|
|
- ---------------------------------
- 用letsencrypt给apache申请证书
- 我用如下命令启动的apache服务
- docker run -it \
- -d \
- --name httpd_3 \
- -v /root/docker/lamp/httpd/apache2/:/usr/local/apache2/ \
- -e TZ=Asia/Shanghai \
- --network=docker_bridge_192_168_21 --ip=192.168.21.3 \
- -p 80:80 \
- -p 443:443 \
- --restart unless-stopped \
- httpd:latest
- 然后网站的配置文件如下:
- <VirtualHost *:80>
- ServerAdmin webmaster@域名.com
- DocumentRoot "/usr/local/apache2/htdocs/域名.com/www"
- ServerName www.域名.com
- ServerAlias www.域名.com
- ErrorLog "logs/www.域名.com-error_log"
- CustomLog "logs/www.域名.com-access_log" common
- </VirtualHost>
- 启动这容器
- 现在80端口能正常访问
- ---------------------------------
- 然后申请证书,就这一条命令就行,以后更新证书可以直接重新运行一次这个就行
- docker run -it --rm \
- -v /root/docker/lamp/httpd/apache2/htdocs/域名.com/zhengshu:/etc/letsencrypt \
- -v /root/docker/lamp/httpd/apache2/htdocs/域名.com/www:/var/www/html \
- certbot/certbot certonly --webroot \
- -w /var/www/html \
- -d www.域名.com \
- -m webmaster@域名.com
- 这个命令里面如果需要为其他域名申请证书,就只需要改域名就好
- 说明:
- 存放证书的目录：/root/docker/lamp/httpd/apache2/htdocs/域名.com/zhengshu
- 供验证使用的目录：/root/docker/lamp/httpd/apache2/htdocs/域名.com/www 这个就是网站的根目录,我估计验证过程可能就是certbot生成一个文件,然后证书颁发机构访问网站的这个文件,能访问说明是对的
- ---------------------------------
- 运行结果如下:
- Saving debug log to /var/log/letsencrypt/letsencrypt.log
- Requesting a certificate for www.域名.com
- Successfully received certificate.
- Certificate is saved at: /etc/letsencrypt/live/www.域名.com/fullchain.pem
- Key is saved at: /etc/letsencrypt/live/www.域名.com/privkey.pem
- This certificate expires on 2026-09-12.
- These files will be updated when the certificate renews.
- NEXT STEPS:
- - The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- If you like Certbot, please consider supporting our work by:
- * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
- * Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- ---------------------------------
- 结果说明:
- live/www.域名.com/fullchain.pem
- live/www.域名.com/privkey.pem
- live/www.域名.com/chain.pem
- `privkey.pem` : the private key for your certificate.
- `fullchain.pem`: the certificate file used in most server software.
- `chain.pem` : used for OCSP stapling in Nginx >=1.3.7.
- 然后我看文件目录的结构,发现这2个文件其实是一个链接,真正的文件在archive/www.域名.com/这个目录下,但是估计以后重新生成这个目录的文件名字会变,那么就使用live目录下的吧
- 那么我修改一下我的httpd配置文件吧
- 下面是教程写的
- SSLCertificateFile /usr/local/apache2/conf/server.crt
- SSLCertificateKeyFile /usr/local/apache2/conf/server.key
- SSLCertificateChainFile /usr/local/apache2/conf/ca.crt
- 将 /data/certbot/conf/live/您的域名/fullchain.pem 映射为 server.crt
- 将 /data/certbot/conf/live/您的域名/privkey.pem 映射为 server.key
- 将 /data/certbot/conf/live/您的域名/chain.pem 映射为 ca.crt
- 这个教程真麻烦,还改名字,直接用现成的不就好了
- 下面是我最终用的
- SSLCertificateFile "/usr/local/apache2/htdocs/域名.com/zhengshu/live/www.域名.com/fullchain.pem"
- SSLCertificateKeyFile "/usr/local/apache2/htdocs/域名.com/zhengshu/live/www.域名.com/privkey.pem"
- SSLCertificateChainFile "/usr/local/apache2/htdocs/域名.com/zhengshu/live/www.域名.com/chain.pem"
- 改好了配置文件,重启httpd容器
- docker restart httpd_3
- 最后用https访问,就能访问了
|
|
发表于 2026-6-14 23:02
楼主