域名生成免费证书（简单可用）

最近有个域名证书过期了，我又懒得去阿里云申请免费的证书（阿里云有免费证书，但是有数量限制和90天使用限制，这个大家自己去阿里云看一下），就试了下有没有更简单的方式可以获取到免费的证书

下面开始免费的证书申请

1.先安装 acme.sh

curl https://get.acme.sh | sh
source ~/.bashrc
# 最好使用root用户添加一下环境变量
export PATH=~/.acme.sh:$PATH

2.注册账号，邮箱可以随便填

~/.acme.sh/acme.sh --register-account -m sakura@email.com

3.给域名生成证书
这里要注意，首先你的域名已经指向的了的公网 ip，然后 /usr/local/web/sakura/dist（这个是我页面端的根目录） 是配置正常可以访问的目录，目的是验证这个域名真的是你的

~/.acme.sh/acme.sh --issue -d www.sakura.cn -w /usr/local/web/sakura/dist

我这里报了个错 Could not get nonce

[Mon May 26 19:02:17 CST 2025] Using CA: https://acme.zerossl.com/v2/DV90
[Mon May 26 19:02:17 CST 2025] Creating domain key
[Mon May 26 19:02:17 CST 2025] The domain key is here: /root/.acme.sh/www.sakura.cn_ecc/www.sakura.cn.key
[Mon May 26 19:02:17 CST 2025] Single domain='www.sakura.cn'
[Mon May 26 19:02:20 CST 2025] Could not get nonce, let's try again.
[Mon May 26 19:02:26 CST 2025] Could not get nonce, let's try again.
[Mon May 26 19:02:31 CST 2025] Could not get nonce, let's try again.
[Mon May 26 19:02:37 CST 2025] Could not get nonce, let's try again.
[Mon May 26 19:02:43 CST 2025] Could not get nonce, let's try again.
[Mon May 26 19:02:49 CST 2025] Could not get nonce, let's try again.

排查一下这个错误的原因
（1）先检查一下网路是否通畅

curl -v https://acme.zerossl.com/v2/DV90

（2）同步一下服务器时间

timedatectl set-ntp true
ntpdate time.windows.com

（3）切换到 Let’s Encrypt（建议），重新签发

~/.acme.sh/acme.sh --set-default-ca --server letsencrypt
# 重新签发
~/.acme.sh/acme.sh --issue -d www.sakura.cn -w /usr/local/web/sakura/dist

我这里执行了（3）切换到 Let’s Encrypt 后显示签发成功了

[root@ecm-74de conf.d]# ~/.acme.sh/acme.sh --set-default-ca --server letsencrypt
[Mon May 26 19:04:40 CST 2025] Changed default CA to: https://acme-v02.api.letsencrypt.org/directory
[root@ecm-74de conf.d]# ~/.acme.sh/acme.sh --issue -d www.sakura.cn -w /usr/local/web/sakura/dist
[Mon May 26 19:04:53 CST 2025] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Mon May 26 19:04:53 CST 2025] Account key creation OK.
[Mon May 26 19:04:53 CST 2025] Registering account: https://acme-v02.api.letsencrypt.org/directory
[Mon May 26 19:05:01 CST 2025] Registered
[Mon May 26 19:05:01 CST 2025] 

5.把证书放到 nginx 证书使用位置，/etc/nginx/ssl 是我自己 nginx 证书安装位置

~/.acme.sh/acme.sh --install-cert -d www.sakura.cn \
--key-file       /etc/nginx/ssl/sakura.cn.key  \
--fullchain-file /etc/nginx/ssl/sakura.cn.pem \
--reloadcmd     "nginx -s reload"

注意 nginx 配置

# 强制 HTTP 跳转到 HTTPS
server {
    listen 80;
    server_name www.sakura.cn;

    # 将所有请求重定向到 HTTPS
    return 301 https://$host$request_uri;
}

# HTTPS 配置
server {
    listen 443 ssl;
    server_name www.sakura.cn;

    ssl_certificate     /etc/nginx/ssl/sakura.cn.pem;
    ssl_certificate_key /etc/nginx/ssl/sakura.cn.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    access_log /etc/nginx/logs/sakura.access.log;
    error_log  /etc/nginx/logs/sakura.error.log;

    root /usr/local/web/sakura/dist;
    index index.html;

    location / {
        try_files $uri $uri/ /index.html;
    }
}

重启nginx配置

nginx -s reload

6.最后我们检查一下定时任务里面时候有这个自动更新证书的任务，默认期限是六个月，六个月后会自动去更新证书的

crontab -l | grep acme.sh

[root@ecm-74de ~]# crontab -l | grep acme.sh
5 9 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

最后我们访问一下域名，可以看到证书生效了