1. 客户端生成密钥对和 CSR（证书签名请求）
2. 向 ACME 服务器请求挑战（challenge）
3. ACME 服务器返回一个 token 和验证方式
4. 客户端完成验证（放置文件 / 添加 DNS 记录）
5. ACME 服务器从外部验证
6. 验证通过后签发证书
7. 客户端下载并保存证书

   
/etc/letsencrypt/live/example.com/
├── cert.pem        -> ../../archive/example.com/cert1.pem
├── chain.pem       -> ../../archive/example.com/chain1.pem
├── fullchain.pem   -> ../../archive/example.com/fullchain1.pem
├── privkey.pem     -> ../../archive/example.com/privkey1.pem
└── README

   bash
# /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
#!/bin/bash
systemctl reload nginx

   bash
certbot renew --deploy-hook "systemctl reload nginx"

   bash
ls -la /etc/letsencrypt/renewal-hooks/deploy/
# 确认脚本存在且有执行权限

   ini
# /etc/systemd/system/certbot-renew.timer
[Unit]
Description=Run certbot renew twice daily
Documentation=https://eff-certbot.readthedocs.io/

[Timer]
OnCalendar=*-*-* 00,12:17:00
RandomizedDelaySec=3600
Persistent=true

[Install]
WantedBy=timers.target

   ini
# /etc/systemd/system/certbot-renew.service
[Unit]
Description=Certbot renewal
Documentation=https://eff-certbot.readthedocs.io/

[Service]
Type=oneshot
ExecStart=/usr/bin/certbot renew --quiet

   bash
sudo systemctl daemon-reload
sudo systemctl enable --now certbot-renew.timer
sudo systemctl list-timers certbot-renew.timer

   bash
# 查看证书详情
openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -dates -subject -issuer

   
notBefore=Sep 12 00:00:00 2026 GMT
notAfter=Dec 11 23:59:59 2026 GMT
subject=CN = example.com
issuer=C = US, O = Let's Encrypt, CN = R3

   bash
# 从远端读取证书（不校验证书有效性）
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -dates -subject

   bash
# 剩余天数计算
EXPIRY=$(openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -enddate | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "${EXPIRY}" +%s)
NOW_EPOCH=$(date +%s)
echo $(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))

   nginx
server {
    listen 443 ssl;
    http2 on;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;

    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
}

   bash
# 检查服务端返回的完整链
echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null \
  | grep -E "^ *[0-9]+ s:|^ *[0-9]+ i:"

   
 0 s:CN = example.com
   i:C = US, O = Let's Encrypt, CN = R3
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1

   
目标：证书自动续期，到期前自动更新，失败及时告警
  │
  ├─ 配置前检查
  │   ├─ 域名解析是否指向本机
  │   ├─ 80 端口是否从公网可达
  │   ├─ 现有证书的剩余有效期
  │   └─ 服务是否支持 reload
  │
  ├─ 实施步骤
  │   ├─ 安装 certbot
  │   ├─ 首次签发（手动确认）
  │   ├─ 配置 Nginx 引用证书
  │   ├─ 配置 deploy 钩子
  │   ├─ 配置定时任务
  │   └─ 配置到期监控
  │
  ├─ 生效方式
  │   ├─ reload Nginx
  │   └─ 确认进程加载新证书
  │
  ├─ 验证方法
  │   ├─ 本地文件检查
  │   ├─ 外部黑盒验证
  │   ├─ 证书链完整性
  │   ├─ 续期演练（dry-run）
  │   └─ 模拟服务重载
  │
  ├─ 风险点
  │   ├─ 续期失败导致到期
  │   ├─ reload 失败导致服务中断
  │   └─ 配置错误导致验证失败
  │
  └─ 回滚方案
      ├─ 恢复旧证书
      ├─ 恢复旧配置
      └─ 手动签发应急

   bash
# 1. 系统上所有证书文件
sudo find /etc /usr/local -name "*.pem" -o -name "*.crt" 2>/dev/null | head -50

# 2. Nginx 配置里引用的证书
sudo nginx -T 2>/dev/null | grep -E "ssl_certificate|server_name" | sort -u

# 3. Apache 配置里的证书
sudo apachectl -S 2>/dev/null
sudo grep -rE "SSLCertificateFile|SSLCertificateKeyFile" /etc/httpd/ /etc/apache2/ 2>/dev/null

