更换ssl证书为let‘s encrypt，并使用acme.sh定期自动更新ssl证书

1

sudo su root

1

curl  https://get.acme.sh | sh

1

acme.sh  --issue -d blog.lomot.cn  --webroot  /var/www/blog.lomot.cn/

1

acme.sh  --issue -d blog.lomot.cn  --nginx

1

acme.sh --installcert -d blog.lomot.cn --key-file /etc/nginx/ssl/blog.lomot.cn.key --fullchain-file /etc/nginx/ssl/blog.lomot.cn.cer --reloadcmd "service nginx force-reload"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

    server {
        listen 80;
        server_name blog.lomot.cn;
        rewrite ^(.*)$  https://$host$1 permanent;
    }

    server {
        listen 443;
        server_name blog.lomot.cn;
        ssl on;
        ssl_certificate  /etc/nginx/ssl/blog.lomot.cn.cer;
        ssl_certificate_key /etc/nginx/ssl/blog.lomot.cn.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;
        location / {
            proxy_set_header   X-Real-IP $remote_addr;
            proxy_set_header   Host      $http_host;
            proxy_pass         http://localhost:3000;
            proxy_set_header REMOTE-HOST $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }