服务器SSL证书安装教程

# 创建证书目录并限制权限
sudo mkdir -p /etc/ssl/private /etc/ssl/certs
sudo chmod 700 /etc/ssl/private

# 方式一：一条命令同时生成 2048 位私钥与 CSR（推荐 RSA 2048 或 ECDSA P-256）
openssl req -new -newkey rsa:2048 -nodes \
  -keyout /etc/ssl/private/example.com.key \
  -out /etc/ssl/certs/example.com.csr \
  -subj "/C=CN/ST=Guangdong/L=Shenzhen/O=Example Tech Co., Ltd./OU=IT Dept/CN=example.com"

# 方式二：已有私钥，用配置文件追加 SAN 后再生成 CSR（多域名/通配符必用）
cat > /tmp/openssl.cnf <<'EOF'
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
C  = CN
ST = Guangdong
L  = Shenzhen
O  = Example Tech Co., Ltd.
CN = example.com

[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = example.com
DNS.2 = www.example.com
DNS.3 = *.example.com
EOF

openssl req -new -sha256 \
  -key /etc/ssl/private/example.com.key \
  -out /etc/ssl/certs/example.com.csr \
  -config /tmp/openssl.cnf

# 查看 CSR 内容，重点确认 CN 与 SAN
openssl req -in /etc/ssl/certs/example.com.csr -noout -text | grep -A2 "Subject Alternative Name"
openssl req -in /etc/ssl/certs/example.com.csr -noout -subject

# 校验私钥格式与强度
openssl rsa -in /etc/ssl/private/example.com.key -check -noout

# 合并顺序必须是：域名证书在前，中间证书在后
cat example.com.crt ca_bundle.crt > /etc/ssl/certs/example.com_fullchain.crt

# 校验私钥与证书的公钥是否匹配（三条命令输出必须完全一致）
openssl x509 -noout -modulus -in /etc/ssl/certs/example.com_fullchain.crt | openssl md5
openssl rsa  -noout -modulus -in /etc/ssl/private/example.com.key          | openssl md5
openssl req  -noout -modulus -in /etc/ssl/certs/example.com.csr            | openssl md5

# 校验整条证书链是否完整
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/example.com_fullchain.crt
# 期望输出：example.com_fullchain.crt: OK

# HTTP 全部 301 跳 HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;                       # Nginx 1.25.1+ 用此写法；旧版本写 listen 443 ssl http2
    server_name example.com www.example.com;

    ssl_certificate     /etc/ssl/certs/example.com_fullchain.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;

    # 仅 TLS 1.2/1.3，禁用已废弃协议
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # 会话复用：降低握手开销
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # OCSP Stapling：把证书状态查询结果随握手返回，加快验证
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 223.5.5.5 8.8.8.8 valid=300s;
    resolver_timeout 5s;

    # HSTS：告诉浏览器半年内只用 HTTPS 访问（上线稳定后再开，回退成本高）
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains" always;

    root /var/www/example.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

sudo nginx -t && sudo systemctl reload nginx

# 在线验证握手与链完整性（看 Verify return code 是否为 0）
openssl s_client -connect example.com:443 -servername example.com /dev/null | openssl x509 -noout -dates -subject -issuer

# 用 SSL Labs 在线评分（目标 A 及以上）
# https://www.ssllabs.com/ssltest/analyze.html?d=example.com

sudo a2enmod ssl ssl_session_cache headers
sudo systemctl restart apache2

    ServerName example.com
    ServerAlias www.example.com
    Redirect permanent / https://example.com/



    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example.com

    SSLEngine on
    SSLCertificateFile      /etc/ssl/certs/example.com.crt
    SSLCertificateKeyFile   /etc/ssl/private/example.com.key
    SSLCertificateChainFile /etc/ssl/certs/ca_bundle.crt

    SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
    SSLHonorCipherOrder     off
    SSLSessionTickets       off

