{"id":352,"date":"2017-06-21T14:22:19","date_gmt":"2017-06-21T06:22:19","guid":{"rendered":"http:\/\/www.isway.cn\/?p=352"},"modified":"2019-01-19T18:50:30","modified_gmt":"2019-01-19T10:50:30","slug":"%e4%bd%bf%e7%94%a8nginx%e5%8f%8d%e5%90%91%e4%bb%a3%e7%90%86-google-wikipedia%ef%bc%88%e6%95%b4%e7%90%86%ef%bc%89","status":"publish","type":"post","link":"https:\/\/www.isway.cn\/?p=352","title":{"rendered":"\u4f7f\u7528Nginx\u53cd\u5411\u4ee3\u7406 Google & Wikipedia\uff08\u6574\u7406\uff09"},"content":{"rendered":"

\u672c\u6587\u53c2\u8003\u81ea\uff1a<\/p>\n

https:\/\/techcat.me\/archives\/300\nhttps:\/\/linuxstory.org\/deploy-lets-encrypt-ssl-certificate-with-certbot\/<\/pre>\n
\u76ee\u6807\uff1a\u5728\u540c\u4e00\u53f0VPS\u90e8\u7f72Google&Wikipedia
\n\u73af\u5883\uff1aUbuntu 16.04\uff0814.04\u4ea6\u53ef\uff09
\n\u9700\u8981\uff1aVPS\u4e00\u53f0\uff08\u6211\u7528\u7684\u642c\u74e6\u5de5\uff09\u3001\u57df\u540d
\n\u51c6\u5907\uff1a
\nGoogle\u53cd\u4ee3\u7684\u57df\u540d(ex:g.www.isway.cn)
\nWiki\u53cd\u4ee3\u7684\u4e09\u4e2a\u57df\u540d(ex:wiki.www.isway.cn,m.wiki.www.isway.cn,up.wiki.www.isway.cn)
\n\u6dfb\u52a0\u4ee5\u4e0a4\u4e2a\u57df\u540d\u7684DNS\u89e3\u6790\u5230VPS\u670d\u52a1\u5668
\nSSH\u5de5\u5177<\/p>\n

\n\u4e00\u3001\u5148\u89e3\u51b3SSL\u8bc1\u4e66
\n1\u3001Let\u2019s Encrypt\u63d0\u4f9b\u4e86\u4e00\u4e2a\u5f88\u597d\u7684\u514d\u8d39\u8bc1\u4e66\uff0c\u6211\u4eec\u7528\u5b98\u65b9\u7684Certbot\u5de5\u5177\u6765\u81ea\u52a8\u90e8\u7f72<\/p>\n
wget https:\/\/dl.eff.org\/certbot-auto\nchmod a+x .\/certbot-auto<\/pre>\n
2\u3001\u76f4\u63a5\u5b89\u88c5\u5b83\uff0c\u8fc7\u7a0b\u4e2d\u4f1a\u8981\u6c42\u4e0b\u8f7d\u5f88\u591a\u7ec4\u4ef6\u3002\u7531\u4e8e\u670d\u52a1\u5668\u6ca1\u6709Web\u670d\u52a1\uff0c\u5b89\u88c5\u5b8c\u6210\u540e\u4f1a\u6709\u7ea2\u5b57\u63d0\u793a\uff0c\u4e0d\u7528\u7ba1\u3002<\/p>\n
.\/certbot-auto<\/pre>\n
3\u3001\u786e\u8ba4DNS\u89e3\u6790\u751f\u6548\u540e\uff0c\u5f00\u59cb\u7533\u8bf7\u8bc1\u4e66<\/p>\n
.\/certbot-auto certonly<\/pre>\n
4\u3001\u63d0\u793a\u4f7f\u7528\u4f55\u79cd\u65b9\u5f0f\u9a8c\u8bc1\u57df\u540d\u6240\u6709\u6743\uff0c\u9009\u62e9\u7b2c\u4e00\u4e2astandalone\u65b9\u5f0f\uff0ccertbot \u4f1a\u81ea\u5df1\u8fd0\u884c\u4e00\u4e2a web server \u6765\u8fdb\u884c\u9a8c\u8bc1\u3002<\/p>\n
How would you like to authenticate with the ACME CA?\n-------------------------------------------------------------------------------\n1: Spin up a temporary webserver (standalone)\n2: Place files in webroot directory (webroot)\n-------------------------------------------------------------------------------\nSelect the appropriate number [1-2] then [enter] (press 'c' to cancel): 1<\/pre>\n
5\u3001\u7b2c\u4e00\u6b21\u4f1a\u8981\u6c42\u4f60\u8f93\u5165\u7535\u5b50\u90ae\u4ef6\u3002<\/p>\n
