配置https

引子：

最近在一篇文章中了解到EFF(电子前哨基金会)为了推广https协议，成立了一个let'sencrypt项目，可以发放免费的证书，此证书可以被大多数主流浏览器所信任，这个邪恶的念头一爆发，就让我走上了一条坎坷的不归路。

准备：
工具:certbot
环境:centOS7

获取Certbot工具：
根据我在网上了解到的信息，获取certbot工具有三种方法
第一种是通过git在github中下载

git clone https://github.com/certbot/certbot.git

第二种是通过epel-release软件源，这个软件源有许多yum中没有的软件包,包括certbot

yum install epel-release
yum install certbot

第三种是通过wget来进行下载

wget https://dl.eff.org/certbot-auto

由于钟爱github，熟悉git所以直接使用git下载好了
执行命令

git clone https://github.com/certbot/certbot.git

生成证书：
下载完了之后，会创建一个certbot的目录

cd certbot
certbot-auto certonly --standalone --email crisen@crisen.org  -d www.crisen.org

然后agree协议静静等待生成证书即可
出现下面提示就说明安装好了

IMPORTANT NOTES:- Congratulations! Your certificate and chain have been saved at/etc/letsencrypt/live/your.domain.com/fullchain.pem. Your certwill expire on 20XX-09-23. To obtain a new or tweaked version ofthis certificate in the future, simply run certbot again. Tonon-interactively renew *all* of your certificates, run "certbotrenew"
 - If you like Certbot, please consider supporting our work by:Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donateDonating to EFF:                    https://eff.org/donate-le

证书会生成在/etc/letsencrypt/live目录下

部署证书：
接着把证书的公钥和私钥配置到nginx的ssl目录下，创建软链接

ln -s /etc/letsencrypt/live/www.crisen.org/fullchain.pem   /usr/local/nginx/conf/ssl/www.crisen.org.crt
ln -s /etc/letsencrypt/live/www.crisen.org/privkey.pem    /usr/local/nginx/conf/ssl/www.crisen.org.key

当然直接复制过去也是可行的

cp -i  /etc/letsencrypt/live/www.crisen.org/fullchain.pem  /usr/local/nginx/conf/ssl/www.crisen.org.crt
cp -i /etc/letsencrypt/live/www.crisen.org/privkey.pem  /usr/local/nginx/conf/ssl/www.crisen.org.key

接下来只要配置 nginx 的https服务就可以了下面是我的nginx服务器配置文件

server {listen 80;listen 443 ssl http2;ssl_certificate /usr/local/nginx/conf/ssl/www.crisen.org.crt;ssl_certificate_key /usr/local/nginx/conf/ssl/www.crisen.org.key;ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;ssl_prefer_server_ciphers on;ssl_session_timeout 10m;ssl_session_cache builtin:1000 shared:SSL:10m;ssl_buffer_size 1400;add_header Strict-Transport-Security max-age=15768000;ssl_stapling on;ssl_stapling_verify on;ssl_trusted_certificate   /usr/local/nginx/conf/ssl/www.crisen.org.crt;server_name www.crisen.org;access_log /data/wwwlogs/www.crisen.org_nginx.log combined;index index.html index.htm index.php;include /usr/local/nginx/conf/rewrite/none.conf;root /data/wwwroot/profiles;if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
location ~ [^/]\.php(/|$) {#fastcgi_pass remote_php_ip:9000;fastcgi_pass unix:/dev/shm/php-cgi.sock;fastcgi_index index.php;include fastcgi.conf;}location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|ico)$ {expires 30d;access_log off;}location ~ .*\.(js|css)?$ {expires 7d;access_log off;}
}