nginx接入let's encrypt

按以下步骤：

一、放开443端口

我的是云服务器，默认没开放443端口，需要先在控制台放开

二、使用let’s encrypt 生成证书

执行以下命令：

git clone https://github.com/letsencrypt/letsencrypt

cd letsencrypt/

./letsencrypt-auto certonly --standalone --email @qq.com -d coolfirer.com -d www.coolfirer.com

邮箱和域名换成自己的即可。

看到上图就说明成功，nginx用到fullchain.pem和privkey.pem两个。

三、配置nginx

修改/etc/nginx/sites-available/default文件, 增加443端口

server {

    listen  ssl;

    server_name www.coolfirer.com coolfirer.com;

    ssl on;

    ssl_certificate /etc/letsencrypt/live/coolfirer.com/fullchain.pem;

    ssl_certificate_key /etc/letsencrypt/live/coolfirer.com/privkey.pem;

    ssl_session_timeout 5m;

    ssl_protocols SSLv3 TLSv1;

    ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;

    ssl_prefer_server_ciphers on;

    location / {

        proxy_pass http://127.0.0.1:8090;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    }

}

同时，配置80端口跳转到443：

server {

    listen   ;

    server_name www.coolfirer.com coolfirer.com;

    return  https://$server_name$request_uri;

}

四、重新加载nginx

nginx -s reload