letsencrypt在nginx下的配置

因为是在segmentfault网站上看到letsencrypt有提供免费的ssl证书，因为决定在CentOS上安装试用一下。

安装过程很简单，按照教程一步步来就能搞定：

$ git clone https://github.com/certbot/certbot
$ cd certbot
$ ./certbot-auto --help

但是教程的下一步就有问题了，安装完之后的目录下并没有certbot这个可执行文件，而只有certbot-auto，但其实它们两个是一回事，直接用就可以。

当我执行./certbot-auto时，出现了以下错误：

Error:  Multilib version problems found. This often means that the root
       cause is something else and multilib version checking is just
       pointing out that there is a problem. Eg.:

         1. You have an upgrade for openssl which is missing some
            dependency that another package requires. Yum is trying to
            solve this by installing an older version of openssl of the
            different architecture. If you exclude the bad architecture
            yum will tell you what the root cause is (which package
            requires what). You can try redoing the upgrade with
            --exclude openssl.otherarch ... this should give you an error
            message showing the root cause of the problem.

         2. You have multiple architectures of openssl installed, but
            yum can only see an upgrade for one of those arcitectures.
            If you don't want/need both architectures anymore then you
            can remove the one with the missing update and everything
            will work.

         3. You have duplicate versions of openssl installed already.
            You can use "yum check" to get yum show these errors.

感觉上好像是openssl版本不匹配，于是执行

yum update openssl

然后再次执行./certbot-auto，这次就没问题了。

先退出界面，然后执行

./certbot-auto --help

这次发现多了一些内容。然后执行：

./certbot-auto certonly --standalone -d www.myserver.com

因为是standalone，它试图在80端口上启动一个服务器，但是因为80端口已经被nginx占用，所以执行不成功，需要暂时停用一下nginx。因为我不想中断服务，所以我手动把nginx停用，把以前备用的一个apache启动起来，占住80端口以提供服务。这样我就不再需要standalone参数，而可以使用apache参数了，如下：

./certbot-auto certonly --apache -d www.myserver.com

但又出现了错误，它在443的虚拟主机上找不到我的服务器，原来我只在80端口上配置了虚拟主机，于是在Apache的conf文件上胡乱配上一个虚拟主机，以便使用443端口。但还是连接不通。报如下错误：

 - The following errors were reported by the server:

   Domain: www.myserver.com
   Type:   connection
   Detail: Failed to connect to host for DVSNI challenge

仔细一想，原来是我在防火墙上把443端口禁用了，打开443端口后，终于成功！

 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/www.myserver.com/fullchain.pem. Your
   cert will expire on 2016-08-15. To obtain a new version of the
   certificate in the future, simply run Certbot again.

接下来，你会在上述目录下看到4个文件：
cert.pem@ chain.pem@ fullchain.pem@ privkey.pem@

这4个文件里，我们在nginx配置中只会用到后2个，因为fullchain.pem就相当于cert.pem+chain.pem。

nginx的配置如下：

server {
    listen       443;
    server_name  www.myserver.com;
    root   /var/www/html;

    ssl                  on;
    ssl_certificate      /etc/letsencrypt/live/www.myserver.com/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/www.myserver.com/privkey.pem;

    location / {
        index  index.php index.html index.htm;
    }

    location ~ /\. {
        return 403;
    }

    location ~ \.php$ {
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }
}

最后还要记得配置80端口，这样它才会强行把所有指向80端口的http链接转变为https请求：

server {
    listen      80;
    server_name www.myserver.com;
    return 301 https://www.myserver.com$request_uri;
}

到止为止，重启nginx，终于可以在浏览器端看见那个漂亮的绿色小锁头了！

---

2016年6月9日补充：

其实在nginx下配置letsencrypt远没有那么麻烦，首先需要在ini文件中的server块中添加如下设置：

location ~ /.well-known {
    allow all;
}

主要目的是因为letsencrypt在验证时需要往这个文件夹下写文件验证，但其实你自己不必创建这个文件夹。

然后你再执行如下语句：

./letsencrypt-auto certonly -a webroot --webroot-path=/var/www/html -d www.example.com

其余步骤同上。

---

更便捷的方法，请参考https://segmentfault.com/a/11...