# 4. 现有 certbot 管理的证书
sudo certbot certificates

# 5. 是否有其他 ACME 客户端
which acme.sh certbot 2>/dev/null
ls -la /root/.acme.sh/ 2>/dev/null

   bash
DOMAIN=example.com

# 本机的公网 IP（云环境通常需要从元数据或控制台获取）
curl -s --max-time 5 https://ifconfig.me || curl -s --max-time 5 http://ipv4.icanhazip.com

# 域名的解析结果
dig +short "${DOMAIN}" A
dig +short "www.${DOMAIN}" A

   bash
# 本机监听情况
sudo ss -lntp | grep -E ':80 |:443 '

# 防火墙
sudo firewall-cmd --list-all 2>/dev/null || sudo iptables -L INPUT -n --line-numbers | head -20

# 云安全组需要在控制台确认（命令行无法直接查）

   bash
# 从外部验证（在另一台机器上执行）
curl -s -o /dev/null -w '%{http_code}\n' --max-time 5 "http://${DOMAIN}/.well-known/acme-challenge/test"

   nginx
server {
    listen 80;
    server_name example.com;

    # 验证路径不跳转
    location /.well-known/acme-challenge/ {
        root /var/www/html;
        allow all;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

   bash
sudo certbot certificates 2>/dev/null

# 或直接看文件
sudo find /etc/letsencrypt/live -name "fullchain.pem" -exec sh -c \
  'echo "=== $1 ==="; openssl x509 -in "$1" -noout -subject -enddate' _ {} \;

   
=== /etc/letsencrypt/live/example.com/fullchain.pem ===
subject=CN = example.com
notAfter=Dec 11 23:59:59 2026 GMT

   bash
systemctl show nginx -p CanReload
# CanReload=yes

   bash
timedatectl status
# 关注 System clock synchronized: yes 和 NTP service: active

   bash
# RHEL/CentOS/openEuler/AlmaLinux/Rocky
sudo dnf install -y certbot python3-certbot-nginx
# 老版本用 yum
sudo yum install -y certbot python3-certbot-nginx

# Debian/Ubuntu
sudo apt update
sudo apt install -y certbot python3-certbot-nginx

# 用 snap（官方推荐的通用方式）
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

   bash
certbot --version
# certbot 2.x.x

   bash
DOMAIN=example.com
EMAIL=ops@example.com
WEBROOT=/var/www/html

# 确认 webroot 目录存在
sudo mkdir -p "${WEBROOT}/.well-known/acme-challenge"
sudo chown -R www-data:www-data "${WEBROOT}" 2>/dev/null || \
  sudo chown -R nginx:nginx "${WEBROOT}"

# dry-run 签发（不会真的签发，用 staging 环境）
sudo certbot certonly \
  --webroot \
  --webroot-path "${WEBROOT}" \
  -d "${DOMAIN}" \
  -d "www.${DOMAIN}" \
  --email "${EMAIL}" \
  --agree-tos \
  --no-eff-email \
  --dry-run

   
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Simulating a certificate request for example.com and www.example.com
Performing the following challenges:
http-01 challenge for example.com
http-01 challenge for www.example.com
Using the webroot path /var/www/html for all unmatched domains.
Waiting for verification...
Cleaning up challenges
The dry run was successful.

   bash
sudo certbot certonly \
  --webroot \
  --webroot-path /var/www/html \
  -d example.com \
  -d www.example.com \
  --email ops@example.com \
  --agree-tos \
  --no-eff-email \
  --keep-until-expiring

   
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/example.com/privkey.pem
This certificate expires on 2026-12-11.
These files will be updated when the certificate renews.

   bash
sudo ls -la /etc/letsencrypt/live/example.com/
sudo openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -dates -subject -issuer

   bash
sudo tail -100 /var/log/letsencrypt/letsencrypt.log

   nginx
# HTTP 端口：保留 ACME 验证路径，其余跳转 HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    location /.well-known/acme-challenge/ {
        root /var/www/html;
        allow all;
        # 不记录验证请求的日志，避免噪声
        access_log off;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS 主站
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com www.example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    add_header Strict-Transport-Security "max-age=31536000" always;

    access_log /var/log/nginx/example.com.access.log main;
    error_log  /var/log/nginx/example.com.error.log warn;

    root /var/www/example.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

   nginx
# 谨慎上线：先用短时间
add_header Strict-Transport-Security "max-age=300" always;

