acme使用ZeroSSL申请泛域名

1.安装acme.sh

1
curl  https://get.acme.sh | sh

默认就是zerossl 的server，无需修改！

配置DNS API，各大DNS厂商都会提供各种APIkey！

1
2
3
以cf为例：
SAVED_CF_Key='8155245808e9ee11af'
SAVED_CF_Email='develop@xx.com'

2.ZeroSSL账号

申请ZeroSSL证书之前需要再官网注册账号，地址：https://zerossl.com/，此处注册的地址需要在acme申请域名时注册，才能申请！

例如我的注册账号是：abc@xx.com

3.Freenom

免费的域名，地址：https://www.freenom.com，然后绑定服务器IP

4.注册zerossl账号

1
acme.sh  --register-account  -m abc@xx.com --server zerossl

5.申请泛域名证书

1
acme.sh --issue -d *.vper.ml --dns  --yes-I-know-dns-manual-mode-enough-go-ahead-please

根据输出提示，在freenom中添加txt记录

1
2
name: _acme-challenge.vper.ml
value: FuVDxvkeU_XJFewFoEOKZFOK0sOLhm6U1I3FIYowSIP

查看txt记录

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
dig -t txt _acme-challenge.vper.ml

root@VM-20-5-ubuntu:~# dig -t txt _acme-challenge.vper.ml

; <<>> DiG 9.16.1-Ubuntu <<>> -t txt _acme-challenge.vper.ml
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51007
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;_acme-challenge.vper.ml.	IN	TXT

;; ANSWER SECTION:
_acme-challenge.vper.ml. 599	IN	TXT	"FuVDxvkeU_XJFewFoEOKZFOK0sOLhm6U1I3FIYowSIP"

;; Query time: 3 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Wed Nov 24 19:12:47 CST 2021
;; MSG SIZE  rcvd: 108

当可以查到txt记录时执行一下命令

1
acme.sh --renew -d *.vper.ml --dns  --yes-I-know-dns-manual-mode-enough-go-ahead-please