Enter email address (used for urgent renewal and security notices) (Enter 'c' to\ncancel):xxx@gmail.com\n\u540c\u610f\u76f8\u5e94\u6761\u6b3e\u3002\nPlease read the Terms of Service at\nhttps:\/\/letsencrypt.org\/documents\/LE-SA-v1.1.1-August-1-2016.pdf. You must agree\nin order to register with the ACME server at\nhttps:\/\/acme-v01.api.letsencrypt.org\/directory\n-------------------------------------------------------------------------------\n(A)gree\/(C)ancel: a\n\u662f\u5426\u5141\u8bb8\u7ed9\u4f60\u90ae\u7bb1\u53d1\u9001\u90ae\u4ef6\uff0c\u6211\u9009\u62e9\u62d2\u7edd\u3002\nWould you be willing to share your email address with the Electronic Frontier\nFoundation, a founding partner of the Let's Encrypt project and the non-profit\norganization that develops Certbot? We'd like to send you email about EFF and\nour work to encrypt the web, protect its users and defend digital rights.\n-------------------------------------------------------------------------------\n(Y)es\/(N)o: n<\/pre>\n
6\u3001\u8f93\u5165\u8981\u7533\u8bf7SSL\u7684\u57df\u540d\uff08\u4e5f\u5c31\u662f\u4e0a\u97624\u4e2a\uff0c\u4e00\u4e2a\u4e00\u4e2a\u6765\uff09<\/p>\n
Please enter in your domain name(s) (comma and\/or space separated) (Enter 'c'\nto cancel):g.www.isway.cn\n\u63d0\u793a\u7533\u8bf7\u6210\u529f\nObtaining a new certificate\nPerforming the following challenges:\ntls-sni-01 challenge for g.www.isway.cn\nWaiting for verification...\nCleaning up challenges\nIMPORTANT NOTES:\n- Congratulations! Your certificate and chain have been saved at\n\/etc\/letsencrypt\/live\/g.www.isway.cn\/fullchain.pem. Your cert will\nexpire on 2017-09-19. To obtain a new or tweaked version of this\ncertificate in the future, simply run certbot-auto again. To\nnon-interactively renew *all* of your certificates, run\n\"certbot-auto renew\"\n- Your account credentials have been saved in your Certbot\nconfiguration directory at \/etc\/letsencrypt. You should make a\nsecure backup of this folder now. This configuration directory will\nalso contain certificates and private keys obtained by Certbot so\nmaking regular backups of this folder is ideal.\n- If you like Certbot, please consider supporting our work by:\nDonating to ISRG \/ Let's Encrypt: https:\/\/letsencrypt.org\/donate\nDonating to EFF: https:\/\/eff.org\/donate-le<\/pre>\n
7\u3001\u53c2\u7167\u4e0a\u9762\u7684\u65b9\u5f0f\uff0c\u53cd\u590d\u8fd0\u884c\u7b2c\u4e09\u6b65\uff0c\u76f4\u5230\u5c064\u4e2a\u57df\u540d\u7684SSL\u90fd\u7533\u8bf7\u4e0b\u6765
\n8\u3001\u68c0\u67e5\u7533\u8bf7\u7684SSL\u8bc1\u4e66\uff0c\u770b\u52304\u4e2a\u57df\u540d\u7684\u6587\u4ef6\u5939\uff0c\u5c31\u8bc1\u660e\u6210\u529f\u4e86<\/p>\n