# 确认稳定后再改长
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

   bash
# 1. 语法检查（关键步骤，不要跳过）
sudo nginx -t

# 2. reload（不是 restart，reload 不断开现有连接）
sudo systemctl reload nginx

# 3. 确认 reload 成功
systemctl is-active nginx

   bash
sudo mkdir -p /etc/letsencrypt/renewal-hooks/deploy

   bash
#!/bin/bash
# 用途：certbot 续期成功后重载 Web 服务器
# 该脚本由 certbot 在每次成功续期后自动执行
set -euo pipefail

LOG_FILE=/var/log/letsencrypt/deploy-hook.log
TIMESTAMP="$(date '+%Y-%m-%d %H:%M:%S')"

# certbot 会传入这些环境变量
RENEWED_DOMAINS="${RENEWED_DOMAINS:-unknown}"
RENEWED_LINEAGE="${RENEWED_LINEAGE:-unknown}"

echo "[${TIMESTAMP}] 续期成功 domain=${RENEWED_DOMAINS} lineage=${RENEWED_LINEAGE}" >> "${LOG_FILE}"

# 先做语法检查，不通过就不 reload
if ! /usr/sbin/nginx -t >> "${LOG_FILE}" 2>&1; then
  echo "[${TIMESTAMP}] nginx 配置检查失败，跳过 reload" >> "${LOG_FILE}"
  exit 1
fi

# reload 而不是 restart
if systemctl reload nginx; then
  echo "[${TIMESTAMP}] nginx reload 成功" >> "${LOG_FILE}"
else
  echo "[${TIMESTAMP}] nginx reload 失败" >> "${LOG_FILE}"
  exit 1
fi

# 验证新证书已生效
NEW_EXPIRY="$(openssl x509 -in "${RENEWED_LINEAGE}/fullchain.pem" -noout -enddate 2>/dev/null | cut -d= -f2)"
echo "[${TIMESTAMP}] 新证书到期时间: ${NEW_EXPIRY}" >> "${LOG_FILE}"

exit 0

   bash
sudo chmod 0755 /etc/letsencrypt/renewal-hooks/deploy/10-reload-nginx.sh
sudo chown root:root /etc/letsencrypt/renewal-hooks/deploy/10-reload-nginx.sh
sudo touch /var/log/letsencrypt/deploy-hook.log
sudo chmod 0600 /var/log/letsencrypt/deploy-hook.log

   bash
# 手动执行一次，验证脚本本身没问题
sudo RENEWED_DOMAINS=example.com \
     RENEWED_LINEAGE=/etc/letsencrypt/live/example.com \
     /etc/letsencrypt/renewal-hooks/deploy/10-reload-nginx.sh

cat /var/log/letsencrypt/deploy-hook.log

   ini
# /etc/systemd/system/certbot-renew.service
[Unit]
Description=Certbot renewal
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/bin/certbot renew --quiet --no-random-sleep-on-renew
StandardOutput=journal
StandardError=journal

   ini
# /etc/systemd/system/certbot-renew.timer
[Unit]
Description=Run certbot renew twice daily
Documentation=https://eff-certbot.readthedocs.io/

[Timer]
OnCalendar=*-*-* 00,12:23:00
RandomizedDelaySec=1800
Persistent=true
AccuracySec=1min

[Install]
WantedBy=timers.target

   bash
sudo systemctl daemon-reload
sudo systemctl enable --now certbot-renew.timer
sudo systemctl list-timers certbot-renew.timer

   
NEXT                        LEFT       LAST                        PASSED    UNIT
Sun 2026-10-11 00:23:00 CST 9h left   Sat 2026-10-10 12:23:15 CST 2h ago    certbot-renew.timer

   bash
# /etc/cron.d/certbot-renew
SHELL=/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# 每天两次，分钟数错开整点
17 0,12 * * * root certbot renew --quiet

   bash
17 0,12 * * * root /usr/bin/certbot renew --quiet >> /var/log/letsencrypt/renew.log 2>&1

   bash
#!/bin/bash
# 用途：检查本地证书文件的到期时间，输出告警
# 设计原则：独立于 certbot，即使 certbot 完全失效也能发现到期风险
set -uo pipefail

