十年网站开发经验 + 多家企业客户 + 靠谱的建站团队
量身定制 + 运营维护+专业推广+无忧售后,网站问题一站解决
Let\'s Encrypt是什么?
Let\'s Encrypt要求站点要有虚拟主机,所以第一步就是把站点直接连接,变为虚拟主机方式。
建立一个文件夹放置虚拟主机配置文件
mkdir /opt/lampp/etc/myVhost
在/opt/lampp/etc/httpd.conf文件末尾添加
httpd.conf:
IncludeOptional etc/myVhost/*.conf
建立虚拟主机配置文件
vi /opt/lampp/etc/myVhost/example.com.conf
example.com.conf:
ServerName example.com
ServerAlias www.example.com
DocumentRoot /opt/lampp/htdocs
ErrorLog /opt/lampp/logs/example.com/error.log
mkdir /opt/lampp/logs/example.com#建立日志目录
虚拟主机配置完,重启lampp
cd /opt/lampp
./lampp restart #也可只单独重启Apache
2.下载let\'s encrypt程序
yum install epel-release #安装环境
yum install git #安装环境
git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt#下载到let\'s encrypt到/opt/letsencrypt
3.下载证书
cd /opt/letsencrypt
./certbot-auto certonly --webroot-w/opt/lampp/htdocs -d www.example.com
#由于lampp是单独配置的环境,所以只下载证书。
证书下载成功会出现下面类似的提示:
IMPORTANT NOTES:
- If you lose your account credentials, you can recover through
e-mails sent to user@example.com.
- Congratulations! Your certificate and chain have been saved at
/etc/letsencrypt/live/example.com/fullchain.pem. Your cert
will expire on 2016-04-21. To obtain a new version of the
certificate in the future, simply run Let\'s Encrypt again.
- Your account credentials have been saved in your Let\'s Encrypt
configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Let\'s
Encrypt so making regular backups of this folder is ideal.
- If you like Let\'s Encrypt, please consider supporting our work by:
Donating to ISRG / Let\'s Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
4.配置Apache,其实也就是添加证书位置。
vi /opt/lampp/etc/myVhost/example.com.conf
example.com.conf:
ServerName example.com
ServerAlias www.example.com
DocumentRoot /opt/lampp/htdocs
ErrorLog /opt/lampp/logs/example.com/error.log
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
5.设置http跳转至https
到第4步,没有意外的话,应该能在浏览器看到小锁了。不想用http,设置一个跳转就行了。
6.let\'s encrypt证书只有90天的期限,所以定期更新证书很有必要,不过还没有实践过,把网上一些资料先copy下来。
crontab -e
30 2 ** 1 /opt/letsencrypt/letsencrypt-auto renew >>/opt/lampp/logs/example.com/le-renew.log#定时每周一 2:30更新证书
7.更新Let’s Encrypt程序,同样没有实践过,先保存。
cd /opt/letsencrypt
git pull