skip to Main Content
网站安全Https:Centos7+Nginx部署Let’s Encrypt的免费SSL

网站安全Https:Centos7+Nginx部署Let’s Encrypt的免费SSL

Let’ s Encrypt是提供免费SSL/TLS的证书发行机构, 证书有效期为90天, 到期前30内可续期, 可通过Certbot实现自动需求以达到永久免费。

Https的优点:
1、SEO方面:谷歌曾在2014年8月份调整搜索引擎算法,并称“比起同等HTTP网站,采用HTTPS加密的网站在搜索结果中的排名将会更高”。
2、安全性:
(1)使用Https协议可认证用户和服务器,确保数据发送到正确的客户机和服务器;
(2)Https协议是由SSL+HTTP协议构建的可进行加密传输、身份认证的网络协议,要比http协议安全,可防止数据在传输过程中不被窃取、改变,确保数据的完整性;
(3)Https是现行架构下最安全的解决方案,虽然不是绝对安全,但它大幅增加了中间人攻击的成本。

以下是CentOS7 + nginx安装和使用Let’s Encrypt的部署过程。
一、前提条件
1、域名,例如www.waitstore.com (绑定国内云主机需取得ICP备案号);
2、创建A记录,解析到云主机的IP地址。

二、安装nginx服务,以www.waitstore.com举例。

yum install -y nginx
mkdir /opt/www/www.waitstore.com -p
chown nginx:nginx /opt/www/www.waitstore.com/ -R
vi /etc/nginx/conf.d/www.waitstore.com.conf
server {
listen 80;
server_name www.waitstore.com;
charset utf-8;

root /opt/www/www.waitstore.com;
index index.html index.htm;

access_log  /var/log/nginx/www.waitstore.com_access.log;
error_log   /var/log/nginx/www.waitstore.com_error.log;
}
systemctl start nginx

三、安装certbot工具

yum install -y epel-release
yum install -y certbot

四、使用certbot命令初次申请证书

# 使用方法:certbot certonly --webroot -w [Web站点目录] -d [站点域名] -m [联系人email地址] --agree-tos
certbot certonly --webroot -w /opt/www/www.waitstore.com -d www.waitstore.com -m skyoycom@gmail.com --agree-tos

注意:联系人email地址要填写真实有效的,Let’ s Encrypt会在证书在过期以前发送预告的通知邮件。
申请成功后,显示以下Congratulations信息:

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/[xxx.xxx.xxx]/fullchain.pem. Your cert will
   expire on 2017-03-20. To obtain a new or tweaked version of this
   certificate in the future, simply run certbot again. To
   non-interactively renew *all* of your certificates, run "certbot
   renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

证书的保存位置在:

/etc/letsencrypt/live/www.waitstore.com/
用户证书 		                             cert.pem -> ../../archive/www.waitstore.com/cert1.pem
中间证书 		                             chain.pem -> ../../archive/www.waitstore.com/chain1.pem
证书链, chain.pem + cert.pem	fullchain.pem -> ../../archive/www.waitstore.com/fullchain1.pem
证书私钥 		                             privkey.pem -> ../../archive/www.waitstore.com/privkey1.pem

五、查看证书有效期的命令

openssl x509 -noout -dates -in /etc/letsencrypt/live/[www.waitstore.com]/cert.pem

六、设置定时任务自动更新证书

# 更新证书
certbot renew --dry-run

# 如果不需要返回的信息,可以用静默方式
certbot renew --quiet
# 可以使用crontab定时更新,例如:
# 每月1号5时执行执行一次更新,并重启nginx服务器
00 05 01 * * /usr/bin/certbot renew --quiet && /bin/systemctl restart nginx

七、应用实例:配置nginx使用证书开通https站点
1、生成Perfect Forward Security(PFS)键值

mkdir /etc/ssl/private/ -p
cd /etc/ssl/private/
openssl dhparam 2048 -out dhparam.pem

2、配置nginx站点,例如/etc/nginx/conf.d/www.waitstore.com.conf,样例内容如下:

server {
listen 80;
server_name www.waitstore.com;
rewrite ^ https://$server_name$request_uri? permanent;
}
server {
  listen 443 ssl;
  server_name www.waitstore.com;

  charset utf-8;
  root /opt/www/www.waitstore.com;
  index index.html index.htm;

  access_log  /var/log/nginx/www.waitstore.com_access.log;
  error_log  /var/log/nginx/www.waitstore.com_error.log;

  # letsencrypt生成的文件
  ssl_certificate /etc/letsencrypt/live/www.waitstore.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/www.waitstore.com/privkey.pem;

  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_session_tickets on;

  ssl_dhparam /etc/ssl/private/dhparam.pem;

  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  # 推荐使用的ssl_ciphers值: https://wiki.mozilla.org/Security/Server_Side_TLS
  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
  ssl_prefer_server_ciphers on;
}

3、浏览器打开https://www.waitstore.com, 若正常跳转到https://www.waitstore.com,则配置成功。 如果是Chrome浏览器,地址栏有绿色安全小锁,点击小锁的图标可查看证书的详情。

Back To Top