[root@study-linux acme.sh]# ./acme.sh --install -m admin@007890.xyz [2025年 12月 06日 星期六 11:30:33 CST] It is recommended to install socat first. [2025年 12月 06日 星期六 11:30:33 CST] We use socat for the standalone server, which is used for standalone mode. [2025年 12月 06日 星期六 11:30:33 CST] If you don't want to use standalone mode, you may ignore this warning. [2025年 12月 06日 星期六 11:30:33 CST] Installing to /root/.acme.sh [2025年 12月 06日 星期六 11:30:33 CST] Installed to /root/.acme.sh/acme.sh [2025年 12月 06日 星期六 11:30:33 CST] Installing alias to '/root/.bashrc' [2025年 12月 06日 星期六 11:30:33 CST] Close and reopen your terminal to start using acme.sh [2025年 12月 06日 星期六 11:30:33 CST] Installing alias to '/root/.cshrc' [2025年 12月 06日 星期六 11:30:33 CST] Installing alias to '/root/.tcshrc' [2025年 12月 06日 星期六 11:30:33 CST] Installing cron job no crontab for root no crontab for root [2025年 12月 06日 星期六 11:30:33 CST] bash has been found. Changing the shebang to use bash as preferred. [2025年 12月 06日 星期六 11:30:35 CST] OK
刷新环境变量，否则没有 acme.sh 的命令
1
source ~/.bashrc
验证
1
acme.sh --version
3.1.2 在线安装
raw.githubusercontent.com 域名被墙，境内可能无法安装。
在线安装
1
curl https://get.acme.sh | sh -s email=my@example.com
1
wget -O - https://get.acme.sh | sh -s email=my@example.com
certbot certonly --manual --preferred-challenges dns -d certbot.qiaoxiong.cc
输入电子邮箱（交互式输入）
1 2
Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel):
同意协议（必须填Yes）
1 2 3 4 5
Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.6-August-18-2025.pdf. You must agree in order to register with the ACME server. Do you agree? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o:
是否同意共享电子邮件给EFF（可选No）
1 2 3 4 5 6 7
Would you be willing, once your first certificate is successfully issued, to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o:
[root@study-linux ~]# certbot certonly --manual --preferred-challenges dns -d certbot.qiaoxiong.cc Saving debug log to /var/log/letsencrypt/letsencrypt.log Python 3.6 support will be dropped in the next release of Certbot - please upgrade your Python version. Requesting a certificate for certbot.qiaoxiong.cc
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please deploy a DNS TXT record under the name:
_acme-challenge.certbot.qiaoxiong.cc.
with the following value:
gUEIns1FvCNFSXxubJZdqupCr6wQ73P37PS9KY_06rI
Before continuing, verify the TXT record has been deployed. Depending on the DNS provider, this may take some time, from a few seconds to multiple minutes. You can check if it has finished deploying with aid of online tools, such as the Google Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.certbot.qiaoxiong.cc. Look for one or more bolded line(s) below the line ';ANSWER'. It should show the value(s) you've just added. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Press Enter to Continue
Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/certbot.qiaoxiong.cc/fullchain.pem Key is saved at: /etc/letsencrypt/live/certbot.qiaoxiong.cc/privkey.pem This certificate expires on 2026-03-06. These files will be updated when the certificate renews.
NEXT STEPS: - This certificate will not be renewed automatically. Autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate's expiry date. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If you like Certbot, please consider supporting our work by: * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate * Donating to EFF: https://eff.org/donate-le - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - [root@study-linux ~]#
步骤五，安装证书
法一：在Nginx配置中启用SSL证书
1 2 3 4 5 6 7 8 9 10 11 12 13
server { listen443 ssl; server_name certbot.qiaoxiong.cc;
[root@study-linux ~]# certbot certonly \ > --dns-cloudflare \ > --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini \ > --dns-cloudflare-propagation-seconds 60 \ > -d auto.qiaoxiong.cc > -d auto.qiaoxiong.cc Saving debug log to /var/log/letsencrypt/letsencrypt.log Python 3.6 support will be dropped in the next release of Certbot - please upgrade your Python version. Requesting a certificate for auto.qiaoxiong.cc
......
Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/auto.qiaoxiong.cc/fullchain.pem Key is saved at: /etc/letsencrypt/live/auto.qiaoxiong.cc/privkey.pem This certificate expires on 2026-03-06. These files will be updated when the certificate renews.
NEXT STEPS: - The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.
