通过acme对nginx配置SSL证书

Posted on In

docker中启动neilpang/acme.sh

1
docker run --rm -itd -v "$(pwd)/out":/acme.sh --net=host --name=[acme.sh](http://acme.sh/) neilpang/acme.sh daemon

注册

1
docker exec [acme.sh](http://acme.sh/) --register-account -m [zhangqian9111@gmail.com](mailto:zhangqian9111@gmail.com)

生成证书

1
docker exec [acme.sh](http://acme.sh/) --issue -d xx.merric.top --standalone

生成的证书在$(pwd)/out目录下

将证书配置到nginx配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
server{
        listen 80;
        server_name xx.merric.top;
        rewrite ^(.*) https://$server_name$1 permanent;
    }  
       
    server{
        listen 443 ssl;   
        server_name xx.merric.top; 
        root html;
        index index.html index.htm;
        ssl_certificate /app/acme.sh/out/xx.merric.top_ecc/fullchain.cer;  
        ssl_certificate_key /app/acme.sh/out/xx.merric.top_ecc/xx.merric.top.key; 
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        location / {
            proxy_pass http://localhost:8001;
            proxy_set_header HOST $host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }

启动nginx