> ## Content Index
> Fetch the complete content index at: https://yonglun.me/llms.txt
> Use this file to discover other available public pages before exploring further.

# Certbot 安装和使用
- URL: https://yonglun.me/certbot/
- Published: 2020-03-09T14:00:11.000Z
- Updated: 2025-04-22T08:47:41.000Z
- Author: Yonglun
- Tags: Open Source, #lang-zh

[Certbot](https://certbot.eff.org/?ref=yonglun.me) 是一个开源免费的工具，主要功能是为网站自动安装基于 Let’s Encrypt服务的SSL证书。

> [Let's Encrypt](https://letsencrypt.org/?ref=yonglun.me)是一个数字证书认证机构，旨在以自动化方式完成创建和安装证书的复杂流程，并推广使万维网服务器的加密连接无所不在，为安全网站提供免费的SSL/TLS证书。

下面以Ubuntu 18.04 为例，说明一下 Certbot 的安装和使用。

# 1\. 添加Certbot PPA 到apt repository

```bash
sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository universe
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update

```

# 2\. 安装 Certbot

```bash
sudo apt-get install certbot python-certbot-nginx

```

# 3\. 使用 Certbot

## 3.1 申请及安装证书

```bash
sudo certbot certonly

```

这是最简单的证书申请方法，输入命令后，根据提示输入相应的信息后，即可完成证书的申请和安装。  
该方式有两个前提条件：

1. 需要在申请域名映射到的服务器上执行。
2. 申请证书时需要绑定80端口进行验证，需要先停止服务器上绑定80端口的服务（比如nginx 或者apache 等），另外防火墙要放开80端口。

## 3.2 申请通配符证书

假设你想为域名domain.com 申请通配符证书，则可以输入下面命令

```bash
$ sudo certbot -d domain.com -d "*.domain.com" --manual --preferred-challenges dns certonly

```

系统显示下面的信息

```bash
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Performing the following challenges:
dns-01 challenge for domain.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: 

```

输入Yes同意将本机对的IP地址记录下来，接着系统显示下面的信息

```bash
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.domain.com with the following value:

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue

```

在你的域名的DNS中加入一条TXT记录，记录名 \_acme-challenge 值为上面的XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX, 然后按回车

验证你的DNS记录成功后，将为你颁发证书，证书会生成到/etc/letsencrypt/live/domain.com/ 目录下。 domain.com 是你申请的域名。

```bash
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/domain.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/domain.com/privkey.pem
   Your cert will expire on 2020-06-14. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

```

# \---The End ---