# 手动模拟 HTTP-01 验证
# 创建验证目录
sudo mkdir -p /var/www/html/.well-known/acme-challenge/
echo "test-token.test-thumbprint" | sudo tee /var/www/html/.well-known/acme-challenge/test-token
curl http://example.com/.well-known/acme-challenge/test-token

# 查看 DNS-01 验证记录
dig _acme-challenge.example.com TXT

# Debian/Ubuntu
sudo apt install certbot

# 或使用 snap 安装（推荐）
sudo snap install --classic certbot

# RHEL/CentOS/Fedora
sudo dnf install certbot

# 验证安装
certbot --version

# Nginx 插件（自动配置）
sudo certbot --nginx -d example.com -d www.example.com

# Apache 插件
sudo certbot --apache -d example.com -d www.example.com

# Standalone 模式（临时启动 Web 服务器）
sudo certbot certonly --standalone -d example.com

# Webroot 模式（使用现有 Web 服务器）
sudo certbot certonly --webroot -w /var/www/html -d example.com

# 使用 DNS 验证（通配符证书需要）
sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.com

# 通配符证书必须使用 DNS-01 验证
sudo certbot certonly \
  --manual \
  --preferred-challenges dns \
  -d "*.example.com" \
  -d "example.com"

# 输出：
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Please deploy a DNS TXT record under the name:
#
# _acme-challenge.example.com
#
# with the following value:
#
# abc123xyz789...
#
# Before continuing, verify the TXT record has been deployed.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

# 使用 Cloudflare DNS 插件
sudo apt install python3-certbot-dns-cloudflare

# 创建凭证文件
cat > /etc/letsencrypt/cloudflare.ini << 'EOF'
dns_cloudflare_api_token = your-api-token
EOF
chmod 600 /etc/letsencrypt/cloudflare.ini

# 自动签发通配符证书
sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  -d "*.example.com" \
  -d "example.com"

# 支持的 DNS 插件
# python3-certbot-dns-cloudflare  (Cloudflare)
# python3-certbot-dns-route53     (AWS Route 53)
# python3-certbot-dns-google      (Google Cloud DNS)
# python3-certbot-dns-digitalocean (DigitalOcean)
# python3-certbot-dns-dnspod      (DNSPod)

# 测试续期
sudo certbot renew --dry-run

# 查看已安装的证书
sudo certbot certificates

# 手动续期
sudo certbot renew

# 设置自动续期（systemd timer，certbot 安装时自动配置）
sudo systemctl status certbot.timer

# 查看定时器详情
sudo systemctl list-timers certbot.timer

# 手动设置 cron 续期
# certbot 建议一天运行两次
cat > /etc/cron.d/certbot << 'EOF'
# 每 12 小时尝试续期
0 */12 * * * root certbot renew --quiet --deploy-hook "systemctl reload nginx" 2>&1
EOF

# 续期前钩子（停止服务释放 80 端口）
sudo certbot renew --pre-hook "systemctl stop nginx"

# 续期后钩子（重新加载服务）
sudo certbot renew --deploy-hook "systemctl reload nginx"

# 配置默认钩子
cat >> /etc/letsencrypt/cli.ini << 'EOF'
deploy-hook = systemctl reload nginx
pre-hook = systemctl stop nginx
post-hook = systemctl start nginx
EOF

server {
    listen 80;
    server_name example.com www.example.com;
    
    # ACME challenge
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }
    
    # HTTP → HTTPS 重定向
    location / {
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    
    # Let's Encrypt 证书路径
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    # SSL 优化
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    
    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    
    # Session 复用
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;
    
    # HSTS
    add_header Strict-Transport-Security "max-age=63072000" always;
    
    root /var/www/html;
    index index.html;
}

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    
    # ACME challenge
    Alias /.well-known/acme-challenge/ /var/www/html/.well-known/acme-challenge/
    
    # HTTP → HTTPS 重定向
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    
    # HSTS
    Header always set Strict-Transport-Security "max-age=63072000"
</VirtualHost>

