https nginx

인증서 생 성 절차
1. OSS 에 업로드 할 프로필 추가

# ll /root/.ossutilconfig
-rw-rw-r-- 1 root root 149 Feb  1 14:51 /root/.ossutilconfig

2. 인증 에 필요 한 갈고리 스 크 립 트 만 들 기

# cat /opt/shell_app/authenticator.sh
#!/bin/bash
CERTBOT_DIR="/opt/nginx/html/.well-known/acme-challenge"
mkdir -p ${CERTBOT_DIR}
echo $CERTBOT_VALIDATION > ${CERTBOT_DIR}/$CERTBOT_TOKEN
/opt/oss/ossutil64 -c /root/.ossutilconfig cp -f ${CERTBOT_DIR}/$CERTBOT_TOKEN oss://js-djstatics-example-com/.well-known/acme-challenge/
# cat /opt/shell_app/cleanup.sh
#!/bin/bash
CERTBOT_DIR="/opt/nginx/html/.well-known/acme-challenge"
rm -f ${CERTBOT_DIR}/$CERTBOT_TOKEN

3. cerbot 코드 가 져 오기

# cd /usr/local/src/
# git clone https://github.com/letsencrypt/letsencrypt
# cd letsencrypt

4. 인증서 만 들 기
mannual for js-sts.example.com
js - sts. example. com 백 엔 드 파일 이 OSS 에 있 기 때문에 challenge 파일 을 OSS 에 동기 화 해 야 하기 때문에 mannual 방식 으로 sync 갈 고 리 를 추가 합 니 다.

# ./letsencrypt-auto certonly --manual --manual-auth-hook /opt/shell_app/authenticator.sh --manual-cleanup-hook /opt/shell_app/cleanup.sh -m example@example -d js-sts.example.com --agree-tos
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for js-sts.example.com

-------------------------------------------------------------------------------
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
-------------------------------------------------------------------------------
(Y)es/(N)o: y
Output from authenticator.sh:

Total num: 1, size: 88. Dealed num: 0, OK size: 0, Progress: 0%
Total num: 1, size: 88. Dealed num: 0, OK size: 88, Progress: 100%

Succeed: Total num: 1, size: 88. OK num: 1(upload 1 files).
0.066282(s) elapsed

Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/js-sts.example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/js-sts.example.com/privkey.pem
   Your cert will expire on 2018-05-02. To obtain a new or tweaked
   version of this certificate in the future, simply run
   letsencrypt-auto again. To non-interactively renew *all* of your
   certificates, run "letsencrypt-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

webroot for js-ds.example.com
js - ds. example. com 백 엔 드 에 모든 nginx 에 rewrite 를 추가 하고 challenge 파일 을 js - gray. example. com 으로 재 설정 하 며 js - gray. example. com 백 엔 드 에 challenge 파일 논리 에 접근 합 니 다.

./letsencrypt-auto certonly --webroot -w /opt/nginx/html/ -d js-ds.example.com -m example@example
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for js-ds.example.com
Using the webroot path /opt/nginx/html for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Unable to clean up challenge directory /opt/nginx/html/.well-known/acme-challenge

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/js-ds.example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/js-ds.example.com/privkey.pem
   Your cert will expire on 2018-05-02. To obtain a new or tweaked
   version of this certificate in the future, simply run
   letsencrypt-auto again. To non-interactively renew *all* of your
   certificates, run "letsencrypt-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

5. 인증서 업로드
/ etc / letsencrypt / live / js - sts. example. com / fullchain. pem 과 / etc / letsencrypt / live / js - sts. example. com / privkey. pem (공개 키 와 비밀 키) 을 각각 붙 여 넣 습 니 다.https://cdn.console.aliyun.com/?spm=5176.8466010.0.0.37df1649mg6epQ#/DomainDetail/detail/js-sts.example.com
6. 인증서 업데이트
보충 을 기다리다
7. 테스트 링크
아래 세 가지 필드 링크 모두 정상 SSLSTATIC_URL: https://js-sts.example.com/statics/html5_player/template_js/base_js/jquery-1.9.1.jsSSL_API_SERVER_URL: https://js-ds.example.com/store/render_native_play/?template_id=15000462§ion_id=15119054&do_type=play&render_type=sgSSL_PHOTO_URL: https://js-ds.example.com/file/v2/d/58fcba4d0b5032540f09b9bf.jpeg
참조 링크: 설정 방법 1 설정 방법 2