# 配置区
CERT_DIR="${CERT_DIR:-/etc/letsencrypt/live}"
WARN_DAYS_WARN="${WARN_DAYS_WARN:-21}"
WARN_DAYS_CRIT="${WARN_DAYS_CRIT:-7}"
STATE_DIR="${STATE_DIR:-/var/lib/cert-expiry}"
LOG_FILE="${LOG_FILE:-/var/log/cert-expiry.log}"
DRY_RUN="${DRY_RUN:-0}"

mkdir -p "${STATE_DIR}"

log() {
  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" >> "${LOG_FILE}"
}

get_fingerprint() {
  # 用序列号作为证书指纹，比文件 mtime 更可靠
  openssl x509 -in "$1" -noout -serial 2>/dev/null | cut -d= -f2
}

check_cert() {
  local cert_file="$1"
  local domain
  domain="$(basename "$(dirname "${cert_file}")")"

  if [[ ! -f "${cert_file}" ]]; then
    log "WARN ${domain}: 证书文件不存在 ${cert_file}"
    return 1
  fi

  local end_date
  end_date="$(openssl x509 -in "${cert_file}" -noout -enddate 2>/dev/null | cut -d= -f2)"
  if [[ -z "${end_date}" ]]; then
    log "ERROR ${domain}: 无法解析证书到期时间"
    return 1
  fi

  local end_epoch now_epoch days_left
  end_epoch="$(date -d "${end_date}" +%s 2>/dev/null)"
  if [[ -z "${end_epoch}" ]]; then
    log "ERROR ${domain}: 无法解析日期格式: ${end_date}"
    return 1
  fi
  now_epoch="$(date +%s)"
  days_left=$(( (end_epoch - now_epoch) / 86400 ))

  # 记录证书序列号，用于检测是否真的换新了
  local serial
  serial="$(get_fingerprint "${cert_file}")"
  local state_file="${STATE_DIR}/${domain}.serial"
  local old_serial=""
  [[ -f "${state_file}" ]] && old_serial="$(cat "${state_file}")"

  echo "${serial}" > "${state_file}"

  local status="OK"
  if [[ "${days_left}" -le "${WARN_DAYS_CRIT}" ]]; then
    status="CRITICAL"
  elif [[ "${days_left}" -le "${WARN_DAYS_WARN}" ]]; then
    status="WARNING"
  fi

  local changed="no"
  if [[ -n "${old_serial}" && "${old_serial}" != "${serial}" ]]; then
    changed="yes"
  fi

  # 输出一行结构化结果，便于日志分析
  printf '%s domain=%s days_left=%d expires=%s serial_changed=%s\n' \
    "${status}" "${domain}" "${days_left}" "${end_date}" "${changed}" \
    | tee -a "${LOG_FILE}"

  case "${status}" in
    CRITICAL) return 2 ;;
    WARNING)  return 1 ;;
    *)        return 0 ;;
  esac
}

main() {
  local worst_rc=0
  local cert_file
  local found=0

  # 遍历所有 lineage
  for dir in "${CERT_DIR}"/*/; do
    cert_file="${dir}fullchain.pem"
    [[ -f "${cert_file}" ]] || continue
    found=$((found + 1))
    check_cert "${cert_file}"
    local rc=$?
    [[ ${rc} -gt ${worst_rc} ]] && worst_rc="${rc}"
  done

  if [[ "${found}" -eq 0 ]]; then
    log "ERROR 未在 ${CERT_DIR} 下找到任何证书"
    return 3
  fi

  if [[ "${DRY_RUN}" == "1" ]]; then
    log "dry-run 结束，未发送告警"
    return 0
  fi

  if [[ "${worst_rc}" -ge 2 ]]; then
    log "存在 CRITICAL 级别的证书，应触发紧急告警"
    # 在这里接入告警通道，例如：
    # curl -s -X POST "${ALERT_WEBHOOK}" -H 'Content-Type: application/json' \
    #   -d "{\"msg\":\"证书即将到期，请立即处理\"}"
  elif [[ "${worst_rc}" -ge 1 ]]; then
    log "存在 WARNING 级别的证书，应触发普通告警"
  fi

  return "${worst_rc}"
}

main "$@"

   bash
# Token 不要写死在脚本里，用环境变量或权限受控的配置文件
# /etc/cert-monitor/env （权限 0600，属主 root）
ALERT_WEBHOOK="https://alert.example.com/api/v1/alerts"
ALERT_TOKEN_FILE="/etc/cert-monitor/token"

   bash
# 脚本中读取
# shellcheck source=/dev/null
[[ -f /etc/cert-monitor/env ]] && source /etc/cert-monitor/env
TOKEN="$(cat "${ALERT_TOKEN_FILE}" 2>/dev/null || echo '')"

   ini
# /etc/systemd/system/cert-expiry-check.service
[Unit]
Description=Check certificate expiry
After=network-online.target

