Siege

使用 Cloudflare 獲取 Let's Encrypt 泛域名證書

Let’s Encrypt 是一個於 2015 年第三季度推出的數位證書認證機構,將通過旨在消除當前手動建立和安裝證書的複雜過程的自動化流程,並推廣使全球資訊網伺服器的加密連接無所不在,為安全網站提供免費的 SSL/TLS 證書。

目前可以使用更簡單的 Cloudflare DNS 驗證方式獲取證書

安裝腳本

wget -O -  https://get.acme.sh | sh

配置 DNS APIKEY

Global API Key 去 Cloudflare 申請

export CF_Key="your_key"
export CF_Email="your_email"

獲取 ECC 證書 ?

./acme.sh --register-account -m your_email
./acme.sh --issue -d your_domain  -d *.your_domain  --dns dns_cf --keylength ec-384
[Fri SEP 08 15:31:26 HKT 2023] Registering account
[Fri SEP 08 15:31:27 HKT 2023] Registered
[Fri SEP 08 15:31:27 HKT 2023] ACCOUNT_THUMBPRINT='****'
[Fri SEP 08 15:31:27 HKT 2023] Creating domain key
[Fri SEP 08 15:31:27 HKT 2023] The domain key is here: /root/.acme.sh/you_domain_ecc/you_domain.key
[Fri SEP 08 15:31:27 HKT 2023] Multi domain='DNS:you_domain,DNS:*.you_domain'
[Fri SEP 08 15:31:27 HKT 2023] Getting domain auth token for each domain
[Fri SEP 08 15:31:28 HKT 2023] Getting webroot for domain='you_domain'
[Fri SEP 08 15:31:28 HKT 2023] Getting webroot for domain='*.you_domain'
[Fri SEP 08 15:31:28 HKT 2023] Found domain api file: /root/.acme.sh/dnsapi/dns_cf.sh
[Fri SEP 08 15:31:30 HKT 2023] Adding record
[Fri SEP 08 15:31:30 HKT 2023] Added, OK
[Fri SEP 08 15:31:30 HKT 2023] Found domain api file: /root/.acme.sh/dnsapi/dns_cf.sh
[Fri SEP 08 15:31:32 HKT 2023] Adding record
[Fri SEP 08 15:31:32 HKT 2023] Added, OK
[Fri SEP 08 15:31:32 HKT 2023] Sleep 120 seconds for the txt records to take effect
[Fri SEP 08 15:33:33 HKT 2023] Verifying:you_domain
[Fri SEP 08 15:33:36 HKT 2023] Success
[Fri SEP 08 15:33:36 HKT 2023] Verifying:*.you_domain
[Fri SEP 08 15:33:39 HKT 2023] Success
[Fri SEP 08 15:33:39 HKT 2023] Removing DNS records.
[Fri SEP 08 15:33:41 HKT 2023] Verify finished, start to sign.
[Fri SEP 08 15:33:43 HKT 2023] Cert success.
-----BEGIN CERTIFICATE-----
****
-----END CERTIFICATE-----
[Fri SEP 08 15:33:43 HKT 2023] Your cert is in  /root/.acme.sh/you_domain_ecc/you_domain.cer
[Fri SEP 08 15:33:43 HKT 2023] Your cert key is in  /root/.acme.sh/you_domain_ecc/you_domain.key
[Fri SEP 08 15:33:43 HKT 2023] The intermediate CA cert is in  /root/.acme.sh/you_domain_ecc/ca.cer
[Fri SEP 08 15:33:43 HKT 2023] And the full chain certs is there:  /root/.acme.sh/you_domain_ecc/fullchain.cer

參考資料:

https://github.com/acmesh-official/acme.sh