[{"data":1,"prerenderedAt":153},["ShallowReactive",2],{"\u002F2019-08-08-https-upgrade-log":3},{"id":4,"title":5,"body":6,"date":130,"description":12,"extension":131,"meta":132,"navigation":135,"path":147,"seo":148,"stem":149,"tags":150,"__hash__":152},"blogs\u002F_legacy\u002F2019\u002F2019-08-08-https-upgrade-log.md","Https改造记录",{"type":7,"value":8,"toc":123},"minimark",[9,13,16,19,22,33,36,39,42,47,56,65,68,71,82,85,88,92,95,98,101,104,108,111,117,120],[10,11,12],"p",{},"经过了几个月的观察，现在网站总算是完全平稳的运作在Https上了。",[10,14,15],{},"之所以要自己折腾Https证书这些事情，是因为最终网站迁移到Linode上了。",[10,17,18],{},"虽然现在的共享主机商都会提供Https签名服务，但是无奈一直都找不到靠谱的主机商。试来试去，发现还是Linode适合我这种规模小但对稳定性有要求的。虽然速度上偶尔会有非常卡的情况，但是现状来看实在无可奈何。因为本质上这边不产生收益，所以没有办法花费太多成本在上面。",[10,20,21],{},"记得以前Https证书很难搞定，只有Comodo的免费授权，要更新起来特别麻烦。而个人站点基本不可能去搞商业证书，完全意义不明~",[10,23,24,25,32],{},"好在现在有了",[26,27,31],"a",{"href":28,"rel":29},"https:\u002F\u002Fletsencrypt.org\u002F",[30],"nofollow","lets encrypt","，可以免费的进行Https证书的申请。",[10,34,35],{},"第一次弄的时候，由于没有什么时间，参照官方教程随便配置了下。",[10,37,38],{},"lets encrypte的签名有效时间比较短，需要自己隔一段时间重新签名一次。但是途中不小心忙忘了 ，导致证书失效。几个常见的浏览器，Firefox和Chrome，遇到这种情况是直接不让访问网站的，相当的尴尬。",[10,40,41],{},"于是就又开始折腾。折腾完了就有了下面的记录，方便下次需要配置的时候直接拷贝就可以了~",[43,44,46],"h2",{"id":45},"acmesh","Acme.sh",[10,48,49,50,55],{},"几经搜索，终于找到了这个自动签名工具。不但有中文的",[26,51,54],{"href":52,"rel":53},"https:\u002F\u002Fgithub.com\u002FNeilpang\u002Facme.sh\u002Fwiki\u002F%E8%AF%B4%E6%98%8E",[30],"说明文档","，功能上，也比官方的工具更直观一些。",[10,57,58,59,64],{},"操作上，为了方便下次自动签名，首先第一步是添加DNS API。具体可以参考",[26,60,63],{"href":61,"rel":62},"https:\u002F\u002Fgithub.com\u002FNeilpang\u002Facme.sh\u002Fwiki\u002Fdnsapi",[30],"官方说明","。",[10,66,67],{},"之后按照文档进行证书申请，完成申请后就可以安装了。",[10,69,70],{},"对于Nginx，安装的主要的命令是这样：",[72,73,78],"pre",{"className":74,"code":76,"language":77},[75],"language-text","acme.sh --install-cert -d *.ch-wind.com \\\n--cert-file      \u002Fetc\u002Fnginx\u002Fssl\u002Fch-wind.cer  \\\n--key-file       \u002Fetc\u002Fnginx\u002Fssl\u002Fch-wind.key  \\\n--ca-file       \u002Fetc\u002Fnginx\u002Fssl\u002Fca.cer  \\\n--fullchain-file \u002Fetc\u002Fnginx\u002Fssl\u002Ffullchain.cer \\\n--reloadcmd     \"service nginx force-reload\"\n\n","text",[79,80,76],"code",{"__ignoreMap":81},"",[10,83,84],{},"一旦完成一次操作，之后就会每隔60天自动更新证书，观察了几个月，基本算是没什么问题。",[10,86,87],{},"需要注意的是，对于wild card的域名证书，是不可以使用给根域名的。虽然不知道为什么，但是如果有做根域名跳转的话，需要对根域名另外签一次名。",[43,89,91],{"id":90},"ipv6","IPV6",[10,93,94],{},"既然都加HTTPS了，自然不能忘了IPV6。",[10,96,97],{},"网站的IPV6迁移是最简单的了，不过现在纯IPV6的用户应当还是比较少。大多数都只是根据线路来优先选择更快的一个。",[10,99,100],{},"配置上，只要服务器提供商有给IPV6地址，那么在DNS提供商那边添加一个AAAA记录就OK了。",[10,102,103],{},"当然，Nginx这边还需要配置下端口监听方式，如果之前没有配过的话。",[43,105,107],{"id":106},"nginx配置","Nginx配置",[10,109,110],{},"接下里就是Nginx配置，这个基本参考官方文档就可以了。但是每次去找也很麻烦，这里贴出现在在使用的版本。",[72,112,115],{"className":113,"code":114,"language":77},[75],"server{\n    server_name ch-wind.com;\n    return 301 https:\u002F\u002Fblog.