浏览文章
文章信息
Let's Encrypt https自动脚本申请
12474
附件中的acme_tiny.py是防止shell自动下载不下来的时候使用：使用方式是将acme_tiny.py文件放置到与shell同目录，或者网站目录中。
#!/bin/bash #author yaozhongjie echo -e "\033[30;34m =======================Let's Encrypt环境准备=======================================\033[0m" echo -e "\033[30;34m 1、检测 Python 环境 \033[0m" if command -v python > /dev/null 2>&1; then echo -e '\033[30;32m Python 环境就绪...\033[0m' python_command=python else echo -e '\033[30;35m Python环境不存在，即将开始自动安装。。。\033[0m' apt-get -y install python || yum -y install python echo -e '\033[30;32m python 安装成功!\033[0m' python_command=python fi echo -e "\033[30;34m 2、检测 openssl 环境 \033[0m" if command -v openssl > /dev/null 2>&1; then echo -e '\033[30;32m openssl 环境就绪...\033[0m' else echo -e '\033[30;35m openssl 不存在，准备安装。。。\033[0m' apt-get -y install openssl || yum -y install openssl fi echo -e "\033[30;34m 3、检测 nginx 环境 \033[0m" # if command -v nginx> /dev/null 2>&1; then # echo -e '\033[30;32m nginx 环境就绪...\033[0m' # else # echo -e '\033[30;35m nginx 环境不存在，是否需要自动安装？' # echo -e '\n' # cat << EOF # 是否需要安装(y/n)?\033[0m # EOF # read -p "> " confirm # if [[ $confirm == "y" ]]; then # apt-get -y install nginx || yum -y install nginx # echo -e '\033[30;32m nginx 环境安装成功!\033[0m' # else # exit 0 # fi # fi echo -e "\033[30;34m ==========================环境准备完成===========================\033[0m" echo -e '\033[30;34m 开始配置\033[0m' echo -e '\033[30;34m 1、域名配置，请确保你的域名已解析到本机\033[0m' echo -e '\033[30;34m 请输入域名（多个请用空格隔开,不输入将使用当前目录名）：按回车结束（例：www.baidu.com）\033[0m' read -p "> " web_domains if [[ -z "$web_domains" ]]; then web_domains=${PWD##*/} fi domain_length=0 sign_domain_str='' web_first_domain=$(echo $web_domains|tr -s [:blank:]|cut -d ' ' -f 1) nginx_web_config_file=$web_first_domain".conf" for web_domain in ${web_domains[@]} do sign_domain_str=$sign_domain_str"DNS:"$web_domain"," domain_length=$(($domain_length+1)) done sign_domain_str=${sign_domain_str:0:${#sign_domain_str}-1} echo -e '\033[30;34m ' echo "$sign_domain_str" echo -e '\033[0m' echo -e '\033[30;34m 2、站点绝对路径配置，如果未输入或者输入非绝对路径，就默认使用当前目录\033[0m' read -p "> " web_dir if [[ -z "$web_dir" || ! "$web_dir" == /* ]]; then web_dir=${PWD} fi if [ ! -d "$web_dir" ]; then echo -e "\033[30;35m $web_dir 目录不存在...\033[0m" exit 0 fi echo -e '\033[30;34m ' echo "$web_dir" echo -e '\033[0m' echo -e '\033[30;34m 3、nginx路径配置，如果你的默认路径是/etc/nginx，请直接回车\033[0m' read -p "> " nginx_config_dir if [[ -z "$nginx_config_dir" ]]; then nginx_config_dir=/etc/nginx fi echo -e "\033[30;32m \n" cat << EOF 确认配置 网 站 根 目 录: $web_dir 域 名 : $web_domains nginx配置 文件路径: $nginx_config_dir EOF echo -e "\033[0m" echo -e "\033[30;34m \n" cat << EOF 请输入1或2 1):确认（默认） 2):退出 EOF echo -e "\033[0m" read -p "> " confirm if [[ $confirm -eq 2 ]]; then exit 0 fi echo -e "\033[30;34m ===========================自动化配置开始=================================\033[0m" if [ ! -d ${web_dir}"/certificate/challenges" ]; then echo -e "\033[30;34m ${web_dir}/certificate/challenges 目录不存在,正在自动创建...\033[0m" mkdir -p ${web_dir}"/certificate/challenges" fi echo -e "\033[30;32m 认证目录${web_dir}/certificate授权...\033[0m" chmod -R 755 ${web_dir}"/certificate" # web_first_parent_dir="/"$(echo $web_dir|cut -d "/" -f2) web_first_parent_dir=$web_dir echo -e "\033[30;32m 网站目录$web_first_parent_dir授权...\033[0m" find $web_first_parent_dir -type d -exec chmod o+x {} \; cd $web_dir"/certificate" echo -e "\033[30;35m 生成 Let's Encrypt 账户 private key（私钥）\033[0m" openssl genrsa 4096 > account.key echo -e "\033[30;35m 生成 域名 private key （私钥）\033[0m" openssl genrsa 4096 > domain.key if [[ $domain_length -gt 1 ]]; then openssl req -new -sha256 -key domain.key -subj "/" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=$sign_domain_str")) > domain.csr || openssl req -new -sha256 -key domain.key -subj "/" -reqexts SAN -config <(cat /etc/pki/tls/openssl.cnf <(printf "[SAN]\nsubjectAltName=$sign_domain_str")) > domain.csr else openssl req -new -sha256 -key domain.key -subj "/CN=$web_domains" > domain.csr fi echo -e "\033[30;35m \n" cat << EOF 请确认是否要自动为网站 验证证书 配置nginx配置文件？(如果你之前已经配置过nginx,不想nginx配置被覆盖，请默认不需要。) EOF echo -e "\033[0m" echo -e "\033[30;34m \n" cat << EOF 请输入1或2 1):不需要（默认） 2):确认 EOF echo -e "\033[0m" read -p "> " confirm_config_nginx if [[ $confirm_config_nginx -eq 2 ]]; then echo -e "\033[30;35m 正在自动为你配置nginx...\033[0m" echo -e "\033[30;34m 配置文件位置：$nginx_config_dir"/conf.d/"$nginx_web_config_file \033[0m" echo -e "\033[30;32m" cat > $nginx_config_dir"/conf.d/"$nginx_web_config_file <<EOF server { listen 80; server_name $web_domains; location /.well-known/acme-challenge/ { alias $web_dir/certificate/challenges/; try_files \$uri =404; } } EOF echo -e "\033[0m" else echo -e "\033[30;34m 已为你跳过自动配置Nginx,如有需要你可以手动将下面输出内容复制到对应配置文件 \033[0m" echo -e "\033[30;34m 配置文件位置：$nginx_config_dir"/conf.d/"$nginx_web_config_file \033[0m" echo -e "\033[30;32m" cat <<EOF server { listen 80; server_name $web_domains; location /.well-known/acme-challenge/ { alias $web_dir/certificate/challenges/; try_files \$uri =404; } } EOF echo -e "\033[0m" fi echo -e "\033[0m" echo -e "\033[30;34m 重启Nginx服务器...\033[0m" service nginx restart echo -e "\033[30;34m 下载Python工具acme_tiny.py...\033[0m" wget --no-check-certificate https://raw.githubusercontent.com/diafygi/acme-tiny/master/acme_tiny.py # wget --no-check-certificate https://github.com/diafygi/acme-tiny/master/acme_tiny.py cp $web_dir/acme_tiny.py ${PWD}/ if [ ! -f "${PWD}/acme_tiny.py" ]; then echo -e "\033[30;35m ${PWD}/acme_tiny.py 文件不存在...\033[0m" echo -e '\033[30;35m 请确认运行：wget --no-check-certificate https://github.com/diafygi/acme-tiny/master/acme_tiny.py后重试！\033[0m' exit 0 fi echo -e "\033[30;35m 正在申请https认证...\033[0m" $python_command acme_tiny.py --account-key ./account.key --csr ./domain.csr --acme-dir $web_dir/certificate/challenges > ./signed.crt || exiterr "create the http website failed,please view the issue of github doc" #NOTE: For nginx, you need to append the Let's Encrypt intermediate cert to your cert wget --no-check-certificate https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem -O intermediate.pem cat signed.crt intermediate.pem > chained.pem echo -e "\033[30;35m \n" cat << EOF 请确认是否要自动为网站配置nginx配置文件？ EOF echo -e "\033[0m" echo -e "\033[30;34m \n" cat << EOF 请输入1或2 1):不需要 2):确认 EOF echo -e "\033[0m" read -p "> " confirm_config_nginx_https if [[ $confirm_config_nginx_https -eq 2 ]]; then echo -e "\033[30;35m 正在自动为你配置nginx...\033[0m" echo -e "\033[30;34m 配置文件位置：$nginx_config_dir"/conf.d/"$nginx_web_config_file \033[0m" echo -e "\033[30;32m" cat > $nginx_config_dir"/conf.d/"$nginx_web_config_file <<EOF server { listen 80; server_name $web_domains; rewrite ^(.*) https://\$host\$1 permanent; } server { listen 443; server_name $web_domains; root $web_dir; index index.html index.htm index.php; ssl on; ssl_certificate $web_dir/certificate/chained.pem; ssl_certificate_key $web_dir/certificate/domain.