设置 Let's encrypt

我用的是centos + apache, 所以执行的是下面的步骤（无细节）:

1. 安装EPEL源

$ yum install -y epel-release

2. 安装apache版certbot插件

$ yum install -y certbot-apache

3. 配置证书

3.1 通过certbot申请证书

$ certbot --apache certonly -d xinjh.info -d *.xinjh.info --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory

3.2 设置证书的自动更新

因为我的用的是manual安装，所以在自动更新的时候需要设置manual-auth-hook。

这里有一个脚本可以被hook使用：https://github.com/ywdblog/certbot-letencrypt-wildcardcertificates-alydns-au

4. 配置 apache

<VirtualHost *:80>
	DocumentRoot "/var/www/htmlroot"
	ServerName yourdomain.com
	ServerAlias www.yourdomain.com
	<Directory "/var/www/htmlroot">
		Options FollowSymLinks
		AllowOverride All
		Require all granted
	</Directory>
	RewriteEngine on
	RewriteCond %{SERVER_NAME} =yourdomain.com [OR]
	RewriteCond %{SERVER_NAME} =www.yourdomain.com
	RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<IfModule mod_ssl.c>
	<VirtualHost *:443>
		DocumentRoot "/var/www/htmlroot"
		ServerName yourdomain.com
		ServerAlias www.yourdomain.com
		<Directory "/var/www/htmlroot">
			Options FollowSymLinks
			AllowOverride All
			Require all granted
		</Directory>
		Include /etc/letsencrypt/options-ssl-apache.conf
		SSLCertificateFile /etc/letsencrypt/live/yourdomain.com/cert.pem
		SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem
		SSLCertificateChainFile /etc/letsencrypt/live/yourdomain.com/chain.pem
	</VirtualHost>
</IfModule>

配置完成后重启 apache

完成