最近使用了acme.sh 生產了 Let's Encrypt 的https 證書，但是在實際服務器上測試遇到如下問題
$ curl "https://www.aaa.com" 如下錯誤 curl: (60) Peer's Certificate issuer is not recognized. More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option
最開始我還以為是我服務器配置哪里出錯了。后來測試了下其他國內的域名都可以訪問，我就想到應該是https證書配置這塊問題。后來查詢了一些資料是我自己nginx 關於https配置不對導致的
server {
listen 443 ssl;
ssl_certificate /home/www/.acme.sh/xxxxx/xxxx.cer;
ssl_certificate_key /home/www/.acme.sh/xxxxx/xxxx.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
ssl_session_cache shared:SSL:50m;
}
其中
ssl_certificate /home/www/.acme.sh/xxxxx/xxxx.cer; 錯誤
ssl_certificate /home/www/.acme.sh/xxxxx/fullchain.cer; 正確
原文地址： 修復Linux下curl等無法使用 Let's Encrypt 證書
標簽： curl Certificate https