https证书配置

# 安装，需要修改email为自己的邮箱
curl https://get.acme.sh | sh -s email=my@example.com

# standalone需要安装socat
apt-get install  socat -y
# 生成证书
acme.sh --issue -d left2east.com --standalone
#复制到nginx目录下
cp /root/.acme.sh/left2east.com_ecc/left2east.com.cer /etc/nginx/ssl/
cp /root/.acme.sh/left2east.com_ecc/left2east.com.key /etc/nginx/ssl/

首先我们要做一下准备工作，假设你域名是 example.com，解析到你的服务器让其生效后，我们建立一个目录：

mkdir -p /var/www/letsencrypt

我们的目的是绑定 http://example.com/.well-known/acme-challenge 到这个目录。

nginx配置

server {
	listen 80;
	listen [::]:80;
	server_name example.com;

	location /.well-known/acme-challenge {
		root /var/www/letsencrypt;
	}

	location / {
		rewrite	^/(.*)$ https://$host/$1 permanent;
	}
}

生成证书

acme.sh --issue -d example.com -w /var/www/letsencrypt

安装证书

acme.sh --install-cert -d example.com \
--key-file       /etc/nginx/ssl/example.com.key  \
--fullchain-file /etc/nginx/ssl/example.com.crt \
--ca-file        /etc/nginx/ssl/example.com.ca.crt \
--reloadcmd     "systemctl restart nginx"

nginx配置

ssl_certificate /etc/nginx/ssl/example.com.crt;
ssl_certificate_key /etc/nginx/ssl/example.com.key;
ssl_trusted_certificate /etc/nginx/ssl/example.com.ca.crt;

过期重新申请的脚本

# 获取证书信息并提取过期时间
expiry_date=$(echo | openssl s_client -servername www.left2east.com -connect www.left2east.com:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)

# 转换为时间戳
expiry_timestamp=$(date -d "$expiry_date" +%s)
current_timestamp=$(date +%s)

# 检查并计算天数
if [ $current_timestamp -gt $expiry_timestamp ]; then
    echo "证书已过期！"
else
    days_remaining=$(( (expiry_timestamp - current_timestamp) / 86400 ))
    echo "证书有效，剩余天数: $days_remaining"
    exit
fi
/usr/sbin/nginx -s stop
acme.sh --issue -d www.left2east.com --standalone
cp /root/.acme.sh/www.left2east.com_ecc/www.left2east.com.cer /etc/nginx/ssl/www.left2east.com.crt
cp /root/.acme.sh/www.left2east.com_ecc/www.left2east.com.key /etc/nginx/ssl/www.left2east.com.key
cp /root/.acme.sh/www.left2east.com_ecc/ca.cer /etc/nginx/ssl/www.left2east.com.ca.crt
/usr/sbin/nginx