[{"data":1,"prerenderedAt":155},["ShallowReactive",2],{"page-HTTPS-1":3,"page-count-HTTPS":154},[4],{"id":5,"title":6,"body":7,"date":131,"description":13,"extension":132,"meta":133,"navigation":136,"path":148,"seo":149,"stem":150,"tags":151,"__hash__":153},"blogs\u002F_legacy\u002F2019\u002F2019-08-08-https-upgrade-log.md","Https改造记录",{"type":8,"value":9,"toc":124},"minimark",[10,14,17,20,23,34,37,40,43,48,57,66,69,72,83,86,89,93,96,99,102,105,109,112,118,121],[11,12,13],"p",{},"经过了几个月的观察，现在网站总算是完全平稳的运作在Https上了。",[11,15,16],{},"之所以要自己折腾Https证书这些事情，是因为最终网站迁移到Linode上了。",[11,18,19],{},"虽然现在的共享主机商都会提供Https签名服务，但是无奈一直都找不到靠谱的主机商。试来试去，发现还是Linode适合我这种规模小但对稳定性有要求的。虽然速度上偶尔会有非常卡的情况，但是现状来看实在无可奈何。因为本质上这边不产生收益，所以没有办法花费太多成本在上面。",[11,21,22],{},"记得以前Https证书很难搞定，只有Comodo的免费授权，要更新起来特别麻烦。而个人站点基本不可能去搞商业证书，完全意义不明~",[11,24,25,26,33],{},"好在现在有了",[27,28,32],"a",{"href":29,"rel":30},"https:\u002F\u002Fletsencrypt.org\u002F",[31],"nofollow","lets encrypt","，可以免费的进行Https证书的申请。",[11,35,36],{},"第一次弄的时候，由于没有什么时间，参照官方教程随便配置了下。",[11,38,39],{},"lets encrypte的签名有效时间比较短，需要自己隔一段时间重新签名一次。但是途中不小心忙忘了 ，导致证书失效。几个常见的浏览器，Firefox和Chrome，遇到这种情况是直接不让访问网站的，相当的尴尬。",[11,41,42],{},"于是就又开始折腾。折腾完了就有了下面的记录，方便下次需要配置的时候直接拷贝就可以了~",[44,45,47],"h2",{"id":46},"acmesh","Acme.sh",[11,49,50,51,56],{},"几经搜索，终于找到了这个自动签名工具。不但有中文的",[27,52,55],{"href":53,"rel":54},"https:\u002F\u002Fgithub.com\u002FNeilpang\u002Facme.sh\u002Fwiki\u002F%E8%AF%B4%E6%98%8E",[31],"说明文档","，功能上，也比官方的工具更直观一些。",[11,58,59,60,65],{},"操作上，为了方便下次自动签名，首先第一步是添加DNS API。具体可以参考",[27,61,64],{"href":62,"rel":63},"https:\u002F\u002Fgithub.com\u002FNeilpang\u002Facme.sh\u002Fwiki\u002Fdnsapi",[31],"官方说明","。",[11,67,68],{},"之后按照文档进行证书申请，完成申请后就可以安装了。",[11,70,71],{},"对于Nginx，安装的主要的命令是这样：",[73,74,79],"pre",{"className":75,"code":77,"language":78},[76],"language-text","acme.sh --install-cert -d *.ch-wind.com \\\n--cert-file      \u002Fetc\u002Fnginx\u002Fssl\u002Fch-wind.cer  \\\n--key-file       \u002Fetc\u002Fnginx\u002Fssl\u002Fch-wind.key  \\\n--ca-file       \u002Fetc\u002Fnginx\u002Fssl\u002Fca.cer  \\\n--fullchain-file \u002Fetc\u002Fnginx\u002Fssl\u002Ffullchain.cer \\\n--reloadcmd     \"service nginx force-reload\"\n\n","text",[80,81,77],"code",{"__ignoreMap":82},"",[11,84,85],{},"一旦完成一次操作，之后就会每隔60天自动更新证书，观察了几个月，基本算是没什么问题。",[11,87,88],{},"需要注意的是，对于wild card的域名证书，是不可以使用给根域名的。虽然不知道为什么，但是如果有做根域名跳转的话，需要对根域名另外签一次名。",[44,90,92],{"id":91},"ipv6","IPV6",[11,94,95],{},"既然都加HTTPS了，自然不能忘了IPV6。",[11,97,98],{},"网站的IPV6迁移是最简单的了，不过现在纯IPV6的用户应当还是比较少。大多数都只是根据线路来优先选择更快的一个。",[11,100,101],{},"配置上，只要服务器提供商有给IPV6地址，那么在DNS提供商那边添加一个AAAA记录就OK了。",[11,103,104],{},"当然，Nginx这边还需要配置下端口监听方式，如果之前没有配过的话。",[44,106,108],{"id":107},"nginx配置","Nginx配置",[11,110,111],{},"接下里就是Nginx配置，这个基本参考官方文档就可以了。但是每次去找也很麻烦，这里贴出现在在使用的版本。",[73,113,116],{"className":114,"code":115,"language":78},[76],"server{\n    server_name ch-wind.com;\n    return 301 https:\u002F\u002Fblog.