Mozilla、思科、Akamai、IdenTrust、EFF 和密歇根大學(xué)研究人員聯(lián)合宣布了 Let’s Encrypt CA 項(xiàng) 目，計(jì)劃為網(wǎng)站提供免費(fèi)的基本 SSL 證書，以加速互聯(lián)網(wǎng)從 HTTP 向 HTTPS 過渡。Let’s Encrypt CA 將由非贏利組織 Internet Security Research Group (ISRG) 運(yùn)營，今天12月4日凌晨項(xiàng)目正式進(jìn)入公測階段，遂趕緊進(jìn)行申請?jiān)囉靡幌隆?/p>
之前我申請證書都是用BS方式，這次是CS方式，感覺挺新鮮。
我的服務(wù)器環(huán)境 centos6.6
要安裝python2.7，2.6在申請時(shí)會報(bào)錯
下載地址 https://www.python.org/downloads/release/python-2710/
wget tar zxf Python-2.7.10.tgz cd Python-2.7.10 ./configure make && make install #把系統(tǒng)python命令指到新版本 which python /usr/local/bin/python rm /usr/local/bin/python ln -s /usr/local/bin/python2.7 /usr/local/bin/python
2.下載letsencrypt客戶端
yum install -y git git clone https://github.com/letsencrypt/letsencrypt.git cd letsencrypt ./letsencrypt-auto --help Updating letsencrypt and virtual environment dependencies....... Running with virtualenv: /root/.local/share/letsencrypt/bin/letsencrypt --help letsencrypt [SUBCOMMAND] [options] [-d domain] [-d domain] ... The Let's Encrypt agent can obtain and install HTTPS/TLS/SSL certificates. By default, it will attempt to use a webserver both for obtaining and installing the cert. Major SUBCOMMANDS are: (default) run Obtain & install a cert in your current webserver certonly Obtain cert, but do not install it (aka "auth") install Install a previously obtained cert in a server revoke Revoke a previously obtained certificate rollback Rollback server configuration changes made during install config_changes Show changes made to server config during installation plugins Display information about installed plugins Choice of server plugins for obtaining and installing cert: --apache Use the Apache plugin for authentication & installation --standalone Run a standalone webserver for authentication (nginx support is experimental, buggy, and not installed by default) --webroot Place files in a server's webroot folder for authentication OR use different plugins to obtain (authenticate) the cert and then install it: --authenticator standalone --installer apache More detailed help: -h, --help [topic] print this message, or detailed help on a topic; the available topics are: all, automation, paths, security, testing, or any of the subcommands or plugins (certonly, install, nginx, apache, standalone, webroot, etc)
3.客戶端可以為你提供申請+全自動安裝apache/nginx等一條龍服務(wù)，這里我選擇DIY，只申請，不用麻煩客戶端了，執(zhí)行以下命令
./letsencrypt-auto certonly --manual
輸入你的域名
提示是否同意他們記錄你這次請求的ip地址，同意
這一步是驗(yàn)證域名所有權(quán)，很關(guān)鍵
這一步的意思是，客戶端將訪問http://www.example.com/.well-known/acme-challenge/xiDWA8FkdWeTua7MIXBpQ3PeLt8jVu5Eimi4-jPsTHs 看看輸出是不是 xiDWA8FkdWeTua7MIXBpQ3PeLt8jVu5Eimi4-jPsTHs.MOcybE5RrQ_NsGgFybrHkVcTSohWn2z0JDfTtQkHKQE
我是提前裝了nginx服務(wù)器，那么只需要在我的網(wǎng)站根目錄下創(chuàng)建目錄和對應(yīng)內(nèi)容的文件，在公網(wǎng)能訪問得到就可以了。
cd /wwwroot/ mkdir -p ./.well-known/acme-challenge/ echo xiDWA8FkdWeTua7MIXBpQ3PeLt8jVu5Eimi4-jPsTHs.MOcybE5RrQ_NsGgFybrHkVcTSohWn2z0JDfTtQkHKQE>./.well-known/acme-challenge/xiDWA8FkdWeTua7MIXBpQ3PeLt8jVu5Eimi4-jPsTHs 試試獲取一下輸出正常了沒 curl 若正常，按回車。（如果還沒裝web服務(wù)器的話可以按照提示執(zhí)行#run only once per server下面的命令）
4.證書獲取成功
IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at /etc/letsencrypt/live/example.com/fullchain.pem. Your cert will expire on 2016-03-03. To obtain a new version of the certificate in the future, simply run Let's Encrypt again. - If like Let's Encrypt, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
后面再發(fā)一篇博文講述如何使用這個(gè)證書。
另外有需要云服務(wù)器可以了解下創(chuàng)新互聯(lián)scvps.cn，海內(nèi)外云服務(wù)器15元起步，三天無理由+7*72小時(shí)售后在線，公司持有idc許可證，提供“云服務(wù)器、裸金屬服務(wù)器、高防服務(wù)器、香港服務(wù)器、美國服務(wù)器、虛擬主機(jī)、免備案服務(wù)器”等云主機(jī)租用服務(wù)以及企業(yè)上云的綜合解決方案，具有“安全穩(wěn)定、簡單易用、服務(wù)可用性高、性價(jià)比高”等特點(diǎn)與優(yōu)勢，專為企業(yè)上云打造定制，能夠滿足用戶豐富、多元化的應(yīng)用場景需求。
重慶分公司
重慶分公司
