鄂尔多斯建设招投标网站百度sem认证

使用 acme.sh 申请并安装 SSL 证书

本文将辅助您通过 acme.sh 工具申请并安装 Let’s Encrypt 的免费 SSL 证书。

---

环境准备

• 可访问公网的服务器。
• 已安装 Nginx （本文以此，其它类似），并确保 80 端口可正常访问。
• 拥有域名解析权，确保域名指向服务器 IP。
• 愿意在你的服务器上面执行五条命令

---

SSL 检测工具–效果图

步骤 1：安装 acme.sh

执行以下命令安装 acme.sh：

curl https://get.acme.sh | sh

效果展示：

[root@instance-sp608fvo tmp]# curl https://get.acme.sh | sh% Total    % Received % Xferd  Average Speed   Time    Time     Time  CurrentDload  Upload   Total   Spent    Left  Speed
100  1032    0  1032    0     0    399      0 --:--:--  0:00:02 --:--:--   399% Total    % Received % Xferd  Average Speed   Time    Time     Time  CurrentDload  Upload   Total   Spent    Left  Speed
100  221k  100  221k    0     0  13834      0  0:00:16  0:00:16 --:--:-- 11956
[Thu Jun 12 12:33:51 CST 2025] Installing from online archive.
[Thu Jun 12 12:33:51 CST 2025] Downloading https://github.com/acmesh-official/acme.sh/archive/master.tar.gz
[Thu Jun 12 12:33:59 CST 2025] Extracting master.tar.gz
[Thu Jun 12 12:33:59 CST 2025] It is recommended to install socat first.
[Thu Jun 12 12:33:59 CST 2025] We use socat for the standalone server, which is used for standalone mode.
[Thu Jun 12 12:33:59 CST 2025] If you don't want to use standalone mode, you may ignore this warning.
[Thu Jun 12 12:33:59 CST 2025] Installing to /root/.acme.sh
[Thu Jun 12 12:33:59 CST 2025] Installed to /root/.acme.sh/acme.sh
[Thu Jun 12 12:33:59 CST 2025] Installing alias to '/root/.bashrc'
[Thu Jun 12 12:33:59 CST 2025] Close and reopen your terminal to start using acme.sh
[Thu Jun 12 12:33:59 CST 2025] Installing alias to '/root/.cshrc'
[Thu Jun 12 12:33:59 CST 2025] Installing alias to '/root/.tcshrc'
[Thu Jun 12 12:33:59 CST 2025] Installing cron job
[Thu Jun 12 12:33:59 CST 2025] bash has been found. Changing the shebang to use bash as preferred.
[Thu Jun 12 12:34:01 CST 2025] OK
[Thu Jun 12 12:34:01 CST 2025] Install success!

步骤 2：设置默认 CA

指定使用 Let’s Encrypt 作为默认证书颁发机构：

source ~/.bashrc
acme.sh --set-default-ca --server letsencrypt

效果展示：

[root@instance-sp608fvo ~]# source ~/.bashrc
[root@instance-sp608fvo ~]# acme.sh --set-default-ca --server letsencrypt
[Thu Jun 12 12:40:46 CST 2025] Changed default CA to: https://acme-v02.api.letsencrypt.org/directory

