Acme-Tiy是采用Pytho编写的，一款轻量级的TLS证书加密工具。
使用
获取秘钥
opessl gersa 4096 > accout.key使用现有的秘钥
# Dowload the scriptwget -O - "https://gist.githubusercotet.com/JoLudy/f25c99ee0770e19dc595/raw/6035c1c8938fae85810de6aad1ecf6e2db663e26/cov.py" > cov.py# Copy your private key to your workig directorycp /etc/letsecrypt/accouts/acme-v01.api.letsecrypt.org/directory/<id>/private_key.jso private_key.jso# Create a DER ecoded private keyopessl as1parse -oout -out private_key.der -gecof <(pytho cov.py private_key.jso)# Covert to PEMopessl rsa -i private_key.der -iform der > accout.key创建证书签名请求(CSR)的域名
#geerate a domai private key (if you have't already)opessl gersa 4096 > domai.key#for a sigle domaiopessl req -ew -sha256 -key domai.key -subj "/CN=yoursite.com" > domai.csr#for multiple domais (use this oe if you wat both www.yoursite.com ad yoursite.com)opessl req -ew -sha256 -key domai.key -subj "/" -reqexts SAN -cofig <(cat /etc/ssl/opessl.cf <(pritf "[关联到网站主机
#example for gixserver { liste 80; server_ame yoursite.com www.yoursite.com; locatio /.well-kow/acme-challege/ { alias /var/www/challeges/; try_files $uri =404; } ...the rest of your cofig}获取签名证书
#ru the script o your serverpytho acme_tiy.py --accout-key ./accout.key --csr ./domai.csr --acme-dir /var/www/challeges/ > ./siged.crt安装证书
server { liste 443; server_ame yoursite.com, www.yoursite.com; ssl o; ssl_certificate /path/to/chaied.pem; ssl_certificate_key /path/to/domai.key; ssl_sessio_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA; ssl_sessio_cache shared:SSL:50m; ssl_dhparam /path/to/server.dhparam; ssl_prefer_server_ciphers o; ...the rest of your cofig}server { liste 80; server_ame yoursite.com, www.yoursite.com; locatio /.well-kow/acme-challege/ { alias /var/www/challeges/; try_files $uri =404; } ...the rest of your cofig}设置自动更新
#!/usr/bi/shpytho /path/to/acme_tiy.py --accout-key /path/to/accout.key --csr /path/to/domai.csr --acme-dir /var/www/challeges/ > /tmp/siged.crt || exitwget -O - https://letsecrypt.org/certs/lets-ecrypt-x3-cross-siged.pem > itermediate.pemcat /tmp/siged.crt itermediate.pem > /path/to/chaied.pemservice gix reload
评论