CentOS下通过CertBot申请泛域名ssl证书

1.安装CertBot

$ sudo yum install certbot python2-certbot-nginx

2.申请证书步骤

2.1 输入命令

$ certbot certonly --preferred-challenges dns --manual  -d *.m2c.top -d m2c.top --server https://acme-v02.api.letsencrypt.org/directory

参数说明：

–preferred-challenges dns: 认证方式选择DNS, 泛域名支持DNS
–manual: 手动模式, 这里为了简单就使用手动认证了, 下面会说自动模式的使用.
-d *.m2c.top: 就是要申请的泛域名了
–server https://acme-v02.api.letsencrypt.org/directory: 泛域名证书是新功能, 如果要使用就得加上这个参数

2.2 敲下回车：

-------------------------------------------------------------------------------
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
-------------------------------------------------------------------------------
(Y)es/(N)o: y

2.3 再敲下y：

-------------------------------------------------------------------------------
Please deploy a DNS TXT record under the name
_acme-challenge.m2c.top with the following value:

W2Z_PT1RQX8usavprZ1ly43Je2ayst3ShIBxpgicdEA

Before continuing, verify the record is deployed.

2.4 在域名解析服务中添加一个泛解析：

2.5 按下回车

Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/m2c.top/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/m2c.top/privkey.pem
   Your cert will expire on 2020-07-16. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

2.6 证书到期了续签

certbot renew

certbot会在原来的证书路径重新生成证书

通配符域名证书不能简单的通过执行 certbot renew 来完成续期，必须通过 –manual-auth-hook 参数提供一个身份验证脚本来自动完成 DNS TXT 记录的验证操作，可以使用别人写好的插件 地址

3.生成p12格式证书(可选)

openssl pkcs12 -export -in /etc/letsencrypt/live/m2c.top/fullchain.pem -inkey /etc/letsencrypt/live/m2c.top/privkey.pem -out /etc/letsencrypt/live/m2c.top/letsencrypt.p12 -name tomcat_letsencrypt