ls \/etc\/letsencrypt\/live\/\nroot@fuhm:~# ls \/etc\/letsencrypt\/live\/\ng.www.isway.cn m.wiki.www.isway.cn up.wiki.www.isway.cn wiki.www.isway.cn\nroot@fuhm:~# ls \/etc\/letsencrypt\/live\/g.www.isway.cn\/\nREADME cert.pem chain.pem fullchain.pem privkey.pem<\/pre>\n
9\u3001SSL\u624b\u52a8\u66f4\u65b0\uff08\u81ea\u52a8\u66f4\u65b0\u8fd8\u5728\u6d4b\u8bd5\uff09<\/p>\n
root@fuhm:~# service nginx stop\nroot@fuhm:~# .\/certbot-auto renew\nroot@fuhm:~# service nginx start<\/pre>\n
\u4e8c\u3001\u914d\u7f6eGoogle\u53cd\u5411\u4ee3\u7406
\n\u53c2\u8003https:\/\/www.isway.cn\/?p=321
\n1\u3001\u53bb\u6389\u7b2c\u56db\u90e8\u5206\u7684\u7b2c1-3\u6b65\u9aa4
\n2\u3001\u7b2c\u56db\u90e8\u5206\u7b2c4\u6b65\u7684google.conf\u6587\u4ef6\u4e2d\u7684<\/p>\n
ssl_certificate \/root\/ssl\/example.com.crt;\nssl_certificate_key \/root\/ssl\/example.com.key;<\/pre>\n
\u4fee\u6539\u4e3a\uff08\u81ea\u884c\u66ff\u6362\u57df\u540d\uff09<\/p>\n
ssl_certificate \/etc\/letsencrypt\/live\/g.www.isway.cn\/fullchain.pem;\nssl_certificate_key \/etc\/letsencrypt\/live\/g.www.isway.cn\/privkey.pem;<\/pre>\n
3\u3001\u68c0\u67e5 Nginx \u914d\u7f6e\uff0c\u76f4\u63a5\u8fd0\u884c nginx -t \u5982\u679c\u8f93\u51fa\u5982\u4e0b\u63d0\u793a\uff0c\u5219\u4e00\u5207\u6b63\u5e38<\/p>\n
nginx: the configuration file \/etc\/nginx\/nginx.conf syntax is ok\nnginx: configuration file \/etc\/nginx\/nginx.conf test is successful<\/pre>\n
4\u3001\u91cd\u542f\u670d\u52a1\uff0c\u5148\u8bd5\u8bd5Google\u53cd\u4ee3\u662f\u5426OK\u4e86<\/p>\n
service nginx restart<\/pre>\n
\u4e09\u3001\u914d\u7f6eWiki\u53cd\u5411\u4ee3\u7406
\n1\u3001\u5728google.conf\u76f8\u540c\u7684\u76ee\u5f55\u4e0b\u65b0\u5efawiki.conf\u6587\u4ef6\uff0c\u5185\u5bb9\u5982\u4e0b\uff08\u81ea\u884c\u66ff\u6362\u57df\u540d\uff09\uff1a<\/p>\n
vi \/etc\/nginx\/sites-enabled\/wiki.conf\nserver {\nserver_name wiki.www.isway.cn;\nlisten 80;\nrewrite ^\/(.*) https:\/\/$server_name\/$1 permanent;\n}\nserver {\nserver_name wiki.www.isway.cn;\nlisten 443 ssl http2;\nssl on;\nssl_certificate \/etc\/letsencrypt\/live\/wiki.www.isway.cn\/fullchain.pem;\nssl_certificate_key \/etc\/letsencrypt\/live\/wiki.www.isway.cn\/privkey.pem;\nlocation \/ {\nproxy_pass https:\/\/zh.wikipedia.org;\nproxy_cookie_domain zh.wikipedia.org wiki.www.isway.cn;\nproxy_redirect https:\/\/zh.wikipedia.org\/ \/;\nproxy_redirect https:\/\/zh.m.wikipedia.org\/ https:\/\/m.wiki.www.isway.cn\/;\nproxy_set_header X-Real_IP $remote_addr;\nproxy_set_header User-Agent $http_user_agent;\nproxy_set_header Accept-Encoding '';\nproxy_set_header referer \"https:\/\/zh.wikipedia.org$request_uri\";\n}\nlocation https:\/\/zh.m.wikipedia.org\/{\nrewrite ^\/(.*) https:\/\/m.wiki.www.isway.cn\/$1 permanent;\n}\n}\nserver {\nserver_name m.wiki.www.isway.cn;\nlisten 80;\nrewrite ^\/(.