SSL证书这么用

作者: fabs | 来源:发表于2017-07-04 12:22 被阅读291次

    HTTPS 化

    近日,谷歌工程师宣布将在2018年第二季度发布的Chrome 67中禁止一切使用不安全来源的呈现API(Presentation API)。
    Presentation API, 即呈现API,是一个能使网页内容访问演示文稿显示并呈现自身的W3C标准技术。它允许设备在第二屏幕上显示内容,例如投影机或电视机。 Presentation API更显着的用途之一是谷歌在Chrome,Android和Chrome Cast设备上提供的“Casting”功能。

    Let's Encrypt

    https://letsencrypt.org/
    Let's Encrypt 项目由 EFF、 Mozilla、Akamai、密歇根大学和思科等组织发起,由非营利组织互联网安全研究集团(Internet Security Research Group)经营,其使命是让每个网站都能使用 HTTPS 加密。
    Let's Encrypt 项目宣布它已签发了超过 1 亿个证书。

    图片.png

    下载客户端

    https://github.com/certbot/certbot/releases

        wget https://github.com/certbot/certbot/archive/v0.15.0.tar.gz
    
        tar -xvf v0.15.0.tar.gz
    
        cd certbot-0.15.0
    

    三种安装模式

    
        ./letsencrypt-auto --help
    
    

    Manual

        // 在非目标服务器上执行模式
        --manual          Obtain certificates interactively, or using shell script hooks
    

    执行如下命令

    
        ./letsencrypt-auto certonly --manual -d gg.fabself.net
    
    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Obtaining a new certificate
    Performing the following challenges:
    http-01 challenge for gg.fabself.net
    
    -------------------------------------------------------------------------------
    NOTE: The IP of this machine will be publicly logged as having requested this
    certificate. If you're running certbot in manual mode on a machine that is not
    your server, please ensure you're okay with that.
    
    Are you OK with your IP being logged?
    -------------------------------------------------------------------------------
    (Y)es/(N)o:Y
    

    Yes 过后有如下提示:

    Make sure your web server displays the following content at
    http://gg.fabself.net/.well-known/acme-challenge/LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw before continuing:
    
    LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw.3h_8AoI_OjBsHFko6XV4wNW6f_WlyXhoaEsne5R6Zw0
    
    If you don't have HTTP server configured, you can run the following
    command on the target server (as root):
    
    mkdir -p /tmp/certbot/public_html/.well-known/acme-challenge
    cd /tmp/certbot/public_html
    printf "%s" LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw.3h_8AoI_OjBsHFko6XV4wNW6f_WlyXhoaEsne5R6Zw0 > .well-known/acme-challenge/LX_kS_OyVVNdeEI3aDRjXP4-eHFRNhh1JMDuePhKVgw
    # run only once per server:
    $(command -v python2 || command -v python2.7 || command -v python2.6) -c \
    "import BaseHTTPServer, SimpleHTTPServer; \
    s = BaseHTTPServer.HTTPServer(('', 80), SimpleHTTPServer.SimpleHTTPRequestHandler); \
    s.serve_forever()"
    -------------------------------------------------------------------------------
    Press Enter to Continue
    

    在回车之前,按以上提示登录到 目标服务器,执行以上脚本
    再回到操作机器上回车,可以看到如下:

    Waiting for verification...
    Cleaning up challenges
    
    IMPORTANT NOTES:
     - Congratulations! Your certificate and chain have been saved at
       /etc/letsencrypt/live/gg.fabself.net/fullchain.pem. Your cert will
       expire on 2017-10-01. To obtain a new or tweaked version of this
       certificate in the future, simply run letsencrypt-auto again. To
       non-interactively renew *all* of your certificates, run
       "letsencrypt-auto renew"
     - If you like Certbot, please consider supporting our work by:
    
       Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
       Donating to EFF:                    https://eff.org/donate-le
    

    证书已经签好,并放在了指定目录下 /etc/letsencrypt/live

    tree 一下看看文件列表

    sudo tree /etc/letsencrypt/live/
    
    /etc/letsencrypt/live/
    └── gg.fabself.net
        ├── README
        ├── cert.pem -> ../../archive/gg.fabself.net/cert1.pem
        ├── chain.pem -> ../../archive/gg.fabself.net/chain1.pem
        ├── fullchain.pem -> ../../archive/gg.fabself.net/fullchain1.pem
        └── privkey.pem -> ../../archive/gg.fabself.net/privkey1.pem
    

    Standalone

            //在目标主机上操作模式
         --standalone      Run a standalone webserver for authentication
    

    执行如下命令,执行命令之前确保 nginx/Apache 已关闭

    
        ./letsencrypt-auto certonly --standalone -d gg.fabself.net
    

    很速度

    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Obtaining a new certificate
    Performing the following challenges:
    tls-sni-01 challenge for gg.fabself.net
    Waiting for verification...
    Cleaning up challenges
    
