nginx+acme.sh

安装nginx

1
wget http://soft.vpser.net/lnmp/lnmp1.5.tar.gz -cO lnmp1.5.tar.gz && tar zxf lnmp1.5.tar.gz && cd lnmp1.5 && ./install.sh nginx

安装acme.sh

1
curl https://get.acme.sh | sh

新建网站文件夹

1
mkdir -p /home/wwwroot/www.kaliwifi.com

新建网站配置文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
cat > /usr/local/nginx/conf/vhost/www.kaliwifi.com.conf << EOF
server
{
listen 80;
#listen [::]:80;
server_name www.kaliwifi.com kaliwifi.com;
index index.html index.htm index.php default.html default.htm default.php;
root /home/wwwroot/www.kaliwifi.com;

include rewrite/none.conf;
#error_page 404 /404.html;

# Deny access to PHP files in specific directory
#location ~ /(wp-content|uploads|wp-includes|images)/.*\.php$ { deny all; }

include enable-php.conf;

location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
expires 30d;
}

location ~ .*\.(js|css)?$
{
expires 12h;
}

location ~ /.well-known {
allow all;
}

location ~ /\.
{
deny all;
}

access_log off;

}
EOF

启动nginx

1
/etc/init.d/nginx start

生成dhparam

1
openssl dhparam -out /usr/local/nginx/conf/ssl/dhparam.pem 2048

生成证书

1
acme.sh --issue -d www.kaliwifi.com -d kaliwifi.com -w /home/wwwroot/www.kaliwifi.com

安装证书

1
2
3
4
acme.sh --install-cert -d www.kaliwifi.com \
--key-file /usr/local/nginx/conf/ssl/www.kaliwifi.com/www.kaliwifi.com.key \
--fullchain-file /usr/local/nginx/conf/ssl/www.kaliwifi.com/fullchain.cer \
--reloadcmd "/etc/init.d/nginx reload"

停止nginx

1
/etc/init.d/nginx stop

修改配置添加https

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
echo > /usr/local/nginx/conf/vhost/www.kaliwifi.com.conf << EOF
{
listen 80;
#listen [::]:80;
server_name www.kaliwifi.com kaliwifi.com;
rewrite ^ https://$server_name$request_uri? permanent;
index index.html index.htm index.php default.html default.htm default.php;
root /home/wwwroot/www.kaliwifi.com;

include rewrite/none.conf;
#error_page 404 /404.html;

# Deny access to PHP files in specific directory
#location ~ /(wp-content|uploads|wp-includes|images)/.*\.php$ { deny all; }

include enable-php.conf;

location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
expires 30d;
}

location ~ .*\.(js|css)?$
{
expires 12h;
}

location ~ /.well-known {
allow all;
}

location ~ /\.
{
deny all;
}

access_log off;

}

server
{
listen 443 ssl http2;
#listen [::]:443 ssl http2;
server_name www.kaliwifi.com kaliwifi.com;
index index.html index.htm index.php default.html default.htm default.php;
root /home/wwwroot/www.kaliwifi.com;
ssl on;
ssl_certificate /usr/local/nginx/conf/ssl/www.kaliwifi.com/fullchain.cer;
ssl_certificate_key /usr/local/nginx/conf/ssl/www.kaliwifi.com/www.kaliwifi.com.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5";
ssl_session_cache builtin:1000 shared:SSL:10m;
# openssl dhparam -out /usr/local/nginx/conf/ssl/dhparam.pem 2048
ssl_dhparam /usr/local/nginx/conf/ssl/dhparam.pem;

include rewrite/none.conf;
#error_page 404 /404.html;

# Deny access to PHP files in specific directory
#location ~ /(wp-content|uploads|wp-includes|images)/.*\.php$ { deny all; }

include enable-php.conf;

location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
expires 30d;
}

location ~ .*\.(js|css)?$
{
expires 12h;
}

location ~ /.well-known {
allow all;
}

location ~ /\.
{
deny all;
}

access_log off;
}
EOF

启动nginx

1
/etc/init.d/nginx start

删除指定域名证书

1
acme.sh --remove -d www.kaliwifi.com

强制更新所有证书

1
acme.sh --renew-all --force

更新指定域名证书

1
acme.sh --renew -d www.kaliwifi.com

卸载证书自动更新

1
acme.sh --uninstall-cronjob

安装证书自动更新

1
acme.sh --install-cronjob

查看计划任务

1
crontab -l

重启nginx

1
/etc/init.d/nginx restart

重新加载nginx配置

1
/etc/init.d/nginx reload

检查nginx配置语法是否正确

1
/etc/init.d/nginx configtest

查看nginx状态

1
/etc/init.d/nginx status

坚持原创技术分享,您的支持将鼓励我继续创作!