如何從Nginx上的certbot獲取受信任的證書？-有解無憂

我正在嘗試在 Laravel Forge 服務器上運行 Certbot。這是我不斷收到的錯誤

nginx: [emerg] 無法加載證書 "/etc/nginx/ssl/mydomain.ca/1263486/server.crt": PEM_read_bio_X509_AUX() failed (SSL: error:0909006C:PEMroutines:get_name:no start line:Expecting: TRUSTED CERTIFICATE) nginx: 組態檔 /etc/nginx/nginx.conf 測驗失敗

根據我的理解，這意味著第一行說的是 BEGIN CERTIFICATE 而不是 TRUSTED CERTIFICATE，我怎樣才能獲得受信任的證書？下面的 Nginix 配置。

# FORGE CONFIG (DO NOT REMOVE!)
include forge-conf/mydomain.ca/before/*;

server {   
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name .mydomain.ca;
    server_tokens off;
    root /home/forge/mydomain.ca/;

# FORGE SSL (DO NOT REMOVE!)
ssl_certificate /etc/nginx/ssl/mydomain.ca/1263486/server.crt;
ssl_certificate_key /etc/nginx/ssl/mydomain.ca/1263486/server.key;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers (MY CIPHER HERE)
ssl_prefer_server_ciphers off;
ssl_dhparam /etc/nginx/dhparams.pem;

add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";

index index.html index.htm index.php;

charset utf-8;

# FORGE CONFIG (DO NOT REMOVE!)
include forge-conf/mydomain.ca/server/*;

location / {
    try_files $uri $uri/ /index.php?$query_string;
}

location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt  { access_log off; log_not_found off; }

access_log off;
error_log  /var/log/nginx/mydomain.ca-error.log error;

error_page 404 /index.php;

location ~ \.php$ {
    fastcgi_split_path_info ^(. \.php)(/. )$;
    fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
    fastcgi_index index.php;
    include fastcgi_params;
}

location ~ /\.(?!well-known).* {
    deny all;
}
}

# FORGE CONFIG (DO NOT REMOVE!)
include forge-conf/mydomain.ca/after/*;

uj5u.com熱心網友回復：

您需要按照以下步驟操作：

安裝 certbot 包
添加用于偵聽埠 80 的服務器塊

server {
    listen 80;
    server_name mydomain.ca;

    location ^~ /.well-known/acme-challenge {
        root /home/forge/certbot;
        default_type "text/plain";
        try_files $uri =404;
     }
}

修改配置上的證書路徑

ssl_certificate /etc/letsencrypt/live/mydomain.ca/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.ca/privkey.pem;

通過命令檢索證書

certbot certonly --cert-name mydomain.ca -d mydomain.ca -d *.mydomain.ca --webroot --webroot-path /home/forge/certbot

通過命令重新加載nginx配置

nginx -t && nginx -s reload

添加用于更新證書的 cron 任務

0 0 */80 * * certbot renew

轉載請註明出處，本文鏈接：https://www.uj5u.com/qukuanlian/376072.html

標籤：拉拉维尔 nginx ssl 锻造

上一篇：Nginx不壓縮網頁

下一篇：基于ChainMaker實作部署集群、部署合約、區塊鏈服務(java)