[Service]
Type=oneshot
EnvironmentFile=-/etc/cert-monitor/env
ExecStart=/usr/local/bin/check-cert-expiry.sh
# 退出码 1 和 2 是"发现到期风险"，属于正常告警，不是服务失败
SuccessExitStatus=0 1 2

   ini
# /etc/systemd/system/cert-expiry-check.timer
[Unit]
Description=Daily certificate expiry check

[Timer]
OnCalendar=*-*-* 08:41:00
RandomizedDelaySec=300
Persistent=true

[Install]
WantedBy=timers.target

   yaml
modules:
  https_cert:
    prober: http
    timeout: 10s
    http:
      preferred_ip_protocol: ip4
      tls_config:
        insecure_skip_verify: true    # 只关心证书有效期，不校验信任链

   yaml
scrape_configs:
  - job_name: 'blackbox-https'
    metrics_path: /probe
    params:
      module: [https_cert]
    static_configs:
      - targets:
          - https://example.com
          - https://www.example.com
          - https://api.example.com
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: 127.0.0.1:9115    # blackbox_exporter 地址

   yaml
groups:
  - name: ssl-certificate
    rules:
      - alert: SSLCertExpiringSoon
        expr: |
          (probe_ssl_earliest_cert_expiry - time()) / 86400 < 21
          and
          (probe_ssl_earliest_cert_expiry - time()) / 86400 >= 7
        for: 1h
        labels:
          severity: warning
        annotations:
          summary: "证书将在 {{ $value | printf \"%.1f\" }} 天后过期"
          description: "目标 {{ $labels.instance }} 的证书剩余有效期不足 21 天"

      - alert: SSLCertExpiringCritical
        expr: |
          (probe_ssl_earliest_cert_expiry - time()) / 86400 < 7
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "证书将在 {{ $value | printf \"%.1f\" }} 天后过期"
          description: "目标 {{ $labels.instance }} 的证书即将过期，需立即处理"

      - alert: SSLCertExpired
        expr: |
          probe_ssl_earliest_cert_expiry - time() < 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "证书已过期"
          description: "目标 {{ $labels.instance }} 的证书已过期"

      - alert: SSLCertProbeFailed
        expr: up{job="blackbox-https"} == 0
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "证书探测失败"
          description: "无法探测 {{ $labels.instance }}，可能是网络或服务问题"

   bash
# 本地文件
LOCAL_EXPIRY=$(openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -enddate | cut -d= -f2)

# 线上实际提供的
REMOTE_EXPIRY=$(echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate | cut -d= -f2)

echo "本地: ${LOCAL_EXPIRY}"
echo "线上: ${REMOTE_EXPIRY}"

   bash
sudo certbot renew --dry-run

   
Processing /etc/letsencrypt/renewal/example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator webroot, Installer None
Simulating renewal of an existing certificate for example.com and www.example.com
Waiting for verification...
Cleaning up challenges
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all simulated renewals succeeded:
  /etc/letsencrypt/live/example.com/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

   bash
sudo certbot renew --force-renewal

   bash
# 触发续期（实际上因为未到期不会真的续期，只是验证服务能跑）
sudo systemctl start certbot-renew.service
sudo journalctl -u certbot-renew.service -n 50 --no-pager

   
Certificate not yet due for renewal; no action taken.

   bash
# 手动执行钩子
sudo RENEWED_DOMAINS=example.com \
     RENEWED_LINEAGE=/etc/letsencrypt/live/example.com \
     /etc/letsencrypt/renewal-hooks/deploy/10-reload-nginx.sh

# 检查日志
sudo tail -20 /var/log/letsencrypt/deploy-hook.log

# 确认 Nginx 确实 reload 了（看进程的重启时间）
systemctl show nginx -p ActiveEnterTimestamp

   bash
# 对比前后
ps -eo pid,lstart,cmd | grep 'nginx: worker' | head

   bash
#!/bin/bash
# 用途：生成所有证书的状态报表
set -uo pipefail

OUTPUT="${1:-/tmp/cert-report-$(date +%Y%m%d).csv}"