    
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    

# 1) 合成 PKCS12（-name 指定别名，下一步要用）
openssl pkcs12 -export \
  -inkey /etc/ssl/private/example.com.key \
  -in /etc/ssl/certs/example.com.crt \
  -certfile /etc/ssl/certs/ca_bundle.crt \
  -name tomcat \
  -out /etc/ssl/private/example.com.p12
# 会提示设置导出密码，务必记录

# 2) 转成 Java Keystore（Tomcat 10 推荐直接使用 PKCS12，无需转 JKS）
keytool -importkeystore \
  -srckeystore /etc/ssl/private/example.com.p12 -srcstoretype PKCS12 \
  -destkeystore /etc/ssl/private/example.com.jks -deststoretype JKS \
  -srcalias tomcat -destalias tomcat

# 1) 先在 OpenSSL 侧生成 PFX（也可在 Linux 上生成后传到 Windows）
# openssl pkcs12 -export -out example.com.pfx -inkey example.com.key -in example.com.crt -certfile ca_bundle.crt

# 2) 以管理员权限 PowerShell 导入到本地计算机证书存储的 "My" 容器
$pwd = ConvertTo-SecureString -String "你的导出密码" -Force -AsPlainText
Import-PfxCertificate -FilePath C:\cert\example.com.pfx `
    -CertStoreLocation Cert:\LocalMachine\My -Password $pwd -Exportable

# 3) 绑定到 IIS 站点（WebAdministration 模块）
Import-Module WebAdministration
$binding = Get-WebBinding -Name "Default Web Site" -Protocol "https"
if (-not $binding) {
    New-WebBinding -Name "Default Web Site" -Protocol "https" -Port 443 -SslFlags 1
}
$binding = Get-WebBinding -Name "Default Web Site" -Protocol "https"
$binding.AddSslCertificate("证书指纹Thumbprint", "my")

# 4) 禁用老旧协议（写入注册表后需重启）
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Name "Enabled" -Value 0

# 1) 查看服务端实际下发了几张证书。返回 1 张说明缺中间证书
openssl s_client -connect example.com:443 -servername example.com -showcerts /dev/null | grep -c "BEGIN CERTIFICATE"

# 2) 检查主题（subject）与颁发者（issuer）能否首尾相接
openssl s_client -connect example.com:443 -servername example.com /dev/null | openssl x509 -noout -subject -issuer

# 3) 验证握手状态（Verify return code: 0 (ok) 才算通过）
openssl s_client -connect example.com:443 -servername example.com /dev/null | grep "Verify return code"

#!/usr/bin/env bash
# /opt/scripts/check-cert-expiry.sh —— 每天检查证书剩余天数，低于阈值发告警
DAYS_LEFT=$(echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate 2>/dev/null \
  | awk -F'=' '{cmd="date -d \""$2"\" +%s"; cmd | getline d; close(cmd); print int((d-'"$(date +%s)"')/86400)}')

THRESHOLD=15
if [ "${DAYS_LEFT:-999}" -lt "$THRESHOLD" ]; then
  echo "ALERT: example.com 证书剩余 ${DAYS_LEFT} 天" | mail -s "SSL 证书即将到期" ops@example.com
fi

# 加入 crontab，每天上午 9 点检查
0 9 * * * /opt/scripts/check-cert-expiry.sh >> /var/log/cert-check.log 2>&1

# 安装 certbot（Nginx 插件 + DNS 插件按需）
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

# HTTP-01 方式签发（需要 80 端口对外可达）
sudo certbot certonly --nginx -d example.com -d www.example.com

# 通配符证书必须用 DNS-01 方式
sudo certbot certonly --manual --preferred-challenges dns \
  -d "*.example.com" -d example.com

# 测试续期（--dry-run 不会真的消耗签发配额）
sudo certbot renew --dry-run

# systemd timer 每 12 小时自动检查续期，并重载 Nginx
sudo systemctl enable --now snap.certbot.renew.timer
sudo certbot renew --deploy-hook "systemctl reload nginx"