nginx使用let’s encrypt https证书并启用http2的使用记录

let’s encrypt 使用记录

安装certbot说明

certbot官网上的文档关于centos6和7的部分在本次安装过程中发现一个python问题，在centos6下python安装的2.6，centbot使用2.6的python运行不成功；centos7下自带python是2.7，如果未安装pip，则需要手动安装，pip安装后，6和7上的certbot才能正常运行 下载python

wget -c

安装python2.7

cd Python-2.7.12/
./configure --prefix=/usr/local
make
make altinstall

安装pip

wget -c 
python2.7 get-pip.py

安装certbot

wget 
chmod a+x certbot-auto

运行获取证书

./certbot-auto certonly --standalone -d devservice.crazypandacam.com -d devadmin.crazypandacam.com -d devweb.crazypandacam.com
IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/devservice.crazypandacam.com/fullchain.pem.
   Your cert will expire on 2017-01-07. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you lose your account credentials, you can recover through
   e-mails sent to [e-mail].
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   
   Donating to EFF:                    

You have mail in /var/spool/mail/root


./certbot-auto certonly --standalone -d testservice.crazypandacam.com -d testadmin.crazypandacam.com -d testweb.crazypandacam.com

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/testservice.crazypandacam.com/fullchain.pem.
   Your cert will expire on 2017-01-07. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   
   Donating to EFF:                    

升级nginx开始http2 支持

建立如下文件： vi /etc/yum.repos.d/nginx.repo

[nginx]
name=nginx repo
baseurl=
gpgcheck=0
enabled=1

执行

yum update nginx

具体配置文件参考 

具体配置示例：pixcar的实际配置

因为pixcar需要 同时支持http和https及http2，所以具体配置和mozilla的最佳实践有改动

 server_name        pixcargoluk.com;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
    ssl_prefer_server_ciphers on;
    add_header Strict-Transport-Security max-age=15768000;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_certificate    /etc/letsencrypt/live/service.crazypandacam.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/service.crazypandacam.com/privkey.pem;

自动renewal证书

crontab 增加一行

# Automating renewal Let's Encrypt certificates
0 0 * * * /usr/local/bin/certbot-auto renew --quiet

后来运行验证发现，原web服务要停掉才能用此命令更新，修改为如下

# Automating renewal Let's Encrypt certificates
0 0 * * * /usr/local/bin/certbot-auto renew --pre-hook "service nginx stop" --post-hook "service nginx start"

以上是centos6及以前，如果是centos7的话，换成如下

0 0 * * * /usr/local/bin/certbot-auto renew --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx"