• Feeds

  • 是时候支持HTTPS了:免费SSL证书letsencrypt配置教程

    今天抽空将 blog 增加了 HTTPS 支持,并停止了原来的 HTTP 服务。

    由于证书仅网站域名需要,因此使用了免费的 Let’s Encrypt 证书服务。

    根据维基百科的说明,Let’s Encrypt 是一个于2015年三季度推出的数字证书认证机构,将通过旨在消除当前手动创建和安装证书的复杂过程的自动化流程,为安全网站提供免费的SSL/TLS证书。Let’s Encrypt 是由互联网安全研究小组(ISRG,一个公益组织)提供的服务。主要赞助商包括电子前哨基金会,Mozilla 基金会,Akamai 以及思科。



    到2016年9月9日,Let’s Encrypt 已经发放 1000 万张证书。因此对于大部分中小型网站来说,是一个值得考虑的选择。


    HTTPS 启用及配置的主要步骤如下,假设你已经有一个正常运行的 HTTP 网站。

    1. 打开 https://certbot.eff.org/ 选择对应操作系统与 Web 服务器,选完后出现响应的平台说明。由于我的系统运行在 nginx 及 Ubuntu,选完之后出现的说明地址是 https://certbot.eff.org/#ubuntuxenial-nginx

    2. 执行命令,并根据需要修改相应域名参数。

    $ sudo apt-get install letsencrypt
    $ letsencrypt certonly --webroot -w /var/www/timyang.net -d timyang.net -d www.timyang.net

    3. 修改 nginx
    将 80 端口相关配置改成 443 端口,并增加相关配置

    # listen       80;
    listen 443 ssl;
    server_name timyang.net www.timyang.net;
    ssl_certificate /etc/letsencrypt/live/timyang.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/timyang.net/privkey.pem;

    再增加 80 端口自动跳转

    server {
        listen 80;
        server_name timyang.net www.timyang.net;
        return 301 https://$host$request_uri;

    4. 重启 nginx,并用 chrome 访问,如果 URL 地址之前出现锁标记,则说明设置成功。
    如果页面中还包含有嵌入的 HTTP 元素,chrome 会仍然显示 i 标记,通过点击 i 之后的元素说明逐个修复即可。


    另外注意 Let’s Encrypt 每次只有 90 天有效期,但可以通过脚本进行更新


    $ sudo letsencrypt renew --dry-run --agree-tos

    如果运行成功,建议将正式更新脚本加到 cron 脚本中,一劳永逸。

    $ sudo letsencrypt renew

    虽然 Let’s Encrypt 是一个免费的服务,但对 letsencrypt 使用感到满意的朋友,还可以去他们网站进行赞助。

    如想及时阅读Tim Yang的文章,可通过页面右上方扫码订阅最新更新。

    « | »


    1. 现在https是趋势,apple,Google等公司对https起引导作用

    2. Hi. A great resource with so much useful information.

    3. 这个跟收费的效果一样吗?chrome经常对一些个人网站进行提醒

    4. 好文,拜读…

    5. But we can find alternate ways to get your page on Musically featured with a crown. For that to happen, you don’t really need to spend a lot of time or money as well. What I’m coming to point out is about using hacks or cheats. Yes, it’s a good alternative to using hacks for featuring your account when the real method http://musicallyresources.com/

    6. Nishant Gaurav

      These are wonderful quotes, funny posts

    7. 已经用上了https,感谢~

    8. 收藏了,赞赞

    9. http://tea-http://business-shop.info/ Need Money Now? 3 Legit Ways to Get Money Today

    10. The information you share is very useful. It is closely related to my work and has helped me grow.

    11. Hi an amazingoffering
      Just click on the link below to qualify


    12. Hi What we obtain here is , an prettyoblation
      Honest click on the check dolour of the trinkets to train


    13. Hey a thingsgift
      High-minded click


    14. An outstanding share! I’ve just forwarded this onto
      a friend who has been doing a little homework on this. And he in fact
      ordered me breakfast because I found it for him…
      lol. So allow me to reword this…. Thank YOU for the meal!!
      But yeah, thanx for spending some time to discuss this matter here
      on your blog.

    15. 夏天,有点爱,有点讨厌,我对此有好感。

    16. 我什至不能在這種環境下工作,噪音太大,溫度太低。

    17. 撰寫文章確實很有趣,如果您當然喜歡寫作,那麼您會發現它很無聊。

    18. 真的很棒。 我读了这篇奇妙的文章。 感谢您分享有关它的信息。 我真的很喜欢 非常感谢您的召集。

    19. http and https have many advantages to distinguishing that Which is the most secure site lsm99 likes to have this new rule released? It makes using the internet a lot easier.

    20. ssl is a very good safety sexygame feature. Because there was no ssl in the old days, it could have been hackers stealing information Or can release the virus onto the website But with ssl it can be prevented

    21. I am now a man sagame who has nothing yet. But in the near future I can make everything The dream that I once painted I have to make it come true. No matter who looks at me I will never use those words to discourage me.

    22. Świetny artykuł, bardzo mi też pomógł w pracy przy tworzeniu Dzwonkinatelefon.pl

    23. If I had to rank video game cinematic trailers, I would rank this one at the top 5 solely because of the hype that it brought to the game. I mean, after I watched it, I could not wait to get my hands on the game itself and play it all day long.

    24. I don’t think this problem has to do with your internet connection or your personal computer or mobile device. I think it has something to do with your account. If you only availed of the standard package then you will only be able to stream in 1080p.

    25. It is an indication that is สมัครจีคลับ Thank you very much for your article. It has given me a lot of knowledge.

    Leave a Comment