You've already forked certbot-dns-dnspod
205 lines
4.1 KiB
Markdown
205 lines
4.1 KiB
Markdown
# Certbot DNSPod 插件配置指南
|
||
|
||
本文档介绍如何在 CentOS 和 Ubuntu 系统上配置 Certbot 和 DNSPod 插件，实现 SSL 证书的自动申请和续期。
|
||
|
||
## 系统要求
|
||
|
||
- CentOS 7/8 或 Ubuntu 18.04/20.04/22.04
|
||
- Python 3.6 或更高版本
|
||
- DNSPod 账号和域名
|
||
- 域名 DNS 解析在 DNSPod 管理下
|
||
|
||
## 1. 安装必要组件
|
||
|
||
### CentOS
|
||
```bash
|
||
# 安装 Python3 和 pip3
|
||
sudo yum install python3 python3-pip
|
||
|
||
# 安装 certbot
|
||
sudo python3 -m pip install certbot
|
||
```
|
||
|
||
### Ubuntu
|
||
```bash
|
||
# 安装 Python3 和 pip3
|
||
sudo apt update
|
||
sudo apt install python3 python3-pip
|
||
|
||
# 安装 certbot
|
||
sudo python3 -m pip install certbot
|
||
```
|
||
|
||
## 2. 安装 DNSPod 插件
|
||
|
||
**重要：必须使用 GitHub 源安装，避免使用 pip 或 yum 安装**
|
||
|
||
```bash
|
||
# 安装 DNSPod 插件
|
||
sudo python3 -m pip install git+https://github.com/tengattack/certbot-dns-dnspod.git
|
||
```
|
||
|
||
## 3. 配置 DNSPod API 凭证
|
||
|
||
1. 登录 DNSPod 控制台：https://www.dnspod.cn/console/user/security
|
||
2. 获取 API ID 和 API Token
|
||
3. 创建凭证文件：
|
||
|
||
```bash
|
||
# 创建凭证文件
|
||
sudo mkdir -p /etc/letsencrypt
|
||
sudo tee /etc/letsencrypt/dnspod.ini << EOF
|
||
dns_dnspod_api_id = 你的API_ID
|
||
dns_dnspod_api_token = 你的API_TOKEN
|
||
EOF
|
||
|
||
# 设置权限
|
||
sudo chmod 600 /etc/letsencrypt/dnspod.ini
|
||
```
|
||
|
||
## 4. 申请证书
|
||
|
||
### 单个域名
|
||
```bash
|
||
certbot certonly -a dns-dnspod \
|
||
--dns-dnspod-credentials /etc/letsencrypt/dnspod.ini \
|
||
-d example.com
|
||
```
|
||
|
||
### 包含通配符的域名
|
||
```bash
|
||
certbot certonly -a dns-dnspod \
|
||
--dns-dnspod-credentials /etc/letsencrypt/dnspod.ini \
|
||
-d example.com \
|
||
-d "*.example.com"
|
||
```
|
||
|
||
## 5. 配置 Nginx
|
||
|
||
### CentOS
|
||
```bash
|
||
# 安装 Nginx
|
||
sudo yum install nginx
|
||
```
|
||
|
||
### Ubuntu
|
||
```bash
|
||
# 安装 Nginx
|
||
sudo apt install nginx
|
||
```
|
||
|
||
### Nginx 配置示例
|
||
```nginx
|
||
server {
|
||
listen 443 ssl;
|
||
server_name example.com *.example.com;
|
||
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
|
||
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
|
||
ssl_session_timeout 5m;
|
||
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_prefer_server_ciphers on;
|
||
|
||
location / {
|
||
root /var/www/html;
|
||
index index.html;
|
||
}
|
||
}
|
||
|
||
server {
|
||
listen 80;
|
||
server_name example.com *.example.com;
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
```
|
||
|
||
## 6. 配置自动续期
|
||
|
||
1. 创建续期后的钩子脚本：
|
||
|
||
```bash
|
||
# 创建续期后的钩子脚本
|
||
sudo tee /etc/letsencrypt/renewal-hooks/post/reload-nginx.sh << 'EOF'
|
||
#!/bin/bash
|
||
# CentOS
|
||
service nginx reload
|
||
# Ubuntu
|
||
# systemctl reload nginx
|
||
EOF
|
||
|
||
# 设置脚本权限
|
||
sudo chmod +x /etc/letsencrypt/renewal-hooks/post/reload-nginx.sh
|
||
```
|
||
|
||
2. 添加定时任务：
|
||
|
||
```bash
|
||
# 编辑 crontab
|
||
sudo crontab -e
|
||
|
||
# 添加以下内容（每天凌晨 2 点检查并续期）
|
||
0 2 * * * /usr/bin/certbot renew --quiet --post-hook "service nginx reload"
|
||
```
|
||
|
||
## 7. 测试配置
|
||
|
||
```bash
|
||
# 测试证书续期
|
||
certbot renew --dry-run
|
||
|
||
# 检查证书状态
|
||
certbot certificates
|
||
|
||
# 检查 Nginx 配置
|
||
nginx -t
|
||
```
|
||
|
||
## 8. 重要文件位置
|
||
|
||
- 证书文件：`/etc/letsencrypt/live/example.com/`
|
||
- 私钥文件：`/etc/letsencrypt/live/example.com/privkey.pem`
|
||
- 完整证书链：`/etc/letsencrypt/live/example.com/fullchain.pem`
|
||
- DNSPod 凭证：`/etc/letsencrypt/dnspod.ini`
|
||
- 续期日志：`/var/log/letsencrypt/letsencrypt.log`
|
||
|
||
## 9. 故障排除
|
||
|
||
1. 401 错误
|
||
- 确保使用 GitHub 源安装 DNSPod 插件
|
||
- 检查 API 凭证是否正确
|
||
- 确认域名在 DNSPod 管理下
|
||
|
||
2. 证书续期失败
|
||
- 检查续期日志
|
||
- 确认 DNS 解析正常
|
||
- 验证 API 权限
|
||
|
||
3. Nginx 配置问题
|
||
- 检查配置文件语法
|
||
- 确认证书文件权限
|
||
- 验证 Nginx 服务状态
|
||
|
||
## 10. 维护建议
|
||
|
||
1. 定期检查：
|
||
- 证书状态
|
||
- 续期日志
|
||
- DNS 解析
|
||
|
||
2. 备份重要文件：
|
||
- 证书文件
|
||
- 配置文件
|
||
- API 凭证
|
||
|
||
3. 监控设置：
|
||
- 证书过期提醒
|
||
- 续期失败通知
|
||
- 服务状态监控
|
||
|
||
## 注意事项
|
||
|
||
1. 确保服务器时间准确
|
||
2. 保持 Python 版本更新
|
||
3. 定期检查证书状态
|
||
4. 保存所有配置文件
|
||
5. 记录重要命令和配置 |