1. 前言
本文环境为Ubuntu LTS 16.04，已经安装配置好了Nginx，http可以访问。目标是为该网站启用HTTPS，增强站点安全性。
2. 解决方案
目前获取安全证书的方案有三：
- 购买主流安全厂商签发的安全证书，需要费用；
- 使用自己签发的证书，不需要费用，但浏览器会报警告；
- 使用Let's Encrypt证书机构颁发的免费证书，不需要费用，浏览器不报警，但只有三个月有效期，需要人工续订
本文中将采取第三种方式。
3. 获取证书
Let's Encrypt证书机构颁发的免费证书对任何人都是开放的，所以在获取证书的过程中会验证证书申请人是否对网站有控制权，例如，能否在WWW主机上执行获取证书程序。
另外，网站应保持启动，域名有效，80端口可被外界访问。
具体访问步骤如下：
访问certbot网站（https://certbot.eff.org/）
-
在页面中选择WWW服务器软件类型（例如Nginx）和操作系统（例如Ubuntu 16.04）
2018-08-06-11-48-56.png -
按照页面下方会显示步骤执行
2018-08-06-11-51-18.png -
设置自动化证书续订
2018-08-06-11-52-50.png
查看/etc/cron.d/目录，下面有个certbot脚本，表明该脚本会每天执行，查看脚本内容，发现该脚本每12小时执行一次.0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew
4. 日志记录
本文忽略了安装前提软件的执行过程，同时因为系统中有多个站点，所以还是希望能够获取到证书后自行配置启用HTTPS。以下主要是命令sudo certbot --nginx certonly的日志记录。过程中需要回答一些问题。
```log
osadmin@mytest:~$ sudo certbot --nginx certonly
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): mytest@qq.com
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Starting new HTTPS connection (1): supporters.eff.org
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: mytest.chinanorth.cloudapp.chinacloudapi.cn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for mytest.chinanorth.cloudapp.chinacloudapi.cn
Waiting for verification...
Cleaning up challenges
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/mytest.chinanorth.cloudapp.chinacloudapi.cn/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/mytest.chinanorth.cloudapp.chinacloudapi.cn/privkey.pem
Your cert will expire on 2018-11-04. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
```
根据日志可以看到，证书为/etc/letsencrypt/live/mytest.chinanorth.cloudapp.chinacloudapi.cn/fullchain.pem，
key文件为/etc/letsencrypt/live/mytest.chinanorth.cloudapp.chinacloudapi.cn/privkey.pem，证书过期日期为2018-11-04。自动续订的命令为certbot renew
查看Linux系统还可发现，只有root可以操作/etc/letsencrypt/live目录。
5. 使用证书
5.1 证书更新
编辑Nginx的配置文件，将证书信息更新到配置之中。
listen 443 ssl;
server_name mytest.chinanorth.cloudapp.chinacloudapi.cn;
ssl_certificate /etc/letsencrypt/live/mytest.chinanorth.cloudapp.chinacloudapi.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mytest.chinanorth.cloudapp.chinacloudapi.cn/privkey.pem;
ssl on;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
5.2 重新启动Nginx验证
重新访问站点，如下图所示，表明HTTPS启用成功。
5.3 强制站点HTTPS访问
用户默认访问HTTP站点，为了让用户访问HTTP时自动跳转到HTTPS，需要编辑Nginx的配置文件，如下：
server {
listen 80;
server_name mytest.chinanorth.cloudapp.chinacloudapi.cn;
return 301 https://$host$request_uri;
}
重新启动Nginx验证
6. 结论
使用certbot可以极大程度简化证书的获取过程，而自动化续订更是极大的方便了系统运维人员，并确保站点始终安全运行。
据调查，29%的TLS应用都使用了有效期为90天的证书，所以Let's Encrypt的证书有效期只有90天。有效期为90天和1年对数据加密并无影响，但较短的有效期能够降低证书被盗用的风险，并且有助于推动证书续订自动化。
通过查看证书的详细信息，可以发现免费签发的证书是只验证域名所有权，而不验证所有者和机构的。所以这类证书也叫做DV（Domain Validated）证书。校验所有者的证书叫做OV（Owner Validated）证书。此外，金融类等机构要求超级安全的证书,要求更加严格的身份验证标准，也叫EV（Extend Validated）证书。
