申請 Let's Encrypt 免費 SSL 憑證(Ubuntu + Cloudflare)

  • Ubuntu 18.04.5 LTS
  • 下載 Let's Encrypt certbot 工具
    sudo apt install certbot python3-certbot-dns-cloudflare
  • 建立 /root/lets-encrypt/cloudflare.ini
    sudo mkdir -p /root/lets-encrypt/
    sudo vi /root/lets-encrypt/cloudflare.ini

    使用 Cloudflare 提供的資訊 Exp.

    # Cloudflare API credentials used by Certbot
    dns_cloudflare_email = [email protected]
    dns_cloudflare_api_key = 0123456789abcdef0123456789abcdef01234567
    sudo chmod 600 /root/lets-encrypt/cloudflare.ini
  • 執行 certbot 工具申請憑證 Exp. harbor.ichiayi.com
    sudo certbot certonly \
      --dns-cloudflare \
      --dns-cloudflare-credentials /root/lets-encrypt/cloudflare.ini \
      --dns-cloudflare-propagation-seconds 10 \
      -d harbor.ichiayi.com

    第一次執行會出現輸入 e-mail 與需要同意的一些服務訊息
    執行範例畫面

    sudo certbot certonly   --dns-cloudflare   --dns-cloudflare-credentials /root/lets-encrypt/cloudflare.ini   --dns-cloudflare-propagation-seconds 10   -d harbor.ichiayi.com
    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Plugins selected: Authenticator dns-cloudflare, Installer None
    Enter email address (used for urgent renewal and security notices) (Enter 'c' to
    cancel): [email protected]
    
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Please read the Terms of Service at
    https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
    agree in order to register with the ACME server at
    https://acme-v02.api.letsencrypt.org/directory
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    (A)gree/(C)ancel: A
    
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Would you be willing to share your email address with the Electronic Frontier
    Foundation, a founding partner of the Let's Encrypt project and the non-profit
    organization that develops Certbot? We'd like to send you email about our work
    encrypting the web, EFF news, campaigns, and ways to support digital freedom.
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    (Y)es/(N)o: Y
    Obtaining a new certificate
    Performing the following challenges:
    dns-01 challenge for harbor.ichiayi.com
    Waiting 10 seconds for DNS changes to propagate
    Waiting for verification...
    Cleaning up challenges
    
    IMPORTANT NOTES:
     - Congratulations! Your certificate and chain have been saved at:
       /etc/letsencrypt/live/harbor.ichiayi.com/fullchain.pem
       Your key file has been saved at:
       /etc/letsencrypt/live/harbor.ichiayi.com/privkey.pem
       Your cert will expire on 2021-01-27. To obtain a new or tweaked
       version of this certificate in the future, simply run certbot
       again. To non-interactively renew *all* of your certificates, run
       "certbot renew"
     - Your account credentials have been saved in your Certbot
       configuration directory at /etc/letsencrypt. You should make a
       secure backup of this folder now. This configuration directory will
       also contain certificates and private keys obtained by Certbot so
       making regular backups of this folder is ideal.
     - If you like Certbot, please consider supporting our work by:
    
       Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
       Donating to EFF:                    https://eff.org/donate-le
    
     - We were unable to subscribe you the EFF mailing list because your
       e-mail address appears to be invalid. You can try again later by
       visiting https://act.eff.org.
  • tech/ssl_letsencrypt_ubuntu.txt
  • 上一次變更: 2021/01/16 14:41
  • jonathan