# 查看当前域名的证书数量
curl -s "https://crt.sh/?q=example.com&output=json" | jq 'length'

# 测试验证（不会消耗速率限制）
sudo certbot renew --dry-run

# 使用 staging 环境
sudo certbot certonly --staging --standalone -d test.example.com

# 清除 staging 证书
sudo certbot delete --cert-name test.example.com

# Nginx 配置中使用 staging 证书
# ssl_certificate     /etc/letsencrypt/live/test.example.com/fullchain.pem;  (staging 路径)

# 使用 crt.sh 查询
curl -s "https://crt.sh/?q=example.com&output=json&exclude=expired" | \
  jq '[.[] | select(.issuer_name_id > 0)] | 
    group_by(.issuer_name) | 
    map({issuer: .[0].issuer_name, count: length})'

# 查看 Let's Encrypt 签发的证书
curl -s "https://crt.sh/?q=example.com&issuer_name_id=183267&output=json" | \
  jq '.[] | {id, not_before, not_after, name_value}'

#!/usr/bin/env bash
# ct-monitor-le.sh - 监控 Let's Encrypt 为你的域名签发的证书
DOMAIN="${1:?用法: $0 <domain>}"

echo "检查 ${DOMAIN} 的 Let's Encrypt CT 记录..."
echo ""

# Let's Encrypt 的 issuer_name_id (crt.sh)
# R3: 183267, R10: 3334554, R11: 3334555
LE_CERTS=$(curl -s "https://crt.sh/?q=${DOMAIN}&output=json" 2>/dev/null | \
  jq '[.[] | select(.issuer_name | contains("Let'"'"'s Encrypt") or contains("ISRG"))]')

COUNT=$(echo "$LE_CERTS" | jq 'length')
echo "共找到 ${COUNT} 张 Let's Encrypt 证书"
echo ""

echo "$LE_CERTS" | jq -r '.[-5:] | .[] | 
  "  ID: \(.id)\n  域名: \(.name_value)\n  签发: \(.not_before)\n  过期: \(.not_after)\n"'

# 安装
curl https://get.acme.sh | sh

# 签发证书（standalone 模式）
acme.sh --issue -d example.com --standalone

# 使用 webroot 模式
acme.sh --issue -d example.com -w /var/www/html

# 通配符证书（Cloudflare DNS）
acme.sh --issue -d "*.example.com" --dns dns_cf

# 安装到 Nginx
acme.sh --install-cert -d example.com \
  --key-file /etc/nginx/ssl/key.pem \
  --fullchain-file /etc/nginx/ssl/fullchain.pem \
  --reloadcmd "systemctl reload nginx"

# 自动续期（acme.sh 安装时自动设置 cron）
crontab -l | grep acme
# 0 0 * * * "/home/user/.acme.sh/acme.sh" --cron

# 安装
go install github.com/go-acme/lego/v4/cmd/lego@latest

# HTTP 验证
lego --http --domains example.com --email admin@example.com run

# DNS 验证（Cloudflare）
CLOUDFLARE_EMAIL=admin@example.com \
CLOUDFLARE_API_KEY=xxx \
lego --dns cloudflare --domains "*.example.com" --email admin@example.com run

# 证书存储路径
ls .lego/certs/example.com/

# certbot 多域名
sudo certbot certonly --nginx \
  -d example.com -d www.example.com \
  -d api.example.com -d admin.example.com

# 查看证书包含的域名
sudo certbot certificates

# 同时申请泛域名和裸域名
sudo certbot certonly \
  --manual --preferred-challenges dns \
  -d "example.com" \
  -d "*.example.com"

# 注意：需要为两条 DNS 记录添加 TXT 值
# _acme-challenge.example.com (两条 TXT 记录)

# docker-compose.yml
version: '3'
services:
  nginx:
    image: nginx:latest
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/conf.d/default.conf
      - certbot-etc:/etc/letsencrypt
      - certbot-var:/var/lib/letsencrypt
      - web-root:/var/www/html

  certbot:
    image: certbot/certbot
    volumes:
      - certbot-etc:/etc/letsencrypt
      - certbot-var:/var/lib/letsencrypt
      - web-root:/var/www/html
    depends_on:
      - nginx
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

volumes:
  certbot-etc:
  certbot-var:
  web-root: