证书管理¶

# ubuntu
apt install -y ca-certificates
curl -s -o /usr/local/share/ca-certificates/xx.crt http://m.8ops.top/cert/xx.crt
md5sum /usr/local/share/ca-certificates/xx.crt
update-ca-certificates

# centos
yum install -y ca-certificates
curl -s -o /etc/pki/ca-trust/source/anchors/xx.crt http://m.8ops.top/cert/xx.crt
md5sum /etc/pki/ca-trust/source/anchors/xx.crt
update-ca-trust

openssl x509 -noout -text -in root.pem

openssl pkcs12 -in root.p12  | \
    openssl x509 -noout -text

openssl x509 -noout -enddate -startdate -in root.crt
openssl x509 -noout -dates -in root.crt

# 通过命令行获取网站SSL证书
# SNI Server Name Indication
# 当一台服务器（相同的IP地址和TCP端口号）同时托管多个域名时，可通过servername参数明文发送主机名称。

echo | \
    openssl s_client -showcerts -connect books.8ops.top:443 | \
    openssl x509 -noout -dates

echo | \
    openssl s_client -showcerts -connect books.8ops.top:443 -servername books.8ops.top | \
    openssl x509 -noout -dates

# 基本信息
echo | \
    openssl s_client -showcerts -connect books.8ops.top:443 -servername books.8ops.top | \
    openssl x509 -noout

# 签发时间 含 startdate + enddate
echo | \
    openssl s_client -showcerts -connect books.8ops.top:443 -servername books.8ops.top | \
    openssl x509 -noout -dates

# 详情
echo | \
    openssl s_client -showcerts -connect books.8ops.top:443 -servername books.8ops.top

echo | \
    openssl s_client -showcerts -connect books.8ops.top:443 -servername books.8ops.top | \
    openssl x509 -noout -text

# 检测OCSP状态
echo "" | \
    openssl s_client -connect books.8ops.top:443 -status 2>/dev/null | \
    grep -i OCSP

# 已启用
# OCSP Response Status: successful (0x0)

# 未启用
# OCSP response: no response sent
# openssl 版本
openssl version -a

openssl genrsa -out server.key 1024

openssl req -new -x509 -days 3650 -key server.key -out server.crt -subj "/C=CN/ST=OPS/L=OPS/O=OPS/OU=OPS/CN=ops.top/CN=*.8ops.top"

openssl genrsa -out server.key 1024

openssl req -new -key server.key -out server.csr

openssl x509 -req -in server.csr -out server.crt -signkey server.key -days 3650

openssl req -new -x509 -keyout server.key -out server.crt -config openssl.cnf

openssl genrsa -out autobestdevops.com.key 2048

openssl req -new -key autobestdevops.com.key -out autobestdevops.com.csr

# install
git clone https://github.com/acmesh-official/acme.sh.git .acme.sh

BASHRC_FILE=.bashrc
[ -e ${BASHRC_FILE} ] || touch ${BASHRC_FILE}
grep -q acme.sh ${BASHRC_FILE} || cat <<EOF >> ${BASHRC_FILE}
# acme.sh
export LE_WORKING_DIR="/root/.acme.sh"
alias acme.sh="/root/.acme.sh/acme.sh"
EOF
. .bashrc
acme.sh --version

# 是指 DNSpod Token
export DP_Id=
export DP_Key=

# register https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA
acme.sh --register-account -m email --server zerossl
acme.sh --set-default-ca  --server zerossl

# issue 
# 可能需要 FW
acme.sh --issue \
    -d 8ops.top \
    -d "*.8ops.top" \
    --dns dns_dp \
    --debug 2

# install
acme.sh --install-cert \
    -d 8ops.top \
    --key-file /etc/nginx/ssl.d/8ops.top.key \
    --fullchain-file /etc/nginx/ssl.d/8ops.top.crt \
    --reloadcmd "systemctl reload nginx"

# renew
acme.sh --renew -d 8ops.top -f

# crontab
0 4 * * 1 "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

# 报错内容
[Wed Jan  3 15:39:57 CST 2024] Error, can not get domain token "type":"dns-01","url":"https://acme.zerossl.com/v2/DV90/chall/eERxBZpE7gEEy08C301sfQ","status":"invalid","error":{

# 尝试切换签发主体，猜测签发主体因某种原因未成功签发
acme.sh --issue ....   --server  zerossl
# 变更为
acme.sh --issue ....   --server  letsencrypt

https://github.com/acmesh-official/acme.sh/wiki/Server