Let's Encrypt是免费的HTTPS证书，有效期是90天。到期后需要手动续期，或者编写一个定时任务自动去续期。

我当前所用Ubuntu版本为：

root@hgdm:~# lsb_release -aLSB Version:	security-11.1.0ubuntu2-noarchDistributor ID:	UbuntuDescription:	Ubuntu 20.04.3 LTSRelease:	20.04Codename:	focal

$ sudo apt-get install nginx$ sudo systemctl start nginx

具体可参考我之前写的：Ubuntu Linux 如何使用apt-get安装Nginx、MySQL、Redis、PHP。

步骤2

$ sudo apt install certbot python3-certbot-nginx

假设需要部署HTTPS证书的域名为：m.xyz.com。

这个域名所对应的网站目录路径为：/data/web/m.xyz.com。

域名和网站目录所对应的nginx配置文件路径为：/etc/nginx/conf.d/m.xyz.com.conf。

/etc/nginx/conf.d/m.xyz.com.conf这个配置文件的内容如下所示：

server {    listen 80 default_server;       # 设置网站的域名为m.xyz.com    server_name m.xyz.com;      # 设置网站的目录路径    root /data/web/m.xyz.com;    index index.html index.htm;    location / {        try_files $uri $uri/ =404;    }}

不知道去哪里复制可重用的nginx配置？去这个路径找：/etc/nginx/sites-available/default。

步骤4：重启nginx

必须重启nginx服务器，否则新增的网站配置不生效。

$ sudo systemctl restart nginx

域名m.xyz.com必须能通过网络访问，因为下一步执行certbot命令时，会在/data/web/m.xyz.com目录下创建一个隐藏的名称为.well-known/acme-challenge的文件，然后在外网Let's Encrypt访问。若Let's Encrypt访问这个网址失败，那么Let's Encrypt就会认为域名m.xyz.com不是你的，进而无法为m.xyz.com签发证书。

步骤5

$ sudo certbot certonly --webroot -w /data/web/m.xyz.com -d m.xyz.com     # 若是成功执行，最后一部分的输出信息为:    IMPORTANT NOTES:     - Congratulations! Your certificate and chain have been saved at:       /etc/letsencrypt/live/m.xyz.com/fullchain.pem       Your key file has been saved at:       /etc/letsencrypt/live/m.xyz.com/privkey.pem       Your cert will expire on 2022-03-30. To obtain a new or tweaked       version of this certificate in the future, simply run certbot       again. To non-interactively renew *all* of your certificates, run       "certbot renew"     - If you like Certbot, please consider supporting our work by:       Donating to ISRG / Let's Encrypt:          Donating to EFF:                    

这个命令的输出显示，生成了两个证书：

/etc/letsencrypt/live/m.xyz.com/fullchain.pem/etc/letsencrypt/live/m.xyz.com/privkey.pem

/etc/letsencrypt/live/m.xyz.com目录是用于存放certbot命令生成的证书文件，但是，certbot生成的证书文件不止前面这两个，还有其他的。

root@hgdm:~# ls /etc/letsencrypt/live/m.xyz.com/README  cert.pem  chain.pem  fullchain.pem  privkey.pem

这个目录里有三个证书文件是下面步骤配置nginx SSL时需要用到的：

第一个：/etc/letsencrypt/live/m.xyz.com/fullchain.pem第二个：/etc/letsencrypt/live/m.xyz.com/privkey.pem第三个：/etc/letsencrypt/live/m.xyz.com/chain.pem步骤6 查找openssl的版本

# 方法1$ openssl versionOpenSSL 1.1.1f  31 Mar 2020# 方法2$ dpkg -l | grep openssl

使用mozilla提供的SSL配置生成器生成nginx SSL配置，然后复制到/etc/nginx/conf.d/m.xyz.com.conf，并修改4个地方。

需要修改的4个地方为：

ssl_certificate：上文的certbot命令已生成这个文件，文件路径为/etc/letsencrypt/live/m.xyz.com/fullchain.pem。ssl_certificate_key：上文的certbot命令已生成这个文件，文件路径为/etc/letsencrypt/live/m.xyz.com/privkey.pem。ssl_dhparam：这个文件还没生成，先填写为预设的文件路径：/etc/nginx/ssl/dhparam.pem，下一步执行命令去生成。ssl_trusted_certificate：上文的certbot命令已生成这个文件，文件路径为/etc/letsencrypt/live/m.xyz.com/chain.pem。