$host$request_uri;\n\n    listen [::]:443 ssl; # managed by Certbot\n    listen 443 ssl; # managed by Certbot\n    ssl_certificate \u002Fetc\u002Fnginx\u002Fssl\u002Fraw_ch-wind.cer; # managed by Certbot \n    ssl_certificate_key \u002Fetc\u002Fnginx\u002Fssl\u002Fraw_ch-wind.key; # managed by Certbot\n}\n\nserver{\n    if ($host = blog.ch-wind.com) {\n        return 301 https:\u002F\u002F$host$request_uri;\n    } # managed by Certbot\n\n\n    listen [::]:80;\n    listen 80;\n\n    server_name blog.ch-wind.com;\n    return 301 https:\u002F\u002F$server_name$request_uri;\n\n\n}\n\nserver {\n        ## Your website name goes here.\n        server_name blog.ch-wind.com;\n        ## Your only path reference.\n        root \u002Fvar\u002Fwww\u002Fchwindblog;\n        ## This should be in your http block and if it is, it's not needed here.\n        index index.php;\n\n        location = \u002Ffavicon.ico {\n                log_not_found off;\n                access_log off;\n        }\n\n        location = \u002Frobots.txt {\n                allow all;\n                log_not_found off;\n                access_log off;\n        }\n\n        location \u002F {\n                # This is cool because no php is touched for static content.\n                # include the \"?$args\" part so non-default permalinks doesn't break when using query string\n                try_files $uri $uri\u002F \u002Findex.php?$args;\n        }\n\n        location ~ \\.php$ {\n                #NOTE: You should have \"cgi.fix_pathinfo = 0;\" in php.ini\n                include snippets\u002Ffastcgi-php.conf;\n                fastcgi_intercept_errors on;\n                fastcgi_pass unix:\u002Fvar\u002Frun\u002Fphp\u002Fphp7.2-fpm.sock;\n                fastcgi_buffers 16 16k;\n                fastcgi_buffer_size 32k;\n        }\n\n        location ~* \\.(js|css|png|jpg|jpeg|gif|ico)$ {\n                expires max;\n                log_not_found off;\n        }\n\n    ## listen 80;\n\n    listen [::]:443 ssl;\n    listen 443 ssl;\n    ssl_certificate \u002Fetc\u002Fnginx\u002Fssl\u002Fch-wind.cer; # managed by Certbot \n    ssl_certificate_key \u002Fetc\u002Fnginx\u002Fssl\u002Fch-wind.key; # managed by Certbot\n}\n\nserver{\n    if ($host = ch-wind.com) {\n        return 301 https:\u002F\u002F$host$request_uri;\n    } # managed by Certbot\n\n\n    server_name ch-wind.com;\n    listen [::]:80;\n    listen 80;\n    return 404; # managed by Certbot\n\n\n}\n\n",[79,116,114],{"__ignoreMap":81},[10,118,119],{},"里面有被Certbot配置过的痕迹，不过CertBot的自动更新功能配置起来有些迷。",[10,121,122],{},"整个配置有点乱，也没时间整，真的是凑活着用了……",{"title":81,"searchDepth":124,"depth":125,"links":126},2,3,[127,128,129],{"id":45,"depth":124,"text":46},{"id":90,"depth":124,"text":91},{"id":106,"depth":124,"text":107},"2019-08-08","md",{"layout":133,"status":134,"published":135,"author":136,"author_login":138,"author_email":139,"wordpress_id":140,"wordpress_url":141,"date_gmt":142,"excerpt":143},"post","publish",true,{"display_name":137,"login":138,"email":139,"url":81},"风铃","flinkor","flinkor@foxmail.com",2647,"\u002F?p=2647","2019-08-08 15:46:42 +0000",{"type":7,"value":144},[145],[10,146,12],{},"\u002F2019-08-08-https-upgrade-log",{"title":5,"description":12},"_legacy\u002F2019\u002F2019-08-08-https-upgrade-log",[151],"HTTPS","XZPIUsZ9_T28NxEpxUxcHMiAq-F1o65MGKNbVC6bhuc",1788763182669]