Let‘s encryt生成免费证书

Let’s encryt生成免费证

安装certbot（https://certbot.eff.org/instructions?ws=nginx&os=ubuntufocal）

sudo snap install --classic certbot

建立软链

sudo ln -s /snap/bin/certbot /usr/bin/certbot

生成证书并自动修改nginx配置

sudo certbot --nginx

输入邮箱、域名后一路确定就ok了

生成二级域名证书

sudo certbot certonly -d "*.xxx.com","xxx.com" --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory

需要在DNS上配置TXT Record Host: _acme-challenge,value:如上图所示

nginx配置

server {
	server_name xxx.com;
}

二级域名

server {
	server_name *.xxx.com;
}

测试工具
https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.xxx.com