​

 

安装

my@example.com替换为你的真实邮箱

curl https://get.acme.sh | sh -s email=my@example.com

 终端输入acme.sh -h 可以看到帮助命令

使用

创建别名

echo "alias acme.sh='~/.acme.sh/acme.sh'"  >> ~/.bashrc
//配置生效
source ~/.bashrc

修改CA证书类型

#切换 Let’s Encrypt
acme.sh --set-default-ca --server letsencrypt

配置 DNS API（以腾讯云）

​编辑

换成真实的配置，执行

export Tencent_SecretId="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
export Tencent_SecretKey="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

刷新让配置生效

source ~/.bashrc

申请域名的证书

acme.sh --issue --dns dns_tencent -d example.com -d *.example.com

安装证书（nginx为例）

acme.sh --install-cert -d example.com \
--key-file       /path/to/keyfile/in/nginx/key.pem  \
--fullchain-file /path/to/fullchain/nginx/cert.pem \
--reloadcmd     "service nginx force-reload"

example.com 替换为您的域名， /path/to/keyfile/in/nginx/key.pem 和 /path/to/fullchain/nginx/cert.pem 替换为证书实际路径。

最终配置效果

server {
    listen 443 ssl http2;

    server_name example.com;

    # 请替换为证书实际路径
    ssl_certificate /path/to/keyfile/in/nginx/cert.pem;
    ssl_certificate_key /path/to/fullchain/nginx/key.pem;

    ssl_session_timeout 5m;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;
    ssl_prefer_server_ciphers on;
    location / {
        root /nginx/www/html;
    }
}

​