腾讯云使用certbot为Nginx申请和续期泛域名SSL证书-此间少年

1.创建API秘钥

因为我们是要申请泛域名的证书，所以需要执行DNS-01 挑战，需要在腾讯云控制台中申请DNS解析的秘钥

把获取到的SecretId和SecretKey写入到配置文件中：

cat > ~/docker/certbot/tencent.ini <<EOF
dns_tencentcloud_secret_id = YOUR_SECRET_ID
dns_tencentcloud_secret_key = YOUR_SECRET_KEY
EOF

2.创建证书

2.1 创建 Dockerfile

cat > ~/docker/certbot/Dockerfile <<'EOF'
FROM certbot/certbot:v5.1.0

# 安装腾讯云 DNS 插件
RUN pip install --no-cache-dir certbot-dns-tencentcloud

# 设置默认工作目录
WORKDIR /etc/letsencrypt
EOF

2.2 构建镜像

cd ~/docker/certbot
docker build -t certbot-tencentcloud:v5.1.0 .

2.3 使用新镜像创建证书

docker run -it --rm \
-v ~/docker/certbot/letsencrypt:/etc/letsencrypt \
-v ~/docker/certbot/tencent.ini:/tencent.ini:ro \
certbot-tencentcloud:v5.1.0 certonly \
--authenticator dns-tencentcloud \
--dns-tencentcloud-credentials /tencent.ini \
--dns-tencentcloud-propagation-seconds 120 \
--server https://acme-v02.api.letsencrypt.org/directory \
-d "*.cdhr6.com" \
--agree-tos \
--email 195822080@qq.com

3.在nginx中使用证书

server {
    listen 80;
    server_name blog.cdhr6.com;

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    http2 on;
    server_name blog.cdhr6.com;

    # 设置证书
    ssl_certificate     /etc/letsencrypt/live/cdhr6.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cdhr6.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    client_max_body_size 10m;

    location / {
        proxy_pass http://localhost:8090;

        proxy_set_header Host                $http_host;
        proxy_set_header X-Real-IP           $remote_addr;
        proxy_set_header X-Forwarded-For     $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto   https;
    }
}

把刚才生成的证书配置到Nginx中

4.自动续期

Let’s Encrypt 有效期是 90 天，我们需要让 Certbot 自动续期

4.1 创建自动续期容器：

docker create \
--name certbot-renew \
-v ~/docker/certbot/letsencrypt:/etc/letsencrypt \
-v ~/docker/certbot/tencent.ini:/tencent.ini:ro \
certbot-tencentcloud:v5.1.0 \
renew \
--authenticator dns-tencentcloud \
--dns-tencentcloud-credentials /tencent.ini \
--dns-tencentcloud-propagation-seconds 120

4.2 添加crontab定时器：

0 3 * * * docker start certbot-renew && docker exec nginx nginx -s reload

每天凌晨 3 点启动一次 Certbot renew 容器,如果证书续期成功 → reload Nginx

4.3 模拟续期功能是否正常：

docker run -it --rm \
-v ~/docker/certbot/letsencrypt:/etc/letsencrypt \
-v ~/docker/certbot/tencent.ini:/tencent.ini:ro \
certbot-tencentcloud:v5.1.0 \
renew --dry-run \
--authenticator dns-tencentcloud \
--dns-tencentcloud-credentials /tencent.ini \
--dns-tencentcloud-propagation-seconds 120 \
--dns-tencentcloud-debug true