利用Certbot全自动安装Let's Encrypt安全证书，实现全站加密

Certbot使用的官方文档，可以选择系统，切换对应的使用方法，我选择的是Ubuntu16.04+Nginx

1、安装Cerbot

$ sudo apt-get update
$ sudo apt-get install software-properties-common
$ sudo add-apt-repository ppa:certbot/certbot
$ sudo apt-get update
$ sudo apt-get install python-certbot-nginx 

安装过程中，若出现 W: GPG error: http://ppa.launchpad.net/ondrej/php/ubuntu xenial InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 4F4EA0AAE5267A6C 错误，可使用 sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 4F4EA0AAE5267A6C 解决，注意后面的key要替换为提示错误中的PUBKEY

补充下Centos下安装方法：

yum install certbot
# 安装完可能会遇到下面两个错误，对应解决即可
# ImportError: cannot import name UnrewindableBodyError 解决这个问题
pip install --upgrade urllib3 utils
# ImportError: 'pyOpenSSL' module missing required functionality解决这个问题
pip install --upgrade --force-reinstall 'requests==2.6.0'

# 安装nginx插件
pip install certbot-nginx

2、申请证书

sudo certbot --nginx --nginx-server-root /etc/nginx/ -d xxx.j2do.com

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): [e-mail]
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org

-------------------------------------------------------------------------------
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v01.api.letsencrypt.org/directory
-------------------------------------------------------------------------------
(A)gree/(C)ancel: A

-------------------------------------------------------------------------------
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about EFF and
our work to encrypt the web, protect its users and defend digital rights.
-------------------------------------------------------------------------------
(Y)es/(N)o: N
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for ddy.j2do.com
nginx: [warn] conflicting server name "" on 0.0.0.0:80, ignored
nginx: [warn] conflicting server name "" on [::]:80, ignored
Waiting for verification...
Cleaning up challenges
nginx: [warn] conflicting server name "" on 0.0.0.0:80, ignored
nginx: [warn] conflicting server name "" on [::]:80, ignored
Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/ddy
nginx: [warn] conflicting server name "" on 0.0.0.0:80, ignored
nginx: [warn] conflicting server name "" on [::]:80, ignored

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 1

-------------------------------------------------------------------------------
Congratulations! You have successfully enabled https://ddy.j2do.com

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=ddy.j2do.com
-------------------------------------------------------------------------------

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/xxx.j2do.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/xxx.j2do.com/privkey.pem
   Your cert will expire on 2018-09-16. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

第一项必须是选择同意（A)，第二项无所谓，是将记得邮件地址添加到EFF邮件列表中，发送一些邮件给你，可以选择否（N)，这时候证书会自动生成，并根据你的域名，去查找nginx配置，自动修改nginx配置支持https，最后询问你，是否要将http的请求全部重置到https上，配置完成后告诉你一些信息，证书存放在/etc/letsencrypt位置

3、重启nignx即可

sudo service nginx restart

4、Let's Encrypt推荐使用ACME v2证书，此证书支持通配符，使证书更容易管理，稍后补充申请方法

5、自动定时申请更新证书

无论如何要记得更新证书这个事情还是很麻烦，那么certbot提供了一个自动为所有证书重新申请的命令，而且它是智能的，只申请七天内到期的证书

#设置crontab命令
0 2 * * * certbot renew