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA; ssl_session_cache shared:SSL:50m; ssl_prefer_server_ciphers on; location /.well-known/acme-challenge/ { alias $web_dir/certificate/challenges/; try_files \$uri =404; } location /download { autoindex on; autoindex_exact_size off; autoindex_localtime on; } #如果是配置代理请放开以下注释即可 #location / { #proxy_pass http://120.80.99.120:20000/; #proxy_redirect off; #proxy_hide_header Vary; #proxy_set_header Accept-Encoding ''; #proxy_set_header Host $host; #proxy_set_header Referer $http_referer; #proxy_set_header Cookie $http_cookie; #proxy_set_header X-Real-IP $remote_addr; #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #} } EOF echo -e "\033[0m" else echo -e "\033[30;34m 已为你跳过自动配置Nginx,如有需要你可以手动将下面输出内容复制到对应配置文件 \033[0m" echo -e "\033[30;34m 配置文件位置：$nginx_config_dir"/conf.d/"$nginx_web_config_file \033[0m" echo -e "\033[30;32m" cat <<EOF server { listen 80; server_name $web_domains; rewrite ^(.*) https://\$host\$1 permanent; } server { listen 443; server_name $web_domains; root $web_dir; index index.html index.htm index.php; ssl on; ssl_certificate $web_dir/certificate/chained.pem; ssl_certificate_key $web_dir/certificate/domain.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA; ssl_session_cache shared:SSL:50m; ssl_prefer_server_ciphers on; location /.well-known/acme-challenge/ { alias $web_dir/certificate/challenges/; try_files \$uri =404; } location /download { autoindex on; autoindex_exact_size off; autoindex_localtime on; } #如果是配置代理请放开以下注释即可 #location / { #proxy_pass http://120.80.99.120:20000/; #proxy_redirect off; #proxy_hide_header Vary; #proxy_set_header Accept-Encoding ''; #proxy_set_header Host $host; #proxy_set_header Referer $http_referer; #proxy_set_header Cookie $http_cookie; #proxy_set_header X-Real-IP $remote_addr; #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #} } EOF echo -e "\033[0m" fi echo -e "\033[30;34m 正在自动检测网站是否存在index.html文件，不存在则新建...\033[0m" if [[ ! -f $web_dir/index.html ]]; then cat > $web_dir/index.html << EOF generate https website succssfully<br/> this is the index.html of $web_first_domain <br/> yout can visit this page from $web_domains EOF fi # current_user=$USER # current_user=$(id -un) not work for sudo echo -e "\033[30;34m 正在授权网站部署账户权限...\033[0m" current_user=$(who am i|awk '{print $1}') current_user_group=$(id -gn $current_user) chown -R $current_user:$current_user_group $web_dir chown $current_user:$current_user_group $nginx_config_dir"/conf.d/"$nginx_web_config_file chmod -R 755 $web_dir service nginx restart echo -e "\n\n" echo -e "\033[30;34m" cat << EOF 成功生成https网站! 您的网站目录是 $web_dir 您的nginx配置文件是 $nginx_config_dir/conf.d/$nginx_web_config_file 您可以通过以下这些域访问您的网站! EOF echo -e "\033[0m" for web_domain in ${web_domains[@]} do echo -e "\033[30;32m" echo https://$web_domain echo -e "\033[0m" done echo -e "\033[30;32m Let's Encrypt 证书续签配置 \033[0m" cat > $web_dir/certificate/renew_cert.bash <<EOF cd $web_dir/certificate wget --no-check-certificate https://github.com/diafygi/acme-tiny/master/acme_tiny.py -O acme_tiny.py $python_command ./acme_tiny.py --account-key ./account.key --csr ./domain.csr --acme-dir $web_dir/certificate/challenges/ > /tmp/signed.crt || exit wget --no-check-certificate -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem cat /tmp/signed.crt intermediate.pem > $web_dir/certificate/chained.pem service nginx reload EOF echo -e "\033[30;35m Let's Encrypt 证书有效期定时任务配置\033[0m" if command -v crontab > /dev/null 2>&1; then echo -e "\033[30;32m crontab 已安装!\033[0m" else echo -e "\033[30;35m crontab 未安装，将为您自动安装...\033[0m" apt-get -y install cron || yum -y install cron fi echo "1 1 1 * * root bash $web_dir/certificate/renew_cert.bash >> $web_dir/certificate/log/renew_cert_error.log 2 >> $web_dir/certificate/log/renew_cert.log" >> /etc/crontab echo -e "\033[30;35m 证书续期定时器添加成功!\033[0m" read -p '证书安装完成，请按任何键退出！' exit 0
