ubuntu: certbot 生成 https - 正常情况

apt install certbot -y

在云服务的后台，一般在网络策略相关的地方设置

打开 http://admin.demo.com 确认能正常打开

# 1. 检查域名解析是否正确
dig admin.demo.com +short
# 应该返回你的服务器公网 IP

# 2. 检查 80 端口是否监听（运行命令前）
sudo netstat -tulnp | grep :80
# 确保没有被占用

# 3. 检查防火墙
sudo ufw status          # Ubuntu

# 查看
ufw status

# 80 端口(这个必须要通)
ufw allow 80/tcp

# 443 端口
ufw allow 443/tcp

# 生成
certbot certonly --standalone \
  --cert-name demo.com \
  -d admin.demo.com

# 生成证书位置
/etc/letsencrypt/live/demo.com/

# 删除 cert
certbot delete --cert-name demo.com --quiet

示例配置

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    root /var/www/example.com;
    index index.html;
}

# 1. 确保 timer 启用
sudo systemctl enable certbot.timer
sudo systemctl start certbot.timer

# 2. 修改 certbot.service 添加 reload
sudo systemctl edit certbot.service

# 3. 查看状态
systemctl status certbot.timer

tail -f /var/log/letsencrypt/letsencrypt.log