2018年3月13日，Let’s Encrypt终于上线了在1月就应该上线的泛域名证书，这个证书类型为泛域名提供了可用的HTTPS方案。
获取泛域名证书
安装Certbot
从官方源安装最新版certbot（最新版为0.22.0，从0.22.0版本才开始支持泛域名申请，不推荐从Debian源安装，常年不更新，还停留在0.10）
|
1 2 |
wget https://dl.eff.org/certbot-auto chmod a+x ./certbot-auto |
初始化
|
1 |
./certbot-auto |
获取证书
泛域名目前只支持以DNS方式验证域名所有权
因为目前大多数国内的DNS服务商不在API支持的列表里，所以以下使用手动方式进行DNS认证，只要将下方命令中的 *.minirplus.com 替换为自己的域名即可
|
1 |
./certbot-auto certonly --manual -d *.minirplus.com --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory |
注意！域名的 minirplus.com 解析记录必须以A记录方式指向当前运行命令的服务器IP，而不能使用CNAME记录。否则会报错，报错信息如下：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
IMPORTANT NOTES: - The following errors were reported by the server: Domain: minirplus.com Type: connection Detail: DNS problem: SERVFAIL looking up TXT for _acme-challenge.minirplus.com To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address. Additionally, please check that your computer has a publicly routable IP address and that no firewalls are preventing the server from communicating with the client. If you're using the webroot plugin, you should also verify that you are serving files from the webroot path you provided. |
运行该命令后，会要求输入邮箱，用于接收证书过期通知
|
1 2 |
Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): |
接着会出现一段广告，大意是收集客户邮箱给赞助商，Y或N均可
|
1 2 3 4 5 6 7 |
------------------------------------------------------------------------------- Would you be willing to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about EFF and our work to encrypt the web, protect its users and defend digital rights. ------------------------------------------------------------------------------- (Y)es/(N)o: |
接着重要的部分来了，在DNS记录中添加一个 _acme-challenge 前缀的域名TXT记录，记录的内容为中间显示的随机码
|
1 2 3 4 5 6 7 8 9 |
------------------------------------------------------------------------------- Please deploy a DNS TXT record under the name _acme-challenge.minirplus.com with the following value: xVloe7V1kMEd2ZlOLlUxv-HltYfTDaMhrrwKjFU47DU Before continuing, verify the record is deployed. ------------------------------------------------------------------------------- Press Enter to Continue |
接着确保当前域名的根记录 minirplus.com 为A记录并且指向当前服务器IP（这条原本不成问题，因为国外的服务商的DNS根域名只能添加A记录，但是国内的DNSPOD则更加灵活，可以添加CNAME记录，所以会在认证的时候出现问题）
按回车，进行认证
等待片刻，出现如下信息，说明认证成功
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/minirplus.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/minirplus.com/privkey.pem Your cert will expire on 2018-06-19. To obtain a new or tweaked version of this certificate in the future, simply run certbot-auto again. To non-interactively renew *all* of your certificates, run "certbot-auto renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le |
修改Apache配置文件
进入/etc/apache2/sites-available，修改泛域名配置文件（这里以000-default.conf为例），添加SSL配置，将下面配置中的SSL证书地址，替换为之前成功获取的证书地址（如直接使用以下配置，请修改DocumentRoot和Directory目录为泛域名指向的目录）
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
<VirtualHost *:80> ServerAdmin webmaster@localhost DocumentRoot /var/www/vps ServerSignature Off <Directory /var/www/vps > Options -Indexes </Directory> </VirtualHost> <IfModule mod_ssl.c> <VirtualHost *:443> ServerAdmin webmaster@localhost DocumentRoot /var/www/vps ServerSignature Off <Directory /var/www/vps > Options -Indexes </Directory> SSLEngine on SSLCertificateFile /etc/letsencrypt/live/minirplus.com/fullchain.pem; SSLCertificateKeyFile /etc/letsencrypt/live/minirplus.com/privkey.pem </VirtualHost> </IfModule> |
效果
当用户访问任意域名，例如https://xVloe7V1kMEd2ZlOLlUxv.minirplus.com
都会看到绿色的HTTPS连接标志。
总结
有了泛域名证书之后有几个好处
- 只要申请一次，所有子域名都可以使用，再也不用重复申请证书了。
- 用户随机生成的子域名也可以使用HTTPS访问了。
Know more
作为Let’s Encrypt方案的对比，Godaddy的SSL证书价格为
- 单域名：HK$493.00/年
- 泛域名：HK$1,944.00/年
4 comments