    IMPORTANT NOTES:
     - Congratulations! Your certificate and chain have been saved at
       /etc/letsencrypt/live/gg.fabself.net/fullchain.pem. Your cert will
       expire on 2017-10-01. To obtain a new or tweaked version of this
       certificate in the future, simply run letsencrypt-auto again. To
       non-interactively renew *all* of your certificates, run
       "letsencrypt-auto renew"
     - If you like Certbot, please consider supporting our work by:
    
       Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
       Donating to EFF:                    https://eff.org/donate-le
    
    sudo tree /etc/letsencrypt/live
    /etc/letsencrypt/live
    `-- gg.fabself.net
        |-- cert.pem -> ../../archive/gg.fabself.net/cert1.pem
        |-- chain.pem -> ../../archive/gg.fabself.net/chain1.pem
        |-- fullchain.pem -> ../../archive/gg.fabself.net/fullchain1.pem
        |-- privkey.pem -> ../../archive/gg.fabself.net/privkey1.pem
        `-- README
    

    Webroot

        //在目标主机上,nginx/Apache 启动的状态下,指定文件目录操作模式
        --webroot         Place files in a server's webroot folder for authentication
    

    执行如下命令

        ./letsencrypt-auto certonly --webroot -w  /usr/share/nginx/html -d gg.fabself.net
    
    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Obtaining a new certificate
    Performing the following challenges:
    http-01 challenge for gg.fabself.net
    Using the webroot path /usr/share/nginx/html for all unmatched domains.
    Waiting for verification...
    Cleaning up challenges
    
    IMPORTANT NOTES:
     - Congratulations! Your certificate and chain have been saved at
       /etc/letsencrypt/live/gg.fabself.net/fullchain.pem. Your cert will
       expire on 2017-10-01. To obtain a new or tweaked version of this
       certificate in the future, simply run letsencrypt-auto again. To
       non-interactively renew *all* of your certificates, run
       "letsencrypt-auto renew"
     - If you like Certbot, please consider supporting our work by:
    
       Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
       Donating to EFF:                    https://eff.org/donate-le
    
    sudo tree /etc/letsencrypt/live
    /etc/letsencrypt/live
    `-- gg.fabself.net
        |-- cert.pem -> ../../archive/gg.fabself.net/cert1.pem
        |-- chain.pem -> ../../archive/gg.fabself.net/chain1.pem
        |-- fullchain.pem -> ../../archive/gg.fabself.net/fullchain1.pem
        |-- privkey.pem -> ../../archive/gg.fabself.net/privkey1.pem
        `-- README
    

    证书部署

    证书描述
    cert.pem 申请的服务器证书文件

    privkey.pem 服务器证书对应的私钥

    chain.pem 除服务器证书外,浏览器解析所需的其他全部证书,比如根证书和中间证书

    fullchain.pem 包含服务器证书的全部证书链文件

    ** nginx 配置**

    打开 nginx.conf,配置 443 端口及证书路径

        server {
            listen 443;
            server_name gg.fabself.net;
    
            root /usr/share/nginx/html;
            index index.html index.htm;
            ssl on;
            ssl_certificate /etc/letsencrypt/live/gg.fabself.net/fullchain.pem;
            ssl_certificate_key /etc/letsencrypt/live/gg.fabself.net/privkey.pem;
            ssl_session_timeout 5m;
            ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
            ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
            ssl_prefer_server_ciphers on;
    
            location / {
                    try_files $uri $uri/ =404;
            }
        }
    

    配置 80 端口重定向至 433

        server {
            listen 80 default_server;
            listen [::]:80 default_server ipv6only=on;
            root /usr/share/nginx/html;
            index index.html index.htm;
            server_name gg.fabself.net;
            return 301 https://$server_name$request_uri;
        }
    

    就这样简单,HTTPS 配置成功

    图片.png

    证书有效期 90 天

    更新证书

    自动更新需要在 目标主机 上进行,选用 standaloneWebroot模式比较适用

        ./letsencrypt-auto renew
    

    如果提示如下,说明证书还没有过期,就耐心等待

    -------------------------------------------------------------------------------
    Processing /etc/letsencrypt/renewal/gg.fabself.net.conf
    -------------------------------------------------------------------------------
    Cert not yet due for renewal
    
    The following certs are not due for renewal yet:
      /etc/letsencrypt/live/gg.fabself.net/fullchain.pem (skipped)
    No renewals were attempted.
    
    考虑更自动化的方式,可以把 `./letsencrypt-auto renew` 加入到 `crontab` 中,可以每天更新两次保障

    相关文章

      网友评论

      • dkvirus:没看懂 ssl 到底是什么用
        fabs:如果你的站点有 HTTPS 访问需要,可以使用
        https://en.wikipedia.org/wiki/SSL

      本文标题:SSL证书这么用

      本文链接:https://www.haomeiwen.com/subject/gunthxtx.html