Let's Encrypt是免费的HTTPS证书，有效期是90天。到期后需要手动续期，或者编写一个定时任务自动去续期。

我当前所用Ubuntu版本为：

root@hgdm:~# lsb_release -a
LSB Version:	security-11.1.0ubuntu2-noarch
Distributor ID:	Ubuntu
Description:	Ubuntu 20.04.3 LTS
Release:	20.04
Codename:	focal

步骤1: 安装并启动nginx

$ sudo apt-get install nginx
$ sudo systemctl start nginx

具体可参考我之前写的：Ubuntu Linux 如何使用apt-get安装Nginx、MySQL、Redis、PHP。

步骤2

$ sudo apt install certbot python3-certbot-nginx

步骤3

假设需要部署HTTPS证书的域名为：m.xyz.com。

这个域名所对应的网站目录路径为：/data/web/m.xyz.com。

域名和网站目录所对应的nginx配置文件路径为：/etc/nginx/conf.d/m.xyz.com.conf。

/etc/nginx/conf.d/m.xyz.com.conf这个配置文件的内容如下所示：

server {
    listen 80 default_server;
  
     # 设置网站的域名为m.xyz.com
    server_name m.xyz.com;
  
    # 设置网站的目录路径
    root /data/web/m.xyz.com;

    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }
}

不知道去哪里复制可重用的nginx配置？去这个路径找：/etc/nginx/sites-available/default。

步骤4：重启nginx

必须重启nginx服务器，否则新增的网站配置不生效。

$ sudo systemctl restart nginx

域名m.xyz.com必须能通过网络访问，因为下一步执行certbot命令时，会在/data/web/m.xyz.com目录下创建一个隐藏的名称为.well-known/acme-challenge的文件，然后在外网Let's Encrypt访问http://m.xyz.com/.well-known/acme-challenge。若Let's Encrypt访问这个网址失败，那么Let's Encrypt就会认为域名m.xyz.com不是你的，进而无法为m.xyz.com签发证书。

步骤5

$ sudo certbot certonly --webroot -w /data/web/m.xyz.com -d m.xyz.com 
    # 若是成功执行，最后一部分的输出信息为:
    IMPORTANT NOTES:
     - Congratulations! Your certificate and chain have been saved at:
       /etc/letsencrypt/live/m.xyz.com/fullchain.pem
       Your key file has been saved at:
       /etc/letsencrypt/live/m.xyz.com/privkey.pem
       Your cert will expire on 2022-03-30. To obtain a new or tweaked
       version of this certificate in the future, simply run certbot
       again. To non-interactively renew *all* of your certificates, run
       "certbot renew"
     - If you like Certbot, please consider supporting our work by:

       Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
       Donating to EFF:                    https://eff.org/donate-le

这个命令的输出显示，生成了两个证书：

• /etc/letsencrypt/live/m.xyz.com/fullchain.pem
• /etc/letsencrypt/live/m.xyz.com/privkey.pem

/etc/letsencrypt/live/m.xyz.com目录是用于存放certbot命令生成的证书文件，但是，certbot生成的证书文件不止前面这两个，还有其他的。

root@hgdm:~# ls /etc/letsencrypt/live/m.xyz.com/
README  cert.pem  chain.pem  fullchain.pem  privkey.pem

这个目录里有三个证书文件是下面步骤配置nginx SSL时需要用到的：

• 第一个：/etc/letsencrypt/live/m.xyz.com/fullchain.pem
• 第二个：/etc/letsencrypt/live/m.xyz.com/privkey.pem
• 第三个：/etc/letsencrypt/live/m.xyz.com/chain.pem

步骤6 查找openssl的版本

# 方法1
$ openssl version
OpenSSL 1.1.1f  31 Mar 2020

# 方法2
$ dpkg -l | grep openssl

步骤7

使用mozilla提供的SSL配置生成器生成nginx SSL配置，然后复制到/etc/nginx/conf.d/m.xyz.com.conf，并修改4个地方。

需要修改的4个地方为：

• ssl_certificate：上文的certbot命令已生成这个文件，文件路径为/etc/letsencrypt/live/m.xyz.com/fullchain.pem。
• ssl_certificate_key：上文的certbot命令已生成这个文件，文件路径为/etc/letsencrypt/live/m.xyz.com/privkey.pem。
• ssl_dhparam：这个文件还没生成，先填写为预设的文件路径：/etc/nginx/ssl/dhparam.pem，下一步执行命令去生成。
• ssl_trusted_certificate：上文的certbot命令已生成这个文件，文件路径为/etc/letsencrypt/live/m.xyz.com/chain.pem。

