50m;
	ssl_session_timeout 1d;

# 如果你 Nginx 配置了 SNI 即多个站点，多个证书，则需要用到如下配置，先生成文件 openssl rand 48 > /etc/nginx/ssl/session_ticket.key
#	ssl_session_ticket_key     /etc/nginx/ssl/session_ticket.key;
#	ssl_session_tickets        off;

# 如果需要开启 OSCP 功能，则需要加入
#	ssl_stapling               on;
#	ssl_stapling_verify        on;
# ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;
#	resolver                   8.8.8.8 8.8.4.4 valid=300s;
#	resolver_timeout           10s;

# 此处是证书文件

	ssl_certificate /etc/nginx/ssl/example.com.crt;
	ssl_certificate_key /etc/nginx/ssl/example.com.key;

# 开启 HSTS Preload 支持

	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; 
	add_header X-Frame-Options SAMEORIGIN;
	add_header X-Content-Type-Options nosniff;
	add_header X-XSS-Protection "1; mode=block";

# 开启 PHP7.2-fpm 模式，如需要安装 PHP 7.1.x 请修改为 fastcgi_pass unix:/run/php/php7.1-fpm.sock;
#	location ~ \.php$ {
#	  include snippets/fastcgi-php.conf;
#    fastcgi_pass unix:/run/php/php7.2-fpm.sock;
#  }

	access_log /var/log/nginx/example.com.access.log;
	error_log /var/log/nginx/example.com.error.log;
}

ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:SEED:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!RSAPSK:!aDH:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SRP';
ssl_prefer_server_ciphers on;

ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;

nginx -t && nginx -s reload

<VirtualHost *:80>

  ServerName example.com
  Redirect permanent / https://example.com/
</VirtualHost>

LoadModule headers_module modules/mod_headers.so

<VirtualHost *:443>

    SSLEngine on
    SSLCertificateFile      /etc/apache2/ssl/example.com.crt
    SSLCertificateKeyFile   /etc/apache2/ssl/example.com.key

    # Uncomment the following directive when using client certificate authentication
    #SSLCACertificateFile    /path/to/ca_certs_for_client_authentication


    # HSTS (mod_headers is required) (15768000 seconds = 6 months)
    Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
    Header always set X-Frame-Options SAMEORIGIN
    Header always set X-Content-Type-Options nosniff
    Header set X-XSS-Protection "1; mode=block"
</VirtualHost>

# intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv3
SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
SSLHonorCipherOrder     on
SSLCompression          off
SSLSessionTickets       off

# OCSP Stapling, only in httpd 2.3.3 and later
# SSLUseStapling          on
# SSLStaplingResponderTimeout 5
# SSLStaplingReturnResponderErrors off
# SSLStaplingCache        shmcb:/var/run/ocsp(128000)

service apache2 reload

acme.sh --issue -d example.com -d '*.example.com' --dns

root@example ~ # acme.sh --issue -d example.com -d '*.example.com' --dns
[Tue Mar 20 16:34:35 HKT 2018] Domains have changed.
[Tue Mar 20 16:34:35 HKT 2018] Registering account
[Tue Mar 20 16:34:36 HKT 2018] Registered
[Tue Mar 20 16:34:36 HKT 2018] ACCOUNT_THUMBPRINT='blablablabla'
[Tue Mar 20 16:34:36 HKT 2018] Multi domain='DNS:example.com,DNS:*.example.com'
[Tue Mar 20 16:34:36 HKT 2018] Getting domain auth token for each domain
[Tue Mar 20 16:34:38 HKT 2018] Getting webroot for domain='example.com'
[Tue Mar 20 16:34:38 HKT 2018] Getting webroot for domain='*.example.com'
[Tue Mar 20 16:34:38 HKT 2018] Add the following TXT record:
[Tue Mar 20 16:34:38 HKT 2018] Domain: '_acme-challenge.example.com'
[Tue Mar 20 16:34:38 HKT 2018] TXT value: 'blablablabla1'
[Tue Mar 20 16:34:38 HKT 2018] Please be aware that you prepend _acme-challenge. before your domain
[Tue Mar 20 16:34:38 HKT 2018] so the resulting subdomain will be: _acme-challenge.example.com
[Tue Mar 20 16:34:38 HKT 2018] Add the following TXT record:
[Tue Mar 20 16:34:38 HKT 2018] Domain: '_acme-challenge.example.com'
[Tue Mar 20 16:34:38 HKT 2018] TXT value: 'blablablabla2'
[Tue Mar 20 16:34:38 HKT 2018] Please be aware that you prepend _acme-challenge. before your domain
[Tue Mar 20 16:34:38 HKT 2018] so the resulting subdomain will be: _acme-challenge.example.com
[Tue Mar 20 16:34:38 HKT 2018] Please add the TXT records to the domains, and re-run with --renew.
[Tue Mar 20 16:34:38 HKT 2018] Please add '--debug' or '--log' to check more details.
[Tue Mar 20 16:34:38 HKT 2018] See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh

root@example ~ # dig TXT _acme-challenge.example.com @9.9.9.9 +short
"blablablabla1"
"blablablabla2"

acme.sh --renew -d example.com -d '*.example.com'

root@example ~ # acme.sh --renew -d example.com -d '*.example.com' --force
[Tue Mar 20 16:41:25 HKT 2018] Renew: 'example.com'
[Tue Mar 20 16:41:26 HKT 2018] Multi domain='DNS:example.com,DNS:*.example.com'
[Tue Mar 20 16:41:26 HKT 2018] Getting domain auth token for each domain
[Tue Mar 20 16:41:26 HKT 2018] Verifying:example.com
[Tue Mar 20 16:41:29 HKT 2018] Success
[Tue Mar 20 16:41:29 HKT 2018] Verifying:*.example.com
[Tue Mar 20 16:41:32 HKT 2018] Success
[Tue Mar 20 16:41:32 HKT 2018] Verify finished, start to sign.
[Tue Mar 20 16:41:33 HKT 2018] Cert success.
-----BEGIN CERTIFICATE-----
这里是证书文件
-----END CERTIFICATE-----
[Tue Mar 20 16:41:33 HKT 2018] Your cert is in  /root/.acme.sh/example.com/example.com.cer 
[Tue Mar 20 16:41:33 HKT 2018] Your cert key is in  /root/.acme.sh/example.com/example.com.key 
[Tue Mar 20 16:41:33 HKT 2018] The intermediate CA cert is in  /root/.acme.sh/example.com/ca.cer 
[Tue Mar 20 16:41:33 HKT 2018] And the full chain certs is there:  /root/.acme.sh/example.com/fullchain.cer 
[Tue Mar 20 16:41:33 HKT 2018] It seems that you are using dns manual mode. please take care: The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead.
[Tue Mar 20 16:41:33 HKT 2018] Call hook error.