1.源码安装好nginx后需要操作的几个目录

$ ln -s /usr/local/nginx/conf  /etc/nginx/
$ ln -s /usr/local/nginx/logs   /usr/share/nginx/logs
$ ln -s /usr/local/nginx/sbin/nginx  /usr/sbin/nginx

2. 安装签发证书服务certbot

$ apt install -y certbot python3-certbot-nginx

3.如果签发通配符证书需要授权dns解析

# 此处使用的域名所在阿里云
$ git clone https://github.com/tengattack/certbot-dns-aliyun

$ cd certbot-dns-aliyun

$ python3 setup.py install

$ touch /etc/.aliyun.ini
# 填入如下内容
dns_aliyun_access_key = <your-aliyun-access-key>
dns_aliyun_access_key_secret = <your-aliyun-secret-key>

$  chmod 600   /etc/.aliyun.ini

4. certbot 插件查看

$ certbot plugins
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
* dns-aliyun
Description: Obtain certificates using a DNS TXT record (if you are using Aliyun
DNS).
Interfaces: Authenticator, Plugin
Entry point: EntryPoint(name='dns-aliyun',
value='certbot_dns_aliyun.dns_aliyun:Authenticator', group='certbot.plugins')

* nginx
Description: Nginx Web Server plugin
Interfaces: Authenticator, Installer, Plugin
Entry point: EntryPoint(name='nginx',
value='certbot_nginx._internal.configurator:NginxConfigurator',
group='certbot.plugins')

* standalone
Description: Runs an HTTP server locally which serves the necessary validation
files under the /.well-known/acme-challenge/ request path. Suitable if there is
no HTTP server already running. HTTP challenge only (wildcards not supported).
Interfaces: Authenticator, Plugin
Entry point: EntryPoint(name='standalone',
value='certbot._internal.plugins.standalone:Authenticator',
group='certbot.plugins')

* webroot
Description: Saves the necessary validation files to a
.well-known/acme-challenge/ directory within the nominated webroot path. A
seperate HTTP server must be running and serving files from the webroot path.
HTTP challenge only (wildcards not supported).
Interfaces: Authenticator, Plugin
Entry point: EntryPoint(name='webroot',
value='certbot._internal.plugins.webroot:Authenticator',
group='certbot.plugins')
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

5. 证书签发

5.1 单个域名证书签发

# 首次签发需要设置邮箱
$ certbot --nginx -d example1.com -d example2.com

5.2 通配符域名证书签发

# 手动添加dns解析，签发证书
$ certbot certonly --manual --preferred-challenges dns -d "*.example1.com -d example2.com"

# 自动添加续签，如果是手动签发证书，更改为自动签发，需要重新生成证书
$  certbot certonly     --authenticator=dns-aliyun     --dns-aliyun-credentials='/etc/.aliyun.ini'     -d " *.example1.com,example2.com"

6. 续签测试

$ certbot renew --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/a.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Simulating renewal of an existing certificate for a.example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Simulating renewal of an existing certificate for *.example.com and example.com
Waiting 30 seconds for DNS changes to propagate

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/b.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Simulating renewal of an existing certificate for a.example.com and b.example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/c.example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Simulating renewal of an existing certificate for c.example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all simulated renewals succeeded:
  /etc/letsencrypt/live/a.example.com/fullchain.pem (success)
  /etc/letsencrypt/live/example.com/fullchain.pem (success)
  /etc/letsencrypt/live/b.example.com/fullchain.pem (success)
  /etc/letsencrypt/live/c.example.com/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

7. 查看续签服务

# 如果是手动续签的可能没有这个服务，自动续签会添加此服务
$  systemctl list-timers | grep certbot
Thu 2025-04-17 01:07:17 CST  1h 7min -                                      - certbot.timer                  certbot.service

$ systemctl cat certbot.timer
# /usr/lib/systemd/system/certbot.timer
[Unit]
Description=Run certbot twice daily

[Timer]
OnCalendar=*-*-* 00,12:00:00
RandomizedDelaySec=43200
Persistent=true

[Install]
WantedBy=timers.target