Let’s Encrypt自动续期脚本
原文参考：https://www.zivers.com/post/492.html
首先复制Let’s Encrypt的样例cli文件
cp /home/certbot/examples/cli.ini /etc/letsencrypt/auto-renew.ini
vi auto-renew.ini
去除以下字段前的注释并对配置文件进行修改：
rsa-key-size = 4096
email = admin@zivers.com
domains = zivers.com, www.zivers.com
webroot-path = /var/www/zivers.com/
现在，你可以用配置化的命令执行更新操作
cd /etc/letsencrypt
./letsencrypt-auto certonly -a webroot --renew-by-default --config /etc/letsencrypt/auto-renew.ini
./letsencrypt-auto certonly -a webroot --renew-by-default --config /etc/letsencrypt/auto-renew.ini
创建自动更新脚本
于是我们可以创建一个脚本来自动执行上述操作
cd /home/shell/
vi letencrypt-auto-renew.sh
vi letencrypt-auto-renew.sh
样例脚本如下：
#!/bin/bash
cd /home/certbot
./certbot-auto certonly -a webroot --renew-by-default --config /etc/letsencrypt/auto-renew.ini
service nginx reload
cd /home/certbot
./certbot-auto certonly -a webroot --renew-by-default --config /etc/letsencrypt/auto-renew.ini
service nginx reload
赋予执行权限
chmod +x letencrypt-auto-renew.sh
加入crontab自动执行
crontab -e
0 0 1 * * /usr/shell/letsencrypt-auto-renew.sh
0 0 1 * * /usr/shell/letsencrypt-auto-renew.sh
执行这个脚本，如果正常运行则修改成功
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
root@localhost:/usr/shell# ./letsencrypt-auto-renew.sh Checkingfor new version... Requestingrootprivilegesto runcertbot... /root/.local/share/letsencrypt/bin/letsencryptcertonly -a webroot --renew-by-default --config /etc/letsencrypt/auto-renew.ini IMPORTANTNOTES: - Congratulations! Yourcertificateand chainhavebeensavedat /etc/letsencrypt/live/zivers.com-0001/fullchain.pem. Yourcertwill expireon 2016-08-23. To obtain a new versionofthecertificatein thefuture, simplyrunCertbotagain. - If youlikeCertbot, pleaseconsidersupportingourworkby: Donatingto ISRG / Let's Encrypt: https://letsencrypt.org/donate Donatingto EFF: https://eff.org/donate-le * Reloadingnginxconfigurationnginx [ OK ] |