{
  echo "domain,type,subject,issuer,not_before,not_after,days_left"
  for cert in $(sudo find /etc/letsencrypt/live -name "fullchain.pem" 2>/dev/null); do
    domain="$(basename "$(dirname "${cert}")")"
    subject="$(openssl x509 -in "${cert}" -noout -subject 2>/dev/null | sed 's/^subject=//')"
    issuer="$(openssl x509 -in "${cert}" -noout -issuer 2>/dev/null | sed 's/^issuer=//')"
    nb="$(openssl x509 -in "${cert}" -noout -startdate 2>/dev/null | cut -d= -f2)"
    na="$(openssl x509 -in "${cert}" -noout -enddate 2>/dev/null | cut -d= -f2)"
    dl=$(( ($(date -d "${na}" +%s) - $(date +%s)) / 86400 ))
    printf '%s,local,%s,%s,%s,%s,%d\n' \
      "${domain}" "${subject}" "${issuer}" "${nb}" "${na}" "${dl}"
  done

  # Nginx 配置中所有 server_name，检查是否有证书没覆盖
  sudo nginx -T 2>/dev/null | grep -E '^\s*server_name' | \
    sed 's/^\s*server_name\s*//;s/;$//' | tr ' ' '\n' | \
    grep -v '^$' | grep -v '_' | sort -u
} > "${OUTPUT}"

echo "报表已生成: ${OUTPUT}"
head -20 "${OUTPUT}"

   bash
subject="$(openssl x509 -in "${cert}" -noout -subject 2>/dev/null | sed 's/^subject=//; s/,/;/g')"

   bash
CERT=/etc/letsencrypt/live/example.com/fullchain.pem

# 基本信息
openssl x509 -in "${CERT}" -noout -subject -issuer -dates

# 包含的域名
openssl x509 -in "${CERT}" -noout -ext subjectAltName

# 序列号
openssl x509 -in "${CERT}" -noout -serial

# 指纹
openssl x509 -in "${CERT}" -noout -fingerprint -sha256

# 完整内容
openssl x509 -in "${CERT}" -noout -text

# 剩余天数
END=$(openssl x509 -in "${CERT}" -noout -enddate | cut -d= -f2)
echo $(( ($(date -d "${END}" +%s) - $(date +%s)) / 86400 )) days

   bash
# 读取远端证书（跳过验证）
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -subject -dates

# 查看完整证书链
echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null \
  | grep -E "^ *[0-9]+ s:|^ *[0-9]+ i:"

# 检查证书链验证结果
echo | openssl s_client -connect example.com:443 -servername example.com 2>&1 \
  | grep -E "Verify return code|verify error"

# 检查 TLS 版本支持
for v in tls1_2 tls1_3; do
  printf '%-8s ' "${v}"
  echo | openssl s_client -connect example.com:443 -servername example.com \
    -"${v}" 2>/dev/null | grep -q "Cipher is" && echo "OK" || echo "FAIL"
done

# 用 curl 检查（更简单）
curl -vI https://example.com 2>&1 | grep -E "SSL certificate|expire date|subject:|issuer:"
curl -sI --max-time 5 https://example.com | head -1

   bash
# 查看所有证书及到期时间
certbot certificates

# 续期所有证书
certbot renew

# 续期演练
certbot renew --dry-run

# 续期并指定钩子
certbot renew --deploy-hook "systemctl reload nginx"

# 强制续期（谨慎）
certbot renew --force-renewal

# 首次签发
certbot certonly --webroot --webroot-path /var/www/html -d example.com

# 泛域名（DNS 验证）
certbot certonly --manual --preferred-challenges dns -d "*.example.com"

# 吊销
certbot revoke --cert-path /etc/letsencrypt/live/example.com/cert.pem

# 删除证书
certbot delete --cert-name example.com

# 查看续期配置
cat /etc/letsencrypt/renewal/example.com.conf

   bash
sudo nginx -T 2>/dev/null | grep -c "example.com"

   bash
# certbot 主日志
sudo tail -100 /var/log/letsencrypt/letsencrypt.log

# 只看错误
sudo grep -iE "error|fail|traceback" /var/log/letsencrypt/letsencrypt.log | tail -30

# 续期钩子日志（自定义的）
sudo tail -50 /var/log/letsencrypt/deploy-hook.log

# systemd timer 日志
sudo journalctl -u certbot-renew.service --since "24 hours ago" --no-pager

# timer 状态
sudo systemctl list-timers certbot-renew.timer
sudo systemctl status certbot-renew.timer

# cron 日志
sudo grep -i certbot /var/log/cron
sudo grep -i CRON /var/log/syslog | grep -i certbot

   bash
ls -la /etc/logrotate.d/ | grep -i certbot
cat /etc/logrotate.d/certbot 2>/dev/null

