生成证书
docker-compose run --rm certbot certonly --manual --preferred-challenges=dns --email service@qq.com --agree-tos --expand -d abc.com,*.abc.com --server https://acme-v02.api.letsencrypt.org/directory
在生成证书过程中,会提示你设置一个域名(TXT)解析,来验证域名所有权,根据提示操作即可。还有一种 webroot的方式,不需要通过域名解析来验证域名所有权,但是不支持泛域名解析,在此不采用。
生成Perfect Forward Security(PFS)键值
PFS(perfect forward secrecy),中文可叫做完全前向保密。要求一个密钥只能访问由它所保护的数据;用来产生密钥的元素一次一换,不能再产生其他的密钥;一个密钥被破解,并不影响其他密钥的安全性。
#创建目录
mkdir /etc/ssl/private/ -p
#执行命令
cd /etc/ssl/private/
openssl dhparam 2048 -out dhparam.pem
nginx配置文件修改
server {
listen 80;
listen [::]:80;
server_name example.org www.example.org;
server_tokens off;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location / {
return 301 https://example.org$request_uri;
}
}
docker compose文件修改
version: '3'
services:
nginx:
image: nginx:1.8.1
ports: #端口映射
- "80:80"
- "443:443"
command: [ "/bin/sh", "-c", "while :;do sleep 24h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"" ]
volumes:
- "${PWD}/nginx/nginx.conf:/etc/nginx/nginx.conf"
- "${PWD}/nginx/conf.d:/etc/nginx/conf.d" #将宿主机上nginx配置文件映射到容器中
- "${PWD}/dataweb/abc:/var/www/html/abc" #映射网站根目录
- "${PWD}/nginx/log:/var/log/nginx"
- ./certbot/conf:/etc/letsencrypt
- ./certbot/www:/var/www/certbot
- /etc/ssl:/etc/ssl
networks:
- app_net
container_name: "compose-nginx" #容器名称
certbot:
container_name: certbot
image: certbot/certbot:latest
# command: certonly --webroot --webroot-path=/var/www/certbot --agree-tos --email service@qq.com -d abc.com
#entrypoint: ["/bin/sh", "-c", "trap exit TERM;while :; do certbot renew --webroot -w /var/www/certbot; sleep 24h & wait $${!}; done;"]
volumes:
- ./certbot/conf:/etc/letsencrypt
- ./certbot/logs:/var/log/letsencrypt
- ./certbot/www:/var/www/certbot
nginx的ssl配置
首先增加443端口的监听,然后在conf文件中增加一个server指令,以前写在80的server中的设置都写在这个server中,并且在80端口的server中设置跳转,将http请求跳转到https
server {
listen 80;
server_name abc.com;
return 301 https://abc.com$request_uri;
location ~ /.well-known/acme-challenge {
allow all;
root /var/www/certbot;
}
}
server {
listen 443 ssl default_server;
server_name abc.com;
server_tokens off;
access_log /var/log/nginx/abc.com.access.log main;
index index.php index.html index.htm;
ssl_session_timeout 5m;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_stapling on;
ssl_stapling_verify on;
ssl_certificate /etc/letsencrypt/live/xiaocilao.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/xiaocilao.com/privkey.pem;
ssl_dhparam /etc/ssl/private/dhparam.pem;
#charset koi8-r;
#access_log logs/host.gaoxueping.log main;
root /var/www/html/abc;
location / {
try_files $uri $uri/ /index.php?q=$uri&$args;
#if (!-e $request_filename){
#rewrite ^(.*)$ /index.php?s=$1 last;
#break;
#}
index index.php index.html index.htm;
}
error_page 404 /404.html;
location = /404.html {
root /usr/share/nginx/html;
}
# redirect server error pages to the static page /50x.html
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /var/www/html/abc;
}
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_pass php7:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
location ~ /\. {
deny all;
}
location ~ /\.ht {
deny all;
}
}
自动更新
可以在docker compose中设置commond来自动定时更新。
Reference
Boilerplate for nginx with Let’s Encrypt on docker-compose
HTTPS using Nginx and Let's encrypt in Docker