1、下載工具
wget https://dl.eff.org/certbot-auto
chmod a+x ./certbot-auto
2、初始化
./certbot-auto
3、獲取證書（1）
./certbot-auto certonly --manual -d *.mydomain.com --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory
將*.mydomain.com換成你的域名。
注意：mydomain.com域名必須為你自己所有，且你能操作跟它相關的DNS記錄。同時，執行certbot-auto命令的服務器必須就是mydomain.com所對應的服務器。
當我們看到類似以下信息時，就需要停一會：
-------------------------------------------------------------------------------
Please deploy a DNS TXT record under the name
_acme-challenge.mydomain.com with the following value:
xfnee7V1DS2ZlOLllasdkv-HltYfsdfahrradfU47xxs
Before continuing, verify the record is deployed.
-------------------------------------------------------------------------------
Press Enter to Continue
4、配置DNS記錄
根據第3步的信息，登錄我們的DNS控制台，添加TXT記錄：
TXT _acme-challenge.mydomain.com xfnee7V1DS2ZlOLllasdkv-HltYfsdfahrradfU47xxs
5、獲取證書（2）
等DNS信息生效后，就繼續獲取證書（1）的步驟，按下回車，系統會自動開始認證。
等待一會，如果出現以下信息，則說明證書生成成功。
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/mydomain.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/mydomain.com/privkey.pem
Your cert will expire on 2019-01-12. To obtain a new or tweaked
version of this certificate in the future, simply run certbot-auto
again. To non-interactively renew *all* of your certificates, run
"certbot-auto renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
6、使用證書
/etc/letsencrypt/live/mydomain.com/fullchain.pem
/etc/letsencrypt/live/mydomain.com/privkey.pem
復制這倆文件到正確的位置，比如nginx的配置目錄下，然后修改nginx配置文件：
server {
listen 443 ssl;
server_name www.mydomain.com;
server_name img.mydomain.com; // 這行不要加，這里是為了說明泛域名可以作用於所有二級域名。
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
location / {
root html;
}
}
7、更新證書
// 更新即將到期的證書
./certbot-auto renew
// 強制更新一個證書（這個證書也許還有很久才到期）
./certbot-auto renew --force-renewal
將更新命令加入定時任務，讓它自動更新。（如何判斷快到90天了）