Linux服务器使用Certbot安装Let‘s Encrypt的SSL安全证书

昨天大伟哥做了Let's Encrypt的SSL证书的简单介绍，今天说一下在VPS或者独立服务器上申请安装Let’s Encrypt的详细步骤。

一、首先，我们要安装Let‘s Encrypt推荐的一个客户端工具：Certbot。

安装Certbot需要你的服务器安装Python 2.6/2.7或者Python 3.3版本以上。另外，你还需要拥有Root权限，以便能够创建文件到/etc/letsencrypt, /etc/log/letsencrypt, /var/lib/letsencrypt等目录，绑定80和443端口，读取并修改网站服务器的配置文件等操作。

Certbot能在多种操作系统上运行，比如Debian, Ubuntu，CentOS, Fedora，FreeBSD，Gentoo等，支持多种www服务器比如apache，Nginx，当然在不同的发行版上可能有不同的名字，叫Certbot或者letsencrypt，使用其他替代方法安装的还有可能叫certbot-auto，功能都一样。总之，使用的时候把名字改成你安装的就行了。

本例以Ubuntu 16.04 LTS下安装certbot为例，使用的WWW服务器是Apache 2.4。其他的系统和WWW服务器可以参考官方文档。

Certbot的团队为Ubuntu系统维护了一个PPA源，所以我们只需要以下命令就可以很方便地在Ubuntu系统下安装好Certbot：

$ sudo apt-get update
$ sudo apt-get install software-properties-common
$ sudo add-apt-repository ppa:certbot/certbot
$ sudo apt-get update
$ sudo apt-get install python-certbot-apache

二、轻松申请并安装Let‘s Encrypt的SSL证书

要为Apache2驱动的网站安装SSL证书，只要运行sudo certbot --apache就可以了。Certbot会提示你根据自己的实际需要选择不同的设置。

user@server:~$ sudo certbot --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel):

输入自己的邮箱，回车确认：

Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org

-------------------------------------------------------------------------------
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf. You must agree
in order to register with the ACME server at
https://acme-v01.api.letsencrypt.org/directory
-------------------------------------------------------------------------------
(A)gree/(C)ancel:

键入A同意服务条款，回车确认：

Starting new HTTPS connection (1): supporters.eff.org

Which names would you like to activate HTTPS for?
-------------------------------------------------------------------------------
1: aaa.com
2: www.aaa.com
3: bbb.com
4: www.bbb.com
5: ccc.com
6: www.ccc.com
-------------------------------------------------------------------------------
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):

这里，Certbot读取了Apache的虚拟主机配置文件，找到了三个网站（带www的和不带www的是同一个网站），让我们选择要给哪个网站安装SSL证书。大伟哥的建议是每个网站分别申请安装，因为如果一次性全部选择，那么虽然所有的网站都可以开启HTTPS协议，但是如果通过浏览器查看网站的通用名的话，就会发现所有不同的网站的通用名都显示的是第一个网站的域名aaa.com，这肯定不是我们希望的。

所以，我们先选择给aaa.com申请证书，键入1和2,中间用逗号或者空格分开，回车确认。

Deploying Certificate for aaa.com to VirtualHost /etc/apache2/sites-available/aaa.com-le-ssl.conf
Deploying Certificate for www.aaa.com to VirtualHost /etc/apache2/sites-available/aaa.com-le-ssl.conf

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel):

Certbot已经帮我们生成并启用了aaa.com的HTTPS配置文件，然后询问我们是不是把来自HTTP的访问强制跳转到HTTPS的协议。如果不是很确认100%能够启用HTTPS，你可以选择不跳转，仍然保持HTTP协议。大伟哥选择以后所有的访问都强制使用https,所以选择2, 然后回车确认。

-------------------------------------------------------------------------------
Congratulations! You have successfully enabled https://aaa.com and
https://www.aaa.com

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=aaa.com
https://www.ssllabs.com/ssltest/analyze.html?d=www.aaa.com
-------------------------------------------------------------------------------

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/aaa.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/aaa.com/privkey.pem
   Your cert will expire on 2018-01-19. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

到这里，Let’s Encrypt的SSL安全证书就安装成功了，可以通过浏览器打开https://www.aaa.com，来欣赏地址栏旁边漂亮的小绿锁了。