一、系统环境
1、系统：Ubuntu 16.04.2 LTS
2、WEB服务器：Openresty11.2.5
二、开始配置
1、获取certbot客户端
wget https://dl.eff.org/certbot-autochmod a+x certbot-auto
2、停止Nginx服务
sudo systemctl stop nginx.service
3、生成证书
./certbot-auto certonly --standalone --email `你的邮箱地址` -d `你的域名地址`
当前网站有多个域名时需在后面增加，例如：
./certbot-auto certonly --standalone --email `你的邮箱地址` -d `你的域名1` -d `你的域名2`
4、查看生产的证书
tree /etc/letsencrypt/live/
www@TinywanAliYun:~$ sudo tree /etc/letsencrypt/live//etc/letsencrypt/live/└── www.tinywan.top ???├── cert.pem -> ../../archive/www.tinywan.top/cert1.pem ???├── chain.pem -> ../../archive/www.tinywan.top/chain1.pem ???├── fullchain.pem -> ../../archive/www.tinywan.top/fullchain1.pem ???├── privkey.pem -> ../../archive/www.tinywan.top/privkey1.pem ???└── README1 directory, 5 files
5、编辑Nginx配置文件和开启SSL服务
sudo vim /usr/local/openresty/nginx/conf/nginx.conf
配置虚拟主机
...
# 配置HTTP请求重定向 ???server { ???????listen ??????80; ???????server_name ?www.tinywan.top; ???????rewrite ^ https://$http_host$request_uri? permanent; ???# force redirect http to https ???}
???# ?配置SSL证书 ???server { ???????listen ??????443 ssl;
server_name ?www.tinywan.top;
???????ssl_certificate /etc/letsencrypt/live/www.tinywan.top/fullchain.pem;
???????ssl_certificate_key /etc/letsencrypt/live/www.tinywan.top//privkey.pem;
#禁止在header中出现服务器版本，防止黑客利用版本漏洞攻击
server_tokens off;
???????set $root_path /home/www/web/golang; ???????root $root_path; ???????location / { ???????????if (!-e $request_filename) { ???????????????rewrite ?^(.*)$ ?/index.php?s=/$1 ?last; ???????????????break; ???????????} ???????}}...
6、重启Nginx服务
sudo systemctl restart nginx.service
7、Let’s Encrypt 生成的免费证书为3个月时间，使用Crontab可以无限次续签证书
# 每星期1的2点30分执行更新操作 30 2 * * 1 /home/www/bin/certbot-auto renew ?>>/home/www/bin/logs/encrypt_auto_update.log ?2>&1
Nginx 学习笔记（一）个人网站的Https配置
原文地址：http://www.cnblogs.com/tinywan/p/7542629.html