步骤 3：申请证书

使用 --webroot 模式申请证书。确保域名已正确解析到服务器，并且 /usr/share/nginx/html 是 Nginx 的默认根目录。

acme.sh --issue  -d 域名比如baidu.com --webroot 80端口可访问地址比如/usr/share/nginx/html

示例：

acme.sh --issue -d     test.example.com --webroot /usr/share/nginx/html

效果展示：

[root@instance-sp608fvo nginx]# acme.sh --issue  -d     test.example.com --webroot /usr/share/nginx/html
[Thu Jun 12 12:49:54 CST 2025] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Thu Jun 12 12:49:54 CST 2025] Creating domain key
[Thu Jun 12 12:49:54 CST 2025] The domain key is here: /root/.acme.sh/    test.example.com_ecc/    test.example.com.key
[Thu Jun 12 12:49:54 CST 2025] Single domain='test.example.com'
[Thu Jun 12 12:50:01 CST 2025] Getting webroot for domain='test.example.com'
[Thu Jun 12 12:50:01 CST 2025] Verifying: test.example.com
[Thu Jun 12 12:50:03 CST 2025] Pending. The CA is processing your order, please wait. (1/30)
[Thu Jun 12 12:50:08 CST 2025] Success
[Thu Jun 12 12:50:08 CST 2025] Verification finished, beginning signing.
[Thu Jun 12 12:50:08 CST 2025] Let's finalize the order.
[Thu Jun 12 12:50:08 CST 2025] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/2459862082/393925191632'
[Thu Jun 12 12:50:12 CST 2025] Downloading cert.
[Thu Jun 12 12:50:12 CST 2025] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/06c810fa50377b7f67b3bafe5d77ae908659'
[Thu Jun 12 12:50:14 CST 2025] Cert success.

步骤 4：安装证书

将申请的证书安装到 Nginx，并设置自动重载配置。

acme.sh --install-cert -d <您的域名> \
--key-file /etc/pki/nginx/<您的域名>.key \
--fullchain-file /etc/pki/nginx/<您的域名>.pem \
--reloadcmd "nginx -s reload"

示例：

acme.sh --install-cert -d     test.example.com \
--key-file /etc/pki/nginx/    test.example.com.key \
--fullchain-file /etc/pki/nginx/    test.example.com.pem \
--reloadcmd "nginx -s reload"

效果展示：

[root@instance-sp608fvo nginx]# acme.sh --install-cert -d     test.example.com \
> --key-file /etc/pki/nginx/    test.example.com.key \
> --fullchain-file /etc/pki/nginx/    test.example.com.pem \
> --reloadcmd "nginx -s reload"
[Thu Jun 12 12:55:56 CST 2025] The domain 'test.example.com' seems to already have an ECC cert, let's use it.
[Thu Jun 12 12:55:56 CST 2025] Installing key to: /etc/pki/nginx/    test.example.com.key
[Thu Jun 12 12:55:56 CST 2025] Installing full chain to: /etc/pki/nginx/    test.example.com.pem
[Thu Jun 12 12:55:56 CST 2025] Running reload cmd: nginx -s reload
[Thu Jun 12 12:55:56 CST 2025] Reload successful

步骤 5：检查自动续期配置

查看 cron 任务

确保 acme.sh 的自动续期任务已添加到系统的定时任务中：

crontab -l
acme.sh --cron --home "/root/.acme.sh"

效果展示：

[root@instance-sp608fvo nginx]# crontab -l
* * * * * /opt/heyeAgent/bin/upgrade &>/dev/null
59 9 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null
[root@instance-sp608fvo nginx]# acme.sh --cron --home "/root/.acme.sh"
[Thu Jun 12 14:07:39 CST 2025] ===Starting cron===
[Thu Jun 12 14:07:39 CST 2025] Renewing: 'test.example.com'
[Thu Jun 12 14:07:39 CST 2025] Renewing using Le_API=https://acme-v02.api.letsencrypt.org/directory
[Thu Jun 12 14:07:39 CST 2025] Skipping. Next renewal time is: 2025-08-10T04:50:14Z
[Thu Jun 12 14:07:39 CST 2025] Add '--force' to force renewal.
[Thu Jun 12 14:07:39 CST 2025] Skipped     test.example.com_ecc
[Thu Jun 12 14:07:39 CST 2025] ===End cron===

如果需要强制续期，可以添加 --force 参数-未进行测试：

acme.sh --renew -d <您的域名> --force

完成

至此，已成功使用 acme.sh 为您的域名申请并安装了 SSL 证书。Nginx 将自动加载新的证书，并且 acme.sh 会在证书过期前自动续期。