成功后会输出证书路径

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
root@VM-20-5-ubuntu:~# acme.sh --renew -d *.vper.ml --dns  --yes-I-know-dns-manual-mode-enough-go-ahead-please
[Wed 24 Nov 2021 07:13:19 PM CST] Renew: '*.vper.ml'
[Wed 24 Nov 2021 07:13:22 PM CST] Using CA: https://acme.zerossl.com/v2/DV90
[Wed 24 Nov 2021 07:13:22 PM CST] Single domain='*.vper.ml'
[Wed 24 Nov 2021 07:13:22 PM CST] Getting domain auth token for each domain
[Wed 24 Nov 2021 07:13:22 PM CST] Verifying: *.vper.ml
[Wed 24 Nov 2021 07:13:28 PM CST] Processing, The CA is processing your order, please just wait. (1/30)
[Wed 24 Nov 2021 07:13:32 PM CST] Success
[Wed 24 Nov 2021 07:13:32 PM CST] Verify finished, start to sign.
[Wed 24 Nov 2021 07:13:32 PM CST] Lets finalize the order.
[Wed 24 Nov 2021 07:13:32 PM CST] Le_OrderFinalize='https://acme.zerossl.com/v2/DV90/order/FXESaJlLCoV1u_X_frBtow/finalize'
[Wed 24 Nov 2021 07:13:34 PM CST] Order status is processing, lets sleep and retry.
[Wed 24 Nov 2021 07:13:34 PM CST] Retry after: 15
[Wed 24 Nov 2021 07:13:50 PM CST] Polling order status: https://acme.zerossl.com/v2/DV90/order/FXESaJlLCoV1u_X_frBtow
[Wed 24 Nov 2021 07:13:51 PM CST] Downloading cert.
[Wed 24 Nov 2021 07:13:51 PM CST] Le_LinkCert='https://acme.zerossl.com/v2/DV90/cert/vgcsCe-a5meRSl7QYTdruw'
[Wed 24 Nov 2021 07:13:53 PM CST] Cert success.
-----BEGIN CERTIFICATE-----
MIIGYTCCBEmgAwIBAgIQCqduUD4/9vIkFkxkL/wBszANBgkqhkiG9w0BAQwFADBL
MQswCQYDVQQGEwJBVDEQMA4GA1UEChMHWmVyb1NTTDEqMCgGA1UEAxMhWmVyb1NT
TCBSU0EgRG9tYWluIFNlY3VyZSBTaXRlIENBMB4XDTIxMTEyNDAwMDAwMFoXDTIy
MDIyMjIzNTk1OVowFDESMBAGA1UEAwwJKi52cGVyLm1sMIIBIjANBgkqhkiG9w0B
AQEFAAOCAQ8AMIIBCgKCAQEAxb2tLr0ShgYUd2Sz/gO0OH5ezwrVrI3nkH50+/oX
cqYeAz39PZRfNFnXrxqWNvn+ACesyiWxoSpnKAdB3e0jvX+KxtiecZjAH3rRF+8Y
Uqrwez93hOwLT3r0BvEsB5rplhwr4PTfPbqXRYNWzDVm9xIngQeI9kdSoM4uwlrI
7Ub4RnA7jmhcJz5kLh/gXKFrwfbzPW9nzGB9jEbYfCl/P+4ikYm1tJmRzA6IH4aE
sp/zpMSj3ND92Ys60CrMTF5mGgH/wYtJ7ShLdCEd+yp9KCX6VApYbg7xFqMKlppY
oBiB9FIVvCNNEG0UhmnelOu6dQrz9IGytw1q5n/hQoVElQIDAQABo4ICdjCCAnIw
HwYDVR0jBBgwFoAUyNl4aKLZGWjVPXLeXwo+3LWGhqYwHQYDVR0OBBYEFGLknwic
0Rf+cWJxVwKals0NX2ZNMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0G
A1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBJBgNVHSAEQjBAMDQGCysGAQQB
sjEBAgJOMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAgG
BmeBDAECATCBiAYIKwYBBQUHAQEEfDB6MEsGCCsGAQUFBzAChj9odHRwOi8vemVy
b3NzbC5jcnQuc2VjdGlnby5jb20vWmVyb1NTTFJTQURvbWFpblNlY3VyZVNpdGVD
QS5jcnQwKwYIKwYBBQUHMAGGH2h0dHA6Ly96ZXJvc3NsLm9jc3Auc2VjdGlnby5j
b20wggEFBgorBgEEAdZ5AgQCBIH2BIHzAPEAdgBGpVXrdfqRIDC1oolp9PN9ESxB
dL79SbiFq/L8cP5tRwAAAX1RpqQ2AAAEAwBHMEUCIGswGhPrIoLVRg/+bu/Y6/jB
ZoJMqOoIifDcAMs6UTW6AiEAhFqLNGms/XbcALiv9tFGn4zVi1tTR6+qGk6T0y8y
GDgAdwBByMqx3yJGShDGoToJQodeTjGLGwPr60vHaPCQYpYG9gAAAX1RpqRAAAAE
AwBIMEYCIQDYrkpmNZoY+k932SWJJShHcLdL7wulCR70r69EWxYYmgIhAMa2ojuQ
lge20jqa6eSyajPdXUbjW8rbxu8Mqz5FrUEkMBQGA1UdEQQNMAuCCSoudnBlci5t
bDANBgkqhkiG9w0BAQwFAAOCAgEAOudCgv3OUsDiDYGV1eNT+5pc3c1R+p+XQrYA
C9umvtfDCbx1znj4yeeVEkxu4DZo95zn0iksH5aaM+pzB5JvDUKMLhNpfTPFTd9O
17HvBTbpIPh4y998L9uC+/Z2IEdt0UAFoBHojsZ7BeXNQhMtDooaL6q43jSrgBm+
vdxl9A99c6fC+CgYoEU0W63RHGxEsyt3td1s0eQSxfDAdlpsrYgfMruJsIGzhx9s
qmAGwwEOI2kRKKMKB8+L38/XYnTthA8esJ8GLFU/XnsYJCLrmTOTGtsN9BptACn2
VVxQEU9GRFAD3YOjVoTCr9yrTi/a4jyv8KviKxZg8WEFWOY/wfmznISNUzmjAAYT
fRquGgOvW4kLVuAy41qXIP28hRqHFSqfoXZDgp3vc2cy0klrasdobMWK16ctv7Ok
qZGEE5V1k0viy9cBW3VxuFAr6Wqg1lMJYeP3LVNVbChYDqzpB1EXo5PC7Pf5SwRi
3U4k5f/sznRiHoA80Ki1ytBusEJ6RzTq+cvpVxE0LGD7aGxDSj2Zgo6RvHkJhm3G
BUyr9XwgTg2LKVSDm7fgupdSdmeg1+hPPohxPQa4M/sRZilOEz6upLNhz79DdwZo
fiL97VYGpQec1FYwNGCpSXTdEbNikpEQcOh8VMLb6fL0tT7LPDAWzQhxJSp0XMJ9
SHZ6o4Q=
-----END CERTIFICATE-----
[Wed 24 Nov 2021 07:13:53 PM CST] Your cert is in: /root/.acme.sh/*.vper.ml/*.vper.ml.cer
[Wed 24 Nov 2021 07:13:53 PM CST] Your cert key is in: /root/.acme.sh/*.vper.ml/*.vper.ml.key
[Wed 24 Nov 2021 07:13:53 PM CST] The intermediate CA cert is in: /root/.acme.sh/*.vper.ml/ca.cer
[Wed 24 Nov 2021 07:13:53 PM CST] And the full chain certs is there: /root/.acme.sh/*.vper.ml/fullchain.cer