$host$request_uri;\n\n    listen [::]:443 ssl; # managed by Certbot\n    listen 443 ssl; # managed by Certbot\n    ssl_certificate \u002Fetc\u002Fnginx\u002Fssl\u002Fraw_ch-wind.cer; # managed by Certbot \n    ssl_certificate_key \u002Fetc\u002Fnginx\u002Fssl\u002Fraw_ch-wind.key; # managed by Certbot\n}\n\nserver{\n    if ($host = blog.ch-wind.com) {\n        return 301 https:\u002F\u002F$host$request_uri;\n    } # managed by Certbot\n\n\n    listen [::]:80;\n    listen 80;\n\n    server_name blog.ch-wind.com;\n    return 301 https:\u002F\u002F$server_name$request_uri;\n\n\n}\n\nserver {\n        ## Your website name goes here.\n        server_name blog.ch-wind.com;\n        ## Your only path reference.\n        root \u002Fvar\u002Fwww\u002Fchwindblog;\n        ## This should be in your http block and if it is, it's not needed here.\n        index index.php;\n\n        location = \u002Ffavicon.ico {\n                log_not_found off;\n                access_log off;\n        }\n\n        location = \u002Frobots.txt {\n                allow all;\n                log_not_found off;\n                access_log off;\n        }\n\n        location \u002F {\n                # This is cool because no php is touched for static content.\n                # include the \"?$args\" part so non-default permalinks doesn't break when using query string\n                try_files $uri $uri\u002F \u002Findex.php?$args;\n        }\n\n        location ~ \\.php$ {\n                #NOTE: You should have \"cgi.fix_pathinfo = 0;\" in php.ini\n                include snippets\u002Ffastcgi-php.conf;\n                fastcgi_intercept_errors on;\n                fastcgi_pass unix:\u002Fvar\u002Frun\u002Fphp\u002Fphp7.2-fpm.sock;\n                fastcgi_buffers 16 16k;\n                fastcgi_buffer_size 32k;\n        }\n\n        location ~* \\.(js|css|png|jpg|jpeg|gif|ico)$ {\n                expires max;\n                log_not_found off;\n        }\n\n    ## listen 80;\n\n    listen [::]:443 ssl;\n    listen 443 ssl;\n    ssl_certificate \u002Fetc\u002Fnginx\u002Fssl\u002Fch-wind.cer; # managed by Certbot \n    ssl_certificate_key \u002Fetc\u002Fnginx\u002Fssl\u002Fch-wind.key; # managed by Certbot\n}\n\nserver{\n    if ($host = ch-wind.com) {\n        return 301 https:\u002F\u002F$host$request_uri;\n    } # managed by Certbot\n\n\n    server_name ch-wind.com;\n    listen [::]:80;\n    listen 80;\n    return 404; # managed by Certbot\n\n\n}\n\n",[80,117,115],{"__ignoreMap":82},[11,119,120],{},"里面有被Certbot配置过的痕迹，不过CertBot的自动更新功能配置起来有些迷。",[11,122,123],{},"整个配置有点乱，也没时间整，真的是凑活着用了……",{"title":82,"searchDepth":125,"depth":126,"links":127},2,3,[128,129,130],{"id":46,"depth":125,"text":47},{"id":91,"depth":125,"text":92},{"id":107,"depth":125,"text":108},"2019-08-08","md",{"layout":134,"status":135,"published":136,"author":137,"author_login":139,"author_email":140,"wordpress_id":141,"wordpress_url":142,"date_gmt":143,"excerpt":144},"post","publish",true,{"display_name":138,"login":139,"email":140,"url":82},"风铃","flinkor","flinkor@foxmail.com",2647,"\u002F?p=2647","2019-08-08 15:46:42 +0000",{"type":8,"value":145},[146],[11,147,13],{},"\u002F2019-08-08-https-upgrade-log",{"title":6,"description":13},"_legacy\u002F2019\u002F2019-08-08-https-upgrade-log",[152],"HTTPS","XZPIUsZ9_T28NxEpxUxcHMiAq-F1o65MGKNbVC6bhuc",1,1788763182670]