   
/var/log/letsencrypt/*.log {
    weekly
    rotate 12
    compress
    delaycompress
    missingok
    notifempty
    create 0600 root root
}

   bash
# 配置语法检查
sudo nginx -t

# 打印完整配置（含 include）
sudo nginx -T

# 只看 ssl 相关
sudo nginx -T 2>/dev/null | grep -E "ssl_certificate|ssl_protocols|server_name"

# reload（不断连接）
sudo systemctl reload nginx

# restart（断连接）
sudo systemctl restart nginx

# 是否支持 reload
systemctl show nginx -p CanReload

# 查看 worker 进程启动时间（验证 reload 生效）
ps -eo pid,lstart,cmd | grep 'nginx: worker'

   promql
# 剩余天数
(probe_ssl_earliest_cert_expiry - time()) / 86400

# 按目标排序，找出最紧急的
sort_desc(
  (probe_ssl_earliest_cert_expiry{job="blackbox-https"} - time()) / 86400
)

# 已经过期的目标
probe_ssl_earliest_cert_expiry - time() < 0

# 探测失败的目标
up{job="blackbox-https"} == 0

# 所有目标的证书剩余天数（用于大盘）
(probe_ssl_earliest_cert_expiry - time()) / 86400 < 30

   
/etc/nginx/conf.d/
├── example.com.conf
├── api.example.com.conf
└── acme-challenge.conf

   nginx
# 所有域名的 ACME 验证统一走这里
# 放在单独的 conf 文件中，便于统一管理
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;

    # 验证路径
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/html;
        default_type "text/plain";
        allow all;
        access_log off;
    }

    # 其他请求返回 444（直接断开），避免暴露默认站
    location / {
        return 444;
    }
}

   nginx
# HTTP -> HTTPS 跳转（保留验证路径）
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/html;
        allow all;
        access_log off;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com www.example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # 协议与加密套件
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;

    # 会话
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # HSTS：首次上线先用短值
    add_header Strict-Transport-Security "max-age=300" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    access_log /var/log/nginx/example.com.access.log main;
    error_log  /var/log/nginx/example.com.error.log warn;

    root /var/www/example.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 60s;
        proxy_connect_timeout 5s;
    }
}

   nginx
listen 443 ssl;
http2 on;

   nginx
listen 443 ssl http2;

   bash
# 凭据文件，权限必须 0600
# /etc/letsencrypt/dns-credentials.ini
sudo tee /etc/letsencrypt/dns-credentials.ini > /dev/null <<'EOF'
dns_example_api_key = REPLACE_WITH_ACTUAL_KEY
dns_example_api_secret = REPLACE_WITH_ACTUAL_SECRET
EOF

sudo chmod 0600 /etc/letsencrypt/dns-credentials.ini
sudo chown root:root /etc/letsencrypt/dns-credentials.ini

   bash
sudo certbot certonly \
  --dns-example \
  --dns-example-credentials /etc/letsencrypt/dns-credentials.ini \
  -d "example.com" \
  -d "*.example.com" \
  --email ops@example.com \
  --agree-tos \
  --no-eff-email

   bash
# 安装
curl https://get.acme.sh | sh -s email=ops@example.com

# 设置默认 CA（Let's Encrypt）
~/.acme.sh/acme.sh --set-default-ca --server letsencrypt

# webroot 方式签发
~/.acme.sh/acme.sh --issue \
  -d example.com \
  -d www.example.com \
  -w /var/www/html

# 安装证书到指定位置（会自动配置续期）
~/.acme.sh/acme.sh --install-cert -d example.com \
  --key-file       /etc/nginx/ssl/example.com.key \
  --fullchain-file /etc/nginx/ssl/example.com.crt \
  --reloadcmd      "systemctl reload nginx"

# 查看已签发的证书
~/.acme.sh/acme.sh --list

   yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ops@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
      - http01:
          ingress:
            class: nginx

   yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: ops@example.com
    privateKeySecretRef:
      name: letsencrypt-staging-account-key
    solvers:
      - http01:
          ingress:
            class: nginx