摘要：超文本傳輸安全協(xié)議英語，縮寫，常稱為，或是一種透過計(jì)算器網(wǎng)上進(jìn)行安全通信的傳輸協(xié)議。超文本傳輸安全協(xié)議為什么要開啟安全性開啟免費(fèi)服務(wù)我們今天介紹的免費(fèi)簽名平臺(tái)是，安裝過程以為例，如果你使用了其他系統(tǒng)或其他服務(wù)類型可前往查看相應(yīng)部署方法。

超文本傳輸安全協(xié)議（英語：Hypertext Transfer Protocol Secure，縮寫：HTTPS，常稱為HTTP over TLS，HTTP over SSL或HTTP Secure）是一種透過計(jì)算器網(wǎng)上進(jìn)行安全通信的傳輸協(xié)議。HTTPS經(jīng)由HTTP進(jìn)行通信，但利用SSL/TLS來加密數(shù)據(jù)包。HTTPS開發(fā)的主要目的，是提供對(duì)網(wǎng)站服務(wù)器的身份認(rèn)證，保護(hù)交換數(shù)據(jù)的隱私與完整性。這個(gè)協(xié)議由網(wǎng)景公司（Netscape）在1994年首次提出，隨后擴(kuò)展到互聯(lián)網(wǎng)上。—— 超文本傳輸安全協(xié)議 from WIKI

我們今天介紹的免費(fèi)簽名平臺(tái)是Let"s Encrypt，安裝過程以CentOS 7 + Nginx為例，如果你使用了其他系統(tǒng)或其他服務(wù)類型可前往Certbot查看相應(yīng)部署方法。

提示：如果你在使用RHEL on EC2，你可以運(yùn)行以下代碼來開啟選項(xiàng)通道（optional channel）：
$ yum -y install yum-utils
$ yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-> server-optional

開啟選項(xiàng)通道后運(yùn)行下面代碼安裝Certbot：

$ sudo yum install python2-certbot-nginx

給Certbot安裝Nginx插件：

$ sudo certbot --nginx

運(yùn)行這個(gè)命令會(huì)自動(dòng)為你獲取證書，并且Certbot會(huì)自動(dòng)配置你的Nginx以提供服務(wù)。如果你想要手動(dòng)修改Nginx配置可以使用certonly子命令：

$ sudo certbot --nginx certonly

執(zhí)行自動(dòng)配置命令后命令行輸出下文：

# sudo certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Enter email address (used for urgent renewal and security notices) (Enter "c" to
cancel): [ email@example.com ]

提示你輸入接收緊急更新和安全提示的郵箱，

輸入郵箱鍵入回車進(jìn)入下一步（輸入"c"并回車放棄設(shè)置該郵箱）。

Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: 

要求閱讀協(xié)議，輸入A同意該協(xié)議并繼續(xù)。

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let"s Encrypt project and the non-profit
organization that develops Certbot? We"d like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: 

詢問郵箱是否接受廣告，輸入N拒絕并繼續(xù)。

No names were found in your configuration files. Please enter in your domain
name(s) (comma and/or space separated)  (Enter "c" to cancel): 

輸入你的域名（例如：example.me）并繼續(xù)。

Obtaining a new certificate
Performing the following challenges:
http-01 challenge for example.me
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/nginx.conf

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you"re confident your site works on HTTPS. You can undo this
change by editing your web server"s configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press "c" to cancel): 

選擇是否將http請(qǐng)求重定向至https，輸入1不改變當(dāng)前服務(wù)器配置（不重定向），輸入2將自動(dòng)配置所有http請(qǐng)求的重定向。

既然我們要開啟https服務(wù)就輸入2并繼續(xù)。

Redirecting all traffic on port 80 to ssl in /etc/nginx/nginx.conf

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://example.me

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=example.me
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/example.me/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/example.me/privkey.pem
   Your cert will expire on 2019-02-12. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let"s Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

出現(xiàn)以上提示就說明配置成功啦，趕快去訪問一下試試吧。