certbot apply for free SSL certificate, automatic renewal

Introduction

Let's Encrypt is a certificate authority, and Certbot is the client of Let's Encrypt. They use the ACME protocol to communicate with each other. There are other clients besides Certbot, but the official recommendation is CertBot . Certbot is a free and open source software that can automatically download from Let's Encrypt Encrypt downloads certificates, automatically renews certificates, and supports nginx/tomcat. In the past, we bought certificates from Alibaba Cloud and Tencent Cloud. With Let's Encrypt, we can save this part of the money.

Certbot is a free, open source software tool for automatically using
Let’s Encrypt certificates on manually-administrated websites to
enable HTTPS.

Let's Encrypt is a free, automated, and open certificate authority.

Let’s Encrypt is a free, automated, and open certificate authority
brought to you by the nonprofit Internet Security Research Group
(ISRG).

Install

To install certbot, you need to choose a web server and an operating system. For example, my web server is nginx, and my operating system is CentOS7. Check the CentOS version . I have to say that the documentation of Certbot is really detailed, and you can install it step by step according to the documentation. .

Briefly talk about the understanding of Certbot,

• The certificate will be automatically generated according to the domain name,
• Automatically add https configuration to nginx (optional, you can only generate certificates and manually configure nginx)
• Automatic certificate renewal, (add scheduled tasks to regularly update expired certificates)
  • View the scheduled task command,systemctl list-timers

Problems encountered during installation

When executing sudo certbot --nginxthis step, an error was reported nginx command not found. After trying it, sudo which nginxthe nginx command could not be found, because it was installed openresty. Later, it ln -s /usr/local/openresty/nginx/sbin/nginx /usr/bin/nginxwas solved by using it. In fact, a soft link/usr/bin was created in the directory to point to the real nginx command path. After working with colleagues According to the discussion, it is more reasonable to use, so that you don't have to care about the installation directory of openresty.ln -s /usr/bin/openresty /usr/bin/nginx