You've already forked certbot-dns-dnspod
Initial commit: Add DNSPod plugin for Certbot
This commit is contained in:
41
.gitignore
vendored
41
.gitignore
vendored
@@ -1,2 +1,43 @@
|
||||
.DS_Store
|
||||
.vs
|
||||
|
||||
# Python
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
*$py.class
|
||||
*.so
|
||||
.Python
|
||||
build/
|
||||
develop-eggs/
|
||||
dist/
|
||||
downloads/
|
||||
eggs/
|
||||
.eggs/
|
||||
lib/
|
||||
lib64/
|
||||
parts/
|
||||
sdist/
|
||||
var/
|
||||
wheels/
|
||||
*.egg-info/
|
||||
.installed.cfg
|
||||
*.egg
|
||||
|
||||
# Virtual Environment
|
||||
venv/
|
||||
env/
|
||||
ENV/
|
||||
|
||||
# IDE
|
||||
.idea/
|
||||
.vscode/
|
||||
*.swp
|
||||
*.swo
|
||||
|
||||
# Credentials
|
||||
credentials.ini
|
||||
*.ini
|
||||
!setup.cfg
|
||||
|
||||
# Logs
|
||||
*.log
|
||||
|
||||
205
certbot-dnspod-setup.md
Normal file
205
certbot-dnspod-setup.md
Normal file
@@ -0,0 +1,205 @@
|
||||
# Certbot DNSPod 插件配置指南
|
||||
|
||||
本文档介绍如何在 CentOS 和 Ubuntu 系统上配置 Certbot 和 DNSPod 插件，实现 SSL 证书的自动申请和续期。
|
||||
|
||||
## 系统要求
|
||||
|
||||
- CentOS 7/8 或 Ubuntu 18.04/20.04/22.04
|
||||
- Python 3.6 或更高版本
|
||||
- DNSPod 账号和域名
|
||||
- 域名 DNS 解析在 DNSPod 管理下
|
||||
|
||||
## 1. 安装必要组件
|
||||
|
||||
### CentOS
|
||||
```bash
|
||||
# 安装 Python3 和 pip3
|
||||
sudo yum install python3 python3-pip
|
||||
|
||||
# 安装 certbot
|
||||
sudo python3 -m pip install certbot
|
||||
```
|
||||
|
||||
### Ubuntu
|
||||
```bash
|
||||
# 安装 Python3 和 pip3
|
||||
sudo apt update
|
||||
sudo apt install python3 python3-pip
|
||||
|
||||
# 安装 certbot
|
||||
sudo python3 -m pip install certbot
|
||||
```
|
||||
|
||||
## 2. 安装 DNSPod 插件
|
||||
|
||||
**重要：必须使用 GitHub 源安装，避免使用 pip 或 yum 安装**
|
||||
|
||||
```bash
|
||||
# 安装 DNSPod 插件
|
||||
sudo python3 -m pip install git+https://github.com/tengattack/certbot-dns-dnspod.git
|
||||
```
|
||||
|
||||
## 3. 配置 DNSPod API 凭证
|
||||
|
||||
1. 登录 DNSPod 控制台：https://www.dnspod.cn/console/user/security
|
||||
2. 获取 API ID 和 API Token
|
||||
3. 创建凭证文件：
|
||||
|
||||
```bash
|
||||
# 创建凭证文件
|
||||
sudo mkdir -p /etc/letsencrypt
|
||||
sudo tee /etc/letsencrypt/dnspod.ini << EOF
|
||||
dns_dnspod_api_id = 你的API_ID
|
||||
dns_dnspod_api_token = 你的API_TOKEN
|
||||
EOF
|
||||
|
||||
# 设置权限
|
||||
sudo chmod 600 /etc/letsencrypt/dnspod.ini
|
||||
```
|
||||
|
||||
## 4. 申请证书
|
||||
|
||||
### 单个域名
|
||||
```bash
|
||||
certbot certonly -a dns-dnspod \
|
||||
--dns-dnspod-credentials /etc/letsencrypt/dnspod.ini \
|
||||
-d example.com
|
||||
```
|
||||
|
||||
### 包含通配符的域名
|
||||
```bash
|
||||
certbot certonly -a dns-dnspod \
|
||||
--dns-dnspod-credentials /etc/letsencrypt/dnspod.ini \