SSL配置生成器生成的配置有4个地方需要修改

/etc/nginx/conf.d/m.xyz.com.conf被修改为：

# generated 2021-12-30, Mozilla Guideline v5.6, nginx 1.18, OpenSSL 1.1.1f, intermediate configuration#  {    server_name m.xyz.com;    listen 80 default_server;    listen [::]:80 default_server;    location / {        return 301 ;    }}server {    listen 443 ssl http2;    listen [::]:443 ssl http2;    # 第1个需被修改的地方(已改)    ssl_certificate /etc/letsencrypt/live/m.xyz.com/fullchain.pem;    # 第2个需被修改的地方(已改)    ssl_certificate_key /etc/letsencrypt/live/m.xyz.com/privkey.pem;    ssl_session_timeout 1d;    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions    ssl_session_tickets off;    # curl  > /path/to/dhparam    # 第3个需被修改的地方(已改)    ssl_dhparam /etc/nginx/ssl/dhparam.pem;    # intermediate configuration    ssl_protocols TLSv1.2 TLSv1.3;    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;    ssl_prefer_server_ciphers off;    # HSTS (ngx_http_headers_module is required) (63072000 seconds)    add_header Strict-Transport-Security "max-age=63072000" always;    # OCSP stapling    ssl_stapling on;    ssl_stapling_verify on;    # verify chain of trust of OCSP response using Root CA and Intermediate certs    # 第4个需被修改的地方(已改)    ssl_trusted_certificate /etc/letsencrypt/live/m.xyz.com/chain.pem;    # replace with the IP address of your resolver    resolver 127.0.0.1;    server_name m.xyz.com;    root /data/web/m.xyz.com;    location ~ \.py$ {        return 403;    }}

执行以下命令，用于生成第7步nginx配置里预设的ssl_dhparam文件。下面第二个命令比较耗时，快的话需要等一两分钟，慢的话则更久。

$ sudo mkdir /etc/nginx/ssl$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

要想前面修改过的nginx配置生效，必须重启nginx服务。

$ sudo systemctl restart nginx

打开浏览器，访问m.xyz.com，检查https是否生效了。若配置正确，nginx也重启了，也没有生效，可能需要等待一小会。

检查https是否生效的步骤如下图所示：

查看证书是否生效第1步和第2步

查看证书是否生效第3步

查看证书是否生效第4步

步骤11：HTTPS证书到期了，需要更新证书

执行以下命令去更新HTTPS证书，且更新后必须重启nginx服务器，否则无法在浏览器看到HTTPS证书的失效日期被更新了。

$ sudo certbot renew# 执行certbot renew命令后，必须重启nginx服务器，否则在浏览器查看不到HTTPS证书的失效日期被更新了$ sudo systemctl restart nginx   

前端是nginx，后端是一个运行着django项目的gunicorn服务。

# generated 2021-12-30, Mozilla Guideline v5.6, nginx 1.18, OpenSSL 1.1.1f, intermediate configuration#  {    server_name m.xyz.com;    listen 80 default_server;    listen [::]:80 default_server;    location / {        return 301 ;    }}server {    listen 443 ssl http2;    listen [::]:443 ssl http2;    ssl_certificate /etc/letsencrypt/live/m.xyz.com/fullchain.pem;    ssl_certificate_key /etc/letsencrypt/live/m.xyz.com/privkey.pem;    ssl_session_timeout 1d;    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions    ssl_session_tickets off;    # curl  > /path/to/dhparam    ssl_dhparam /etc/nginx/ssl/dhparam.pem;    # intermediate configuration    ssl_protocols TLSv1.2 TLSv1.3;    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;    ssl_prefer_server_ciphers off;    # HSTS (ngx_http_headers_module is required) (63072000 seconds)    add_header Strict-Transport-Security "max-age=63072000" always;    # OCSP stapling    ssl_stapling on;    ssl_stapling_verify on;    # verify chain of trust of OCSP response using Root CA and Intermediate certs    ssl_trusted_certificate /etc/letsencrypt/live/m.xyz.com/chain.pem;    # replace with the IP address of your resolver    resolver 127.0.0.1;    server_name m.xyz.com;    # 找不到入口的请求(在gunicorn,/static, /media都没找到入口)，最后访问/data/web/m.xyz.com_other这个目录，试试看是否能访问成功    root /data/web/m.xyz.com_other;    # 网站的js和css文件所在目录    location /static/ {        alias /data/web/m.xyz.com/static/;        add_header Cache-Control no-cache;        expires -1; # kill cache;        access_log        off;        log_not_found     off;    }    # 网站的媒体文件所在的目录    location /media/ {        alias /data/web/m.xyz.com/media/;        expires max;    }    location ~ \.py$ {        return 403;    }    # 将非文件的请求发给运行django项目的gunicorn服务，gunicorn服务的端口号为8999    location / {         proxy_set_header Host $http_host;        proxy_set_header X-Real-IP $remote_addr;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;        proxy_set_header X-Forwarded-Proto $scheme;        proxy_set_header X-NginX-Proxy true;        proxy_redirect off;        if (!-f $request_filename) {            proxy_pass ;            break;        }    }}