آموزش پیکربندی nginx با Let’s Encrypt در CentOS 8

1git clone https://github.com/Neilpang/acme.sh.git

1vi /etc/nginx/conf.d/your-domain-name.conf

1acme.sh --issue -d your-domain-name --nginx

1vi /etc/nginx/conf.d/your-domain-name.conf

1sudo firewall-cmd --add-service=https

1sudo yum install git bc wget curl socat

1cd /tmp/23git clone https://github.com/Neilpang/acme.sh.git

1cd acme.sh/23sudo -i ## be root user ##45./acme.sh –install

1sudo source ~/.bashrc

1acme.sh --version23https://github.com/Neilpang/acme.sh45v2.8.4

1# vi /etc/nginx/conf.d/c8nginx.cyberciti.biz.conf

1# http port 802server {3    listen      80;4    server_name c8nginx.cyberciti.biz;5    access_log  /var/log/nginx/http_c8nginx.cyberciti.biz_access.log;6    error_log   /var/log/nginx/http_c8nginx.cyberciti.biz_error.log;7    root        /usr/share/nginx/html;8}

1# nginx -t23# systemctl restart nginx.service

1# mkdir -pv /etc/nginx/ssl/cyberciti.biz/23# cd /etc/nginx/ssl/cyberciti.biz/45# openssl dhparam -out dhparams.pem -dsaparam 4096

1sudo acme.sh --issue -d c8nginx.cyberciti.biz -k 2048 --nginx23## for two domains ##45sudo acme.sh --issue -d c8nginx.cyberciti.biz -d www.cyberciti.biz -k 2048 --nginx67## get certs for three domains ##89sudo acme.sh --issue -d cyberciti.biz -d c8nginx.cyberciti.biz -d www.cyberciti.biz -k 2048 --nginx1011## let us get cert for c8nginx.cyberciti.biz domain only ##1213sudo acme.sh --issue -d c8nginx.cyberciti.biz -k 4096 --nginx

1<pre>$ sudo vi /etc/nginx/conf.d/c8nginx.cyberciti.biz.conf

1</pre>23## http port 80: START http://c8nginx.cyberciti.biz/ config ##45server {67listen 80;89listen [::]:80;1011access_log&nbsp; /var/log/nginx/http_c8nginx.cyberciti.biz_access.log;1213error_log&nbsp;&nbsp; /var/log/nginx/http_c8nginx.cyberciti.biz_error.log;1415server_name c8nginx.cyberciti.biz;1617root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/share/nginx/html;1819#2021# redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.2223#2425return 301 https://$host$request_uri;2627}2829## https port 443: START https://c8nginx.cyberciti.biz/ config ##3031server {3233listen 443 ssl http2;3435listen [::]:443 ssl http2;3637server_name c8nginx.cyberciti.biz;3839root /usr/share/nginx/html;4041# certs sent to the client in SERVER HELLO are concatenated in ssl_certificate4243ssl_certificate&nbsp; /etc/nginx/ssl/cyberciti.biz/c8nginx.cyberciti.biz.cer;4445ssl_certificate_key /etc/nginx/ssl/cyberciti.biz/c8nginx.cyberciti.biz.key;4647ssl_session_timeout 1d;4849ssl_session_cache shared:MozSSL:10m;&nbsp; # about 40000 sessions5051ssl_session_tickets off;5253ssl_dhparam /etc/nginx/ssl/cyberciti.biz/dhparams.pem;5455#5657# Supports Firefox 27, Android 4.4.2, Chrome 31, Edge, IE 11 on Windows 7, Java 8u31, OpenSSL 1.0.1, Opera 20, and Safari 9 and above5859#6061ssl_protocols TLSv1.2 TLSv1.3;6263ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;6465ssl_prefer_server_ciphers off;6667# HSTS (ngx_http_headers_module is required) (63072000 seconds)6869add_header Strict-Transport-Security "max-age=63072000" always;7071# OCSP stapling7273ssl_stapling on;7475ssl_stapling_verify on;7677# replace with the IP address of your resolver7879resolver 8.8.8.8;8081## add other config below such as fastcgi or php and so on ##82<pre>}

1# acme.sh --installcert -d c8nginx.cyberciti.biz \23--key-file /etc/nginx/ssl/cyberciti.biz/c8nginx.cyberciti.biz.key \45--fullchain-file /etc/nginx/ssl/cyberciti.biz/c8nginx.cyberciti.biz.cer \67--reloadcmd 'systemctl reload nginx.service'

1# ss -tulpn

1$ sudo firewall-cmd --add-service=https23$ sudo firewall-cmd --runtime-to-permanent

1<pre># acme.sh --list

1Main_Domain            KeyLength  SAN_Domains  Created                       Renew2c8nginx.cyberciti.biz  "4096"     no           Mon Dec 30 16:57:10 UTC 2019  Fri Feb 28 16:57:10 UTC 2020

1# acme.sh --renew -d c8nginx.cyberciti.biz

1# crontab -l

18 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

1# acme.sh --upgrade234<pre>

1# acme.sh --help | more