|
||||
-d example.com \
|
||||
-d "*.example.com"
|
||||
```
|
||||
|
||||
## 5. 配置 Nginx
|
||||
|
||||
### CentOS
|
||||
```bash
|
||||
# 安装 Nginx
|
||||
sudo yum install nginx
|
||||
```
|
||||
|
||||
### Ubuntu
|
||||
```bash
|
||||
# 安装 Nginx
|
||||
sudo apt install nginx
|
||||
```
|
||||
|
||||
### Nginx 配置示例
|
||||
```nginx
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name example.com *.example.com;
|
||||
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
|
||||
ssl_session_timeout 5m;
|
||||
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
location / {
|
||||
root /var/www/html;
|
||||
index index.html;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name example.com *.example.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
```
|
||||
|
||||
## 6. 配置自动续期
|
||||
|
||||
1. 创建续期后的钩子脚本：
|
||||
|
||||
```bash
|
||||
# 创建续期后的钩子脚本
|
||||
sudo tee /etc/letsencrypt/renewal-hooks/post/reload-nginx.sh << 'EOF'
|
||||
#!/bin/bash
|
||||
# CentOS
|
||||
service nginx reload
|
||||
# Ubuntu
|
||||
# systemctl reload nginx
|
||||
EOF
|
||||
|
||||
# 设置脚本权限
|
||||
sudo chmod +x /etc/letsencrypt/renewal-hooks/post/reload-nginx.sh
|
||||
```
|
||||
|
||||
2. 添加定时任务：
|
||||
|
||||
```bash
|
||||
# 编辑 crontab
|
||||
sudo crontab -e
|
||||
|
||||
# 添加以下内容（每天凌晨 2 点检查并续期）
|
||||
0 2 * * * /usr/bin/certbot renew --quiet --post-hook "service nginx reload"
|
||||
```
|
||||
|
||||
## 7. 测试配置
|
||||
|
||||
```bash
|
||||
# 测试证书续期
|
||||
certbot renew --dry-run
|
||||
|
||||
# 检查证书状态
|
||||
certbot certificates
|
||||
|
||||
# 检查 Nginx 配置
|
||||
nginx -t
|
||||
```
|
||||
|
||||
## 8. 重要文件位置
|
||||
|
||||
- 证书文件：`/etc/letsencrypt/live/example.com/`
|
||||
- 私钥文件：`/etc/letsencrypt/live/example.com/privkey.pem`
|
||||
- 完整证书链：`/etc/letsencrypt/live/example.com/fullchain.pem`
|
||||
- DNSPod 凭证：`/etc/letsencrypt/dnspod.ini`
|
||||
- 续期日志：`/var/log/letsencrypt/letsencrypt.log`
|
||||
|
||||
## 9. 故障排除
|
||||
|
||||
1. 401 错误
|
||||
- 确保使用 GitHub 源安装 DNSPod 插件
|
||||
- 检查 API 凭证是否正确
|
||||
- 确认域名在 DNSPod 管理下
|
||||
|
||||
2. 证书续期失败
|
||||
- 检查续期日志
|
||||
- 确认 DNS 解析正常
|
||||
- 验证 API 权限
|
||||
|
||||
3. Nginx 配置问题
|
||||
- 检查配置文件语法
|
||||
- 确认证书文件权限
|
||||
- 验证 Nginx 服务状态
|
||||
|
||||
## 10. 维护建议
|
||||
|
||||
1. 定期检查：
|
||||
- 证书状态
|
||||
- 续期日志
|
||||
- DNS 解析
|
||||
|
||||
2. 备份重要文件：
|
||||
- 证书文件
|
||||
- 配置文件
|
||||
- API 凭证
|
||||
|
||||
3. 监控设置：
|
||||
- 证书过期提醒
|
||||
- 续期失败通知
|
||||
- 服务状态监控
|
||||
|
||||
## 注意事项
|
||||
|
||||
1. 确保服务器时间准确
|
||||
2. 保持 Python 版本更新
|
||||
3. 定期检查证书状态
|
||||
4. 保存所有配置文件
|
||||
5. 记录重要命令和配置
|
||||
Reference in New Issue
Block a user