letsencrypt ssl证书

本文介绍如何在服务器上为域名获取letsencrypt证书

安装letsencrypt

docker pull quay.io/letsencrypt/letsencrypt

使用webroot插件验证并获取证书

根据webroot插件的原理，我们需要在letsencrypt和nginx容器之间共享一个webroot目录，并在域名中配置challenge的location

这里提供了一个snippets/letsencrypt.conf

#############################################################################
# Configuration file for Let's Encrypt ACME Challenge location
# This file is already included in listen_xxx.conf files.
# Do NOT include it separately!
#############################################################################
#
# This config enables to access /.well-known/acme-challenge/xxxxxxxxxxx
# on all our sites (HTTP), including all subdomains.
# This is required by ACME Challenge (webroot authentication).
# You can check that this location is working by placing ping.txt here:
# /var/www/letsencrypt/.well-known/acme-challenge/ping.txt
# And pointing your browser to:
# http://xxx.domain.tld/.well-known/acme-challenge/ping.txt
#
# Sources:
# https://community.letsencrypt.org/t/howto-easy-cert-generation-and-renewal-with-nginx/3491
#
#############################################################################

# Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx)
# We use ^~ here, so that we don't check other regexes (for speed-up). We actually MUST cancel
# other regex checks, because in our other config files have regex rule that denies access to files with dotted names.
location ^~ /.well-known/acme-challenge/ {

    # Set correct content type. According to this:
    # https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/29
    # Current specification requires "text/plain" or no content header at all.
    # It seems that "text/plain" is a safe option.
    default_type "text/plain";

    # This directory must be the same as in /etc/letsencrypt/cli.ini
    # as "webroot-path" parameter. Also don't forget to set "authenticator" parameter
    # there to "webroot".
    # Do NOT use alias, use root! Target directory is located here:
    # /var/www/common/letsencrypt/.well-known/acme-challenge/
    root         /usr/share/nginx/html;
}

# Hide /acme-challenge subdirectory and return 404 on all requests.
# It is somewhat more secure than letting Nginx return 403.
# Ending slash is important!
location = /.well-known/acme-challenge/ {
    return 404;
}

我们在每一个网站的server最后加上

include /etc/nginx/snippets/letsencrypt.conf;

例如

upstream tunet_website {
	server tunetweb-80.service.lab.mu;
}
server {
	listen 80;
	gzip on;
        gzip_comp_level 4;
        gzip_types application/javascript text/css image/svg+xml;
	server_name tunet.lab.mu;
	access_log /var/log/nginx/tunet_website.access;
	error_log /var/log/nginx/tunet_website.error;
	location / {
		proxy_pass http://tunet_website;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
	}
	include /etc/nginx/snippets/letsencrypt.conf;
}

接下来我们来看一下nginx和letsencrypt的compose file:

globalproxy:
 image: registry.service.lab.mu:5000/mulab/nginx-reload:1.1
 ports:
  - "80:80"
  - "443:443"
 volumes:
  - ./sites-enabled:/etc/nginx/sites-enabled
  - ./certs:/etc/letsencrypt
  - ./letsencrypt_challenge:/usr/share/nginx/html
  - ./log:/var/log/nginx
  - ./snippets:/etc/nginx/snippets
 restart: always
 dns:
  - 172.17.0.1
ssl:
  image: quay.io/letsencrypt/letsencrypt
  volumes:
   - ./cli.ini:/etc/letsencrypt/cli.ini
   - ./certs:/etc/letsencrypt
   - ./letsencrypt_challenge:/usr/share/nginx/html

启动nginx docker-compose up -d globalproxy,然后我们来issue证书

docker-compose run ssl auth -d domain.com

首次运行需要提供一些信息

最后我们配置nginx的ssl配置

upstream labmu_website {
        server website-80.service.lab.mu;
}
server {
        listen 80 default;
	server_name www.lab.mu lab.mu;
	return 301 https://lab.mu$request_uri;
}
server {
	listen 443 ssl;
	ssl_certificate /etc/letsencrypt/live/lab.mu/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/lab.mu/privkey.pem;
	add_header Strict-Transport-Security "max-age=31536000"; 
        gzip on;
        gzip_comp_level 4;
        gzip_types application/javascript text/css image/svg+xml;
        server_name www.lab.mu lab.mu;
        access_log /var/log/nginx/labmu_website.access;
        error_log /var/log/nginx/labmu_website.error;
        location / {
                proxy_pass http://labmu_website;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
        }
	include /etc/nginx/snippets/letsencrypt.conf;
}

手动刷新证书

docker-compose -f letsencrypt.yml run ssl renew