6.部署域名证书

nginx 1.18

1
2
秘钥：/root/.acme.sh/*.vper.ml/*.vper.ml.key
证书：/root/.acme.sh/*.vper.ml/fullchain.cer

配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# /etc/nginx/conf.d/nps.conf
upstream api {
    server 127.0.0.1:8888;
}

upstream nps {
    server 127.0.0.1:8000;
}

server {
    listen       80;
    server_name  test.vper.ml;

    rewrite ^(.*)$  https://$host$1 permanent;
}

server {
    listen       443 ssl;
    server_name  test.vper.ml;

    root /www/web/test.vper.ml;
    index index.html index.htm;

    ssl_certificate /root/cert/fullchain.cer;
    ssl_certificate_key /root/cert/*.vper.ml.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
    ssl_session_cache shared:SSL:50m;
    ssl_prefer_server_ciphers on;



    location /api/v1/ {
        rewrite ^/(.*) /$1 break;
        proxy_pass http://api;

        #Proxy Settings
        proxy_redirect      off;
        proxy_set_header    Host            $host;
        proxy_set_header    X-Real-IP       $remote_addr;
        proxy_set_header    X-Scheme        $scheme;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
    }


    location /ws/join {
       proxy_pass http://127.0.0.1:9995/ws/join;
       proxy_http_version 1.1;
       proxy_read_timeout 120s;
       proxy_set_header    Host            $host;
       proxy_set_header    X-Real-IP       $remote_addr;
       proxy_set_header    X-Scheme        $scheme;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "upgrade";
   }


    #location / {
    #    try_files $uri $uri/ @router;
    #    index index.html;
    #}

	# nps
    location / {
        proxy_set_header Host  $http_host;
        proxy_pass http://nps;
    }

    location @router {
        rewrite ^.*$ /index.html last;
    }
}

参考

https://www.xiaoz.me/archives/16056

https://www.cnblogs.com/faberbeta/p/12844811.html