LNMP安装Let’s Encrypt 免费SSL证书方法:自动安装与手动配置Nginx

1
2

wget -c http://soft.vpser.net/lnmp/lnmp1.4beta.tar.gz && tar zxf lnmp1.4beta.tar.gz && cd lnmp1.4 && ./install.sh {lnmp|lnmpa|lamp} #请注意最后的参数，需要哪个模式就写哪个，./install.sh 不带任何参数默认为LNMP模式。

1
2
3
4
5
6
7
8

server
{
        listen 80;
        server_name ucblog.net www.ucblog.net;
        rewrite ^(.*) https://www.ucblog.net$1 permanent; } #或者 return 301 https://www.ucblog.net$request_uri;

1
2
3

wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto
./certbot-auto certonly

1
2

/etc/letsencrypt/live/web.ucblog.net/fullchain.pem
/etc/letsencrypt/live/web.ucblog.net/privkey.pem

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

server
    {
        listen 80;
        #listen [::]:80;
        server_name we.ucblog.net ;
        index index.html index.htm index.php default.html default.htm default.php;
        root  /home/wwwroot/we.ucblog.net;  include wordpress.conf; #error_page 404 /404.html;  # Deny access to PHP files in specific directory #location ~ /(wp-content|uploads|wp-includes|images)/.*\.php$ { deny all; }  include enable-php.conf;  location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ { expires 30d; }  location ~ .*\.(js|css)?$ { expires 12h; }  location ~ /.well-known { allow all; }  location ~ /\. { deny all; }  access_log /home/wwwlogs/we.ucblog.net.log; }

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

server
    {
        listen 80;
        #listen [::]:80;
        server_name web.ucblog.net ;
        index index.html index.htm index.php default.html default.htm default.php;
        root  /home/wwwroot/web.ucblog.net;  include wordpress.conf; #error_page 404 /404.html;  # Deny access to PHP files in specific directory #location ~ /(wp-content|uploads|wp-includes|images)/.*\.php$ { deny all; }  include enable-php.conf;  location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ { expires 30d; }  location ~ .*\.(js|css)?$ { expires 12h; }  location ~ /.well-known { allow all; }  location ~ /\. { deny all; }  access_log /home/wwwlogs/web.ucblog.net.log; }  server { listen 443 ssl http2; #listen [::]:443 ssl http2; server_name web.ucblog.net ; index index.html index.htm index.php default.html default.htm default.php; root /home/wwwroot/web.ucblog.net; ssl on; ssl_certificate /etc/letsencrypt/live/web.ucblog.net/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/web.ucblog.net/privkey.pem; ssl_session_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5"; ssl_session_cache builtin:1000 shared:SSL:10m; # openssl dhparam -out /usr/local/nginx/ssl/dhparam.pem 2048 ssl_dhparam /usr/local/nginx/ssl/dhparam.pem;  include wordpress.conf; #error_page 404 /404.html;  # Deny access to PHP files in specific directory #location ~ /(wp-content|uploads|wp-includes|images)/.*\.php$ { deny all; }  include enable-php.conf;  location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ { expires 30d; }  location ~ .*\.(js|css)?$ { expires 12h; }  location ~ /.well-known { allow all; }  location ~ /\. { deny all; }  access_log /home/wwwlogs/web.ucblog.net.log; }

1

0 3 */7 * * /bin/certbot renew --renew-hook "/etc/init.d/nginx reload"