/etc/nginx/conf.d/m.xyz.com.conf被修改为：

# generated 2021-12-30, Mozilla Guideline v5.6, nginx 1.18, OpenSSL 1.1.1f, intermediate configuration
# https://ssl-config.mozilla.org/#server=nginx&version=1.18&config=intermediate&openssl=1.1.1f&guideline=5.6
server {
    server_name m.xyz.com;
    listen 80 default_server;
    listen [::]:80 default_server;

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    # 第1个需被修改的地方(已改)
    ssl_certificate /etc/letsencrypt/live/m.xyz.com/fullchain.pem;
    # 第2个需被修改的地方(已改)
    ssl_certificate_key /etc/letsencrypt/live/m.xyz.com/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets off;

    # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
    # 第3个需被修改的地方(已改)
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;

    # intermediate configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
    add_header Strict-Transport-Security "max-age=63072000" always;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # verify chain of trust of OCSP response using Root CA and Intermediate certs
    # 第4个需被修改的地方(已改)
    ssl_trusted_certificate /etc/letsencrypt/live/m.xyz.com/chain.pem;

    # replace with the IP address of your resolver
    resolver 127.0.0.1;

    server_name m.xyz.com;
    root /data/web/m.xyz.com;

    location ~ \.py$ {
        return 403;
    }

}

步骤8

执行以下命令，用于生成第7步nginx配置里预设的ssl_dhparam文件。下面第二个命令比较耗时，快的话需要等一两分钟，慢的话则更久。

$ sudo mkdir /etc/nginx/ssl
$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

步骤9：重启nginx

要想前面修改过的nginx配置生效，必须重启nginx服务。

$ sudo systemctl restart nginx

步骤10

打开浏览器，访问m.xyz.com，检查https是否生效了。若配置正确，nginx也重启了，也没有生效，可能需要等待一小会。

检查https是否生效的步骤如下图所示：

步骤11：HTTPS证书到期了，需要更新证书

执行以下命令去更新HTTPS证书，且更新后必须重启nginx服务器，否则无法在浏览器看到HTTPS证书的失效日期被更新了。

$ sudo certbot renew

# 执行certbot renew命令后，必须重启nginx服务器，否则在浏览器查看不到HTTPS证书的失效日期被更新了
$ sudo systemctl restart nginx   

最后 贴上完整的nginx配置

前端是nginx，后端是一个运行着django项目的gunicorn服务。

# generated 2021-12-30, Mozilla Guideline v5.6, nginx 1.18, OpenSSL 1.1.1f, intermediate configuration
# https://ssl-config.mozilla.org/#server=nginx&version=1.18&config=intermediate&openssl=1.1.1f&guideline=5.6
server {
    server_name m.xyz.com;
    listen 80 default_server;
    listen [::]:80 default_server;

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    ssl_certificate /etc/letsencrypt/live/m.xyz.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/m.xyz.com/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets off;

    # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;

    # intermediate configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
    add_header Strict-Transport-Security "max-age=63072000" always;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # verify chain of trust of OCSP response using Root CA and Intermediate certs
    ssl_trusted_certificate /etc/letsencrypt/live/m.xyz.com/chain.pem;

    # replace with the IP address of your resolver
    resolver 127.0.0.1;

    server_name m.xyz.com;

    # 找不到入口的请求(在gunicorn,/static, /media都没找到入口)，最后访问/data/web/m.xyz.com_other这个目录，试试看是否能访问成功
    root /data/web/m.xyz.com_other;

    # 网站的js和css文件所在目录
    location /static/ {
        alias /data/web/m.xyz.com/static/;
        add_header Cache-Control no-cache;
        expires -1; # kill cache;
        access_log        off;
        log_not_found     off;
    }

    # 网站的媒体文件所在的目录
    location /media/ {
        alias /data/web/m.xyz.com/media/;
        expires max;
    }

    location ~ \.py$ {
        return 403;
    }

    # 将非文件的请求发给运行django项目的gunicorn服务，gunicorn服务的端口号为8999
    location / { 
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-NginX-Proxy true;
        proxy_redirect off;
        if (!-f $request_filename) {
            proxy_pass http://127.0.0.1:8999;
            break;
        }
    }
}