服务器维护,服务器代维,安全设置,漏洞扫描,入侵检测服务

运维之家

 找回密码
 注册
搜索
查看: 286|回复: 0

letsencrypt申请流程

[复制链接]
dirtysea 发表于 2018-10-16 15:03:26 | 显示全部楼层 |阅读模式



在了解该协议之前有几个注意点:
1)客户在申请 Let’sEncrypt 证书的时候,需要校验域名的所有权,证明操作者有权利为该域名申请证书,目前支持三种验证方式:

  • dns-01:给域名添加一个 DNS TXT 记录。
  • http-01:在域名对应的 Web     服务器下放置一个 HTTP well-known URL 资源文件。
  • tls-sni-01:在域名对应的 Web     服务器下放置一个 HTTPS well-known URL 资源文件。
而申请通配符证书,只能使用 dns-01 的方式


./certbot-auto certonly  -d *.imobilechain.org --manual--preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory
介绍下相关参数:

  • certonly,表示安装模式,Certbot     有安装模式和验证模式两种类型的插件。
  • --manual 表示手动安装插件,Certbot     有很多插件,不同的插件都可以申请证书,用户可以根据需要自行选择
  • -d 为那些主机申请证书,如果是通配符,输入     *.newyingyong.cn(可以替换为你自己的域名)
  • --preferred-challenges dns,使用 DNS 方式校验域名所有权
  • --server,Let's     Encrypt ACME v2 版本使用的服务器不同于 v1 版本,需要显示指定。

Enter email address (used forurgent renewal and security notices) (Enter 'c' to
cancel):google@imobilechain.org
- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read theTerms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf.You must
agree in order toregister with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A
- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you bewilling to share your email address with the Electronic Frontier
Foundation, afounding partner of the Let's Encrypt project and the non-profit
organization that developsCertbot? We'd like to send you email about our work
encrypting the web,EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Obtaining a newcertificate
Performing thefollowing challenges:
dns-01 challengefor imobilechain.org
dns-01 challengefor irc.dirtysea.com
- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP ofthis machine will be publicly logged as having requested this
certificate. Ifyou're running certbot in manual mode on a machine that is not
your server, pleaseensure you're okay with that.
Are you OK withyour IP being logged?
- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNSTXT record under the name
_acme-challenge.imobilechain.orgwith the following value:
u1933de2nT8XIL0lS6xfhImZrBBvhrPN5Pn3QXLDJ3Q
Before continuing,verify the record is deployed.
- - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter toContinue
交互式的提示:
·        是否同意 Let's Encrypt 协议要求
·        询问是否对域名和机器(IP)进行绑定
确认同意才能继续
·        要求配置 DNS TXT 记录,从而校验域名所有权,也就是判断证书申请者是否有域名的所有权。
上面输出要求给 _acme-challenge.imobilechain.org配置一条 TXT 记录,在没有确认 TXT 记录生效之前不要回车执行
file:///C:/Users/root/AppData/Local/Temp/msohtmlclip1/01/clip_image001.png
file:///C:/Users/root/AppData/Local/Temp/msohtmlclip1/01/clip_image003.jpg
查询是否生效:
LINUX下验证:  dig -t txt _acme-challenge.imobilechain.org@8.8.8.8
WINDOWS下验证:nslookup-> set type=txt
- Congratulations! Your certificate and chainhave been saved at:
  /etc/letsencrypt/live/imobilechain.org/fullchain.pem
   Your key file has been saved at:
  /etc/letsencrypt/live/imobilechain.org/privkey.pem
   Your cert will expire on 2019-01-14. Toobtain a new or tweaked
   version of this certificate in the future,simply run certbot-auto
   again. To non-interactively renew *all* ofyour certificates, run
   "certbot-auto renew"
- If you like Certbot, please considersupporting our work by:
   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
  Donating to EFF:                   https://eff.org/donate-le
恭喜您,证书申请成功
tree/etc/letsencrypt/archive/imobilechain.org
├── cert1.pem
├── chain1.pem
├── fullchain1.pem
└── privkey1.pem
更新证书流程就是重新执行一遍上面的操作,新证书会在你申请证书的日期上加三个月

您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|小黑屋|手机版|Archiver|运维之家 ( 蜀ICP备12020351号 )

GMT+8, 2018-12-19 20:29 , Processed in 0.055358 second(s), 15 queries .

Powered by Discuz! X3.4

© 2001-2017 Comsenz Inc.

快速回复 返回顶部 返回列表