certbot配置https

(Updated: )
talk

说在前面

首先声明一下，这并不是水文，起因是今天下午突然想起来，dice2024的时候有一道题因为自己的域名不够短，而没能攻击成功，想来就气，于是去阿里云淘到了一个非常不错的域名，rb3.top十年188，简直拉满了，我也是用了一个小时才找到的，想用来专门给一台服务器当做测试的攻击机，但是https这是不能少的，不然后面就会很麻烦

不过经历了几次手动配置，虽然觉得非常的熟练的写出了conf文件，正打算去阿里云申请一个一年的免费证书，什么?!你要我68？诶然后就去问了问，突然想起之前Pazuris师傅的博客过期，我去催他上https的事情，于是去问问他，有没有什么绕过的方法， 他给我安利了一个好工具certbot

certbot配置https

这里的操作非常之简单，干就完事了，官方操作文档

首先安装一下snapd

1
2
3
4
5
6
sudo apt update
sudo apt install snapd
sudo systemctl start snapd
sudo systemctl enable snapd

snap version

如果有回显版本，那就是安装并且启动成功了，接着我们就可以使用这个包来安装

certbot，我这里使用的是debian，所以需要去运行sudo apt-get remove certbot，即使可能之前自己没有安装过这个工具，但是还是运行一下为妙

安装

1
2
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

我们是使用的nginx，

1
sudo certbot --nginx

直接一键部署，中途会问几个问题，但是都无关紧要，类似于

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
root@dkhkdZNfqWuIjxnYiAla:/var/www/html# sudo certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
 (Enter 'c' to cancel): 2xxxxxxxxxxxxxxxxx5@qq.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Account registered.
Please enter the domain name(s) you would like on your certificate (comma and/or
space separated) (Enter 'c' to cancel): rb3.top
Requesting a certificate for rb3.top

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/rb3.top/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/rb3.top/privkey.pem
This certificate expires on 2025-07-15.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for rb3.top to /etc/nginx/sites-enabled/default
Congratulations! You have successfully enabled HTTPS on https://rb3.top

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

我们就部署成功啦，现在去访问一下，发现确实是https，再写个定时任务来设置检查，这里设置一个月的，反正不影响

1
2
3
4
sudo crontab -e

# 写入
0 0 */30 * * /usr/bin/certbot renew --dry-run --quiet

保存退出之后查看是否生效

1
sudo crontab -l

发现确实有这个了，避免因为权限问题不能运行成功，自己手动运行sudo certbot renew --dry-run，发现也成功了，这样就OK了啊

小结

特别好用的工具，谢谢Pazuris师傅的推荐😄