Let's Encrypt - Nginx - HTTPS 免费

1. 安装

Apache 版
http://jasonmun.blogspot.my/2017/01/https-lets-encrypt.html

或

http://jasonmun.blogspot.my/2017/02/lets-encrypt-certbot.html

$ su
$ wget https://dl.eff.org/certbot-auto
$ chmod a+x certbot-auto
$ mkdir /opt/letsencrypt
$ mv certbot-auto /opt/letsencrypt/
$ /opt/letsencrypt/certbot-auto

$ /opt/letsencrypt/certbot-auto certonly --webroot -w /var/www/html -d member.dlinkddns.com -d www.member.dlinkddns.com

测试
$ /opt/letsencrypt/certbot-auto renew --dry-run
$ /opt/letsencrypt/certbot-auto renew --quiet --no-self-upgrade

$ gedit /opt/letsencrypt/renew.sh

#!/bin/sh
/opt/letsencrypt/certbot-auto renew --quiet --no-self-upgrade --post-hook "service nginx reload"

一天执行 2次
$ 30 2 * * 0 /opt/letsencrypt/renew.sh

2. 设置

$ gedit /etc/nginx/sites-enabled/default

server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;

server_name member.dlinkddns.com;
root /var/www/html;
index index.php index.html index.htm index.nginx-debian.html;

       # 强制用 HTTPS
       rewrite ^(.*)$ https://$host$1 permanent;

ssl on;

ssl_certificate /etc/letsencrypt/live/member.dlinkddns.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/member.dlinkddns.com/privkey.pem;

ssl_session_timeout 5m;
       ssl_session_cache shared:SSL:50m;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_prefer_server_ciphers on;

location ^~ /.well-known/acme-challenge/ {
alias /var/www/html/;
}

       location ~ /\. {
             deny all;
       }
}

3. 重启

$ nginx -t

$ systemctl restart nginx