letsencrypt申请流程
在了解该协议之前有几个注意点：1）客户在申请 Let’sEncrypt 证书的时候，需要校验域名的所有权，证明操作者有权利为该域名申请证书，目前支持三种验证方式：
[*]dns-01：给域名添加一个 DNS TXT 记录。
[*]http-01：在域名对应的 Web 服务器下放置一个 HTTP well-known URL 资源文件。
[*]tls-sni-01：在域名对应的 Web 服务器下放置一个 HTTPS well-known URL 资源文件。
而申请通配符证书，只能使用 dns-01 的方式
git clonehttps://github.com/letsencrypt/letsencrypt
cd letsencrypt ./certbot-auto certonly-d *.imobilechain.org --manual--preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory 介绍下相关参数：
[*]certonly，表示安装模式，Certbot 有安装模式和验证模式两种类型的插件。
[*]--manual 表示手动安装插件，Certbot 有很多插件，不同的插件都可以申请证书，用户可以根据需要自行选择
[*]-d 为那些主机申请证书，如果是通配符，输入 *.newyingyong.cn（可以替换为你自己的域名）
[*]--preferred-challenges dns，使用 DNS 方式校验域名所有权
[*]--server，Let's Encrypt ACME v2 版本使用的服务器不同于 v1 版本，需要显示指定。
Enter email address (used forurgent renewal and security notices) (Enter 'c' tocancel):google@imobilechain.org - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Please read theTerms of Service athttps://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf.You mustagree in order toregister with the ACME server athttps://acme-v02.api.letsencrypt.org/directory- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -(A)gree/(C)ancel: A - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Would you bewilling to share your email address with the Electronic FrontierFoundation, afounding partner of the Let's Encrypt project and the non-profitorganization that developsCertbot? We'd like to send you email about our workencrypting the web,EFF news, campaigns, and ways to support digital freedom.- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -(Y)es/(N)o: YObtaining a newcertificatePerforming thefollowing challenges:dns-01 challengefor imobilechain.orgdns-01 challengefor irc.dirtysea.com - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -NOTE: The IP ofthis machine will be publicly logged as having requested thiscertificate. Ifyou're running certbot in manual mode on a machine that is notyour server, pleaseensure you're okay with that. Are you OK withyour IP being logged?- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -(Y)es/(N)o: Y - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Please deploy a DNSTXT record under the name_acme-challenge.imobilechain.orgwith the following value: u1933de2nT8XIL0lS6xfhImZrBBvhrPN5Pn3QXLDJ3Q Before continuing,verify the record is deployed.- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Press Enter toContinue 交互式的提示：· 是否同意 Let's Encrypt 协议要求· 询问是否对域名和机器（IP）进行绑定确认同意才能继续· 要求配置 DNS TXT 记录，从而校验域名所有权，也就是判断证书申请者是否有域名的所有权。上面输出要求给 _acme-challenge.imobilechain.org配置一条 TXT 记录，在没有确认 TXT 记录生效之前不要回车执行。file:///C:/Users/root/AppData/Local/Temp/msohtmlclip1/01/clip_image001.pngfile:///C:/Users/root/AppData/Local/Temp/msohtmlclip1/01/clip_image003.jpg 查询是否生效:LINUX下验证:dig -t txt _acme-challenge.imobilechain.org@8.8.8.8WINDOWS下验证：nslookup-> set type=txt - Congratulations! Your certificate and chainhave been saved at:/etc/letsencrypt/live/imobilechain.org/fullchain.pem Your key file has been saved at:/etc/letsencrypt/live/imobilechain.org/privkey.pem Your cert will expire on 2019-01-14. Toobtain a new or tweaked version of this certificate in the future,simply run certbot-auto again. To non-interactively renew *all* ofyour certificates, run "certbot-auto renew" - If you like Certbot, please considersupporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donateDonating to EFF: https://eff.org/donate-le 恭喜您，证书申请成功 tree/etc/letsencrypt/archive/imobilechain.org├── cert1.pem├── chain1.pem├── fullchain1.pem└── privkey1.pem 更新证书流程就是重新执行一遍上面的操作，新证书会在你申请证书的日期上加三个月
页:
[1]