*) https:\/\/$server_name\/$1 permanent;\n}\nserver {\nserver_name m.wiki.www.isway.cn;\nlisten 443 ssl http2;\nssl on;\nssl_certificate \/etc\/letsencrypt\/live\/m.wiki.www.isway.cn\/fullchain.pem;\nssl_certificate_key \/etc\/letsencrypt\/live\/m.wiki.www.isway.cn\/privkey.pem;\nlocation \/ {\nproxy_pass https:\/\/zh.m.wikipedia.org;\nproxy_redirect https:\/\/zh.m.wikipedia.org\/ \/;\nproxy_cookie_domain zh.m.wikipedia.org m.wiki.www.isway.cn;\nproxy_set_header X-Real_IP $remote_addr;\nproxy_set_header User-Agent $http_user_agent;\nproxy_set_header Accept-Encoding '';\nproxy_set_header referer \"https:\/\/zh.m.wikipedia.org$request_uri\";\n}\n}\nserver {\nserver_name up.wiki.www.isway.cn;\nlisten 80;\nrewrite ^\/(.*) https:\/\/$server_name\/$1 permanent;\n}\nserver {\nserver_name up.wiki.www.isway.cn;\nlisten 443 ssl http2;\nssl on;\nssl_certificate \/etc\/letsencrypt\/live\/up.wiki.www.isway.cn\/fullchain.pem;\nssl_certificate_key \/etc\/letsencrypt\/live\/up.wiki.www.isway.cn\/privkey.pem;\nlocation \/ {\nproxy_pass https:\/\/upload.wikimedia.org;\nproxy_cookie_domain upload.wikimedia.org up.wiki.www.isway.cn;\nproxy_set_header X-Real_IP $remote_addr;\nproxy_set_header User-Agent $http_user_agent;\nproxy_set_header referer \"https:\/\/upload.wikimedia.org$request_uri\";\n}\n}<\/pre>\n
2\u3001\u68c0\u67e5\u4f7f\u7528nginx -t\u68c0\u67e5Nginx \u914d\u7f6e\uff0c\u6ca1\u6709\u62a5\u9519\u5c31\u91cd\u542fnginx\u670d\u52a1\uff0c\u7136\u540e\u8bbf\u95ee\u662f\u5426OK<\/p>\n
service nginx restart<\/pre>\n
\u3010\u5b8c\u3011<\/p>\n","protected":false},"excerpt":{"rendered":"
\u672c\u6587\u53c2\u8003\u81ea\uff1a https:\/\/techcat.me\/archives\/300 https:\/\/linuxsto… <\/p>\n
\u9605\u8bfb\u66f4\u591a<\/i><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-352","post","type-post","status-publish","format-standard","hentry","category-tech"],"_links":{"self":[{"href":"https:\/\/www.isway.cn\/index.php?rest_route=\/wp\/v2\/posts\/352","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.isway.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.isway.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.isway.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.isway.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=352"}],"version-history":[{"count":3,"href":"https:\/\/www.isway.cn\/index.php?rest_route=\/wp\/v2\/posts\/352\/revisions"}],"predecessor-version":[{"id":388,"href":"https:\/\/www.isway.cn\/index.php?rest_route=\/wp\/v2\/posts\/352\/revisions\/388"}],"wp:attachment":[{"href":"https:\/\/www.isway.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.isway.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.isway.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}