Lets Encrypt SSL 证书自动化部署

HTTPS 不再是可选项。本文讲解使用 Certbot 自动申请和续期 Lets Encrypt 证书，并配置 Nginx 强制 HTTPS。

安装 Certbot

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d opsglobalonline.com -d www.opsglobalonline.com

Nginx HTTPS 配置

server {
    listen 80;
    server_name opsglobalonline.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name opsglobalonline.com;

    ssl_certificate /etc/letsencrypt/live/opsglobalonline.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/opsglobalonline.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    add_header Strict-Transport-Security max-age=63072000 always;

    location / {
        proxy_pass http://localhost:3000;
    }
}

自动续期

sudo certbot renew --dry-run
# 添加到 crontab: 0 3 * * * certbot renew --quiet --deploy-hook systemctl reload nginx

实用技巧

• 使用 --staging 标志测试，避免触发速率限制
• 配置 OCSP Stapling 提升性能
• 监控证书过期时间（可配合 Prometheus Alertmanager）