克隆脚本

sudo git clone https://github.com/diafygi/acme-tiny.git  
cd acme-tiny

创建Let's Encrypt私钥

openssl genrsa 4096 > account.key

创建CSR(Certificate Signing Request，证书签名请求) 文件

将需要加密的域名加到下面的代码中，目前一张证书最多可以加密 100 个域名：

openssl genrsa 4096 > domain.key     
openssl req -new -sha256 -key domain.key -subj "/" -reqexts SAN -config <(cat /etc/pki/tls/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:yoursite.com,DNS:www.yoursite.com")) > domain.csr

证明你拥有该域名

手动生成challenges目录，用来存放验证文件（路径可以根据需要修改）

mkdir -p /var/www/challenges

配置nignx的80端口

server {
    listen 80;
    server_name yoursite.com www.yoursite.com;
    location /.well-known/acme-challenge/ {
        alias /var/www/challenges/;
        try_files $uri =404;
    }
}

获取签名证书

sudo chmod +x acme_tiny.py  
python acme_tiny.py --account-key ./account.key --csr ./domain.csr --acme-dir /var/www/challenges/ > ./signed.crt

安装证书

针对nginx, 你还需要将 Let's Encrypt 的中间件证书 intermediate.pem 内容附加在签名证书signed.crt之后：

wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem  
cat signed.crt intermediate.pem > chained.pem

server {
    listen 443;
    server_name yoursite.com www.yoursite.com;

    ssl on;
    ssl_certificate /path/to/chained.pem;
    ssl_certificate_key /path/to/domain.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
    ssl_session_cache shared:SSL:50m;
    ssl_prefer_server_ciphers on;

    #...你的其他配置
}

证书自动更新定时任务

#!/usr/bin/sh

python /path/to/acme_tiny.py --account-key /path/to/account.key --csr /path/to/domain.csr --acme-dir /var/www/challenges/ > /tmp/signed.crt || exit

wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem

cat /tmp/signed.crt intermediate.pem > /path/to/chained.pem

service nginx reload

定时任务可以设置为每个月执行一次：

0 0 1 * * /path/to/renew_cert.sh 2>> /var/log/acme_tiny.log

设置网站跳转

location / {
    if ($host = "cjango.com") {
        return 301 https://www.cjango.com$request_uri;
    }
}