Let's Encrypt 的免費證書有效期為三個月，不過可以免費續期，寫一個腳本定期更新即可。
准備一台nginx 服務器 ，將以下三個附件上傳到你的nginx服務器。
1、下載腳本文件，wget https://raw.githubusercontent.com/xdtianyu/scripts/master/lets-encrypt/letsencrypt.sh//記得給予腳本755權限chmod +x letsencrypt.sh，letsencrypt.sh 是自動獲取證書的腳本，無需更改其中代碼。
2、下載腳本配置文件，wget https://raw.githubusercontent.com/xdtianyu/scripts/master/lets-encrypt/letsencrypt.conf，這里除了ACCOUNT_KEY 參數無需更改外，其他三個更改成你自己的，DOMAINS參數填入你的域名，DOMAIN_DIR 注意這個地方一定要和域名的配置目錄保持一致，否則生成證書會出錯。（這里很重要，如果這里沒設置好會報以下錯誤）
Generate account key...Generating RSA private key, 4096 bit long modulus.....................................................................++...........++e is 65537 (0x10001)Generate domain key...Generating RSA private key, 2048 bit long modulus.........+++.........................+++e is 65537 (0x10001)Generate CSR...cptest.csrParsing account key...Parsing CSR...Registering account...Registered!Verifying cptest.xxx.com...Traceback (most recent call last): File "/tmp/acme_tiny.py", line 198, inmain(sys.argv[1:])
File "/tmp/acme_tiny.py", line 194, in main
signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca)
File "/tmp/acme_tiny.py", line 123, in get_crt
wellknown_path, wellknown_url))
ValueError: Wrote file to /data/wwwroot/testing/testing_server_test/.well-known/acme-challenge/wRf1bolKp92cX4YdHKIEMf9DxGhtnP6GvvOvB6rY2F0, but couldn't download http://cptest.xxx.com/.well-known/acme-challenge/wRf1bolKp92cX4YdHKIEMf9DxGhtnP6GvvOvB6rY2F0
3、執行腳本 ./letsencrypt.sh letsencrypt.conf 生成證書，如配置正確，執行成功后，最后會出現一句：New cert: ps_beefblock_com.chained.crt has been generated ，代表成功。
4、在nginx上配置SSL:
server{
listen 443 ssl;
ssl_certificate /usr/local/ssl/ps.beefblock.com/ps_beefblock_com.crt;
ssl_certificate_key /usr/local/ssl/ps.beefblock.com/ps_beefblock_com.key;
server_name ps.beefblock.com;
location ^~ /.well-known/ #這里是配合內網穿透做的正則匹配
{
root /opt/zbox; #這里的路徑需要和DOMAIN_DIR的一致
}
location / {
proxy_pass http://192.168.5.250; #反向代理
}
}
server {
listen 80;
server_name pms.beliefblock.com;
rewrite ^(.*)$ https://pms.beliefblock.com$1 permanent; #所有http重載至https
}
5、因為Let's Encrypt證書的有效期只有90天，所以我們要定期給他更新，可以用crontab每月執行一次腳本更新：
0 0 1 * * /usr/local/ssl/ps.beefblock.com/letsencrypt.sh