{"id":1245,"date":"2025-08-25T21:51:26","date_gmt":"2025-08-25T13:51:26","guid":{"rendered":"https:\/\/www.jumoon.top\/?p=1245"},"modified":"2026-01-08T22:58:36","modified_gmt":"2026-01-08T14:58:36","slug":"%e9%a3%9e%e7%89%9bos%e9%80%9a%e8%bf%87acme-sh%e8%87%aa%e5%8a%a8%e9%83%a8%e7%bd%b2ssl%e8%af%81%e4%b9%a6","status":"publish","type":"post","link":"https:\/\/www.jumoon.top\/?p=1245","title":{"rendered":"\u98de\u725bOS\u901a\u8fc7acme.sh\u81ea\u52a8\u90e8\u7f72ssl\u8bc1\u4e66"},"content":{"rendered":"\n<p>\u98de\u725bOS\u7ed1\u5b9a\u81ea\u6709\u57df\u540d\u540e\uff0c\u901a\u8fc7acme.sh\u5de5\u5177+CF\u7ec4\u5408\uff0c\u81ea\u52a8\u66f4\u65b0ssl\u8bc1\u4e66\uff0c\u81ea\u52a8\u7eed\u7b7e\u7684\u65b9\u6848\u3002\u4ee5\u4e0b\u6240\u6709\u547d\u4ee4\u5728root\u6743\u9650\u4e0b\u8fd0\u884c<\/p>\n\n\n\n<p>\u5b9a\u4f4d\u5230opt\u76ee\u5f55<br>cd \/opt<br><br>\u56fd\u5185\u73af\u5883\u5b89\u88c5acme\uff0c<strong>\u6ce8\u610f\u672b\u5c3e\u7684\u90ae\u7bb1\u6539\u6210\u81ea\u5df1\u7684<\/strong>\uff1a<br>mkdir -p \/opt\/acme &amp;&amp; cd \/opt\/acme &amp;&amp; git clone https:\/\/gitee.com\/neilpang\/acme.sh.git &amp;&amp; cd acme.sh &amp;&amp; .\/acme.sh &#8211;install -m yourmail@server.com<br><br>\u521b\u5efa\u81ea\u52a8\u6267\u884c\u811a\u672c\uff1a<br>sudo nano \/opt\/acme\/acmedeploy.sh<br><br>\u7ed9\u4e0e\u811a\u672c\u6743\u9650\uff1a<br>chmod 777 \/opt\/acme\/acmedeploy.sh<br><br>\u624b\u5de5\u6267\u884c\u811a\u672c\u521b\u5efa\u8bc1\u4e66\uff1a<br>bash \/opt\/acme\/acmedeploy.sh<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>\u5728\u6210\u529f\u4f60\u6267\u884c\u811a\u672c\u5e76\u81ea\u52a8\u521b\u5efa\u8bc1\u4e66\uff0c\u7f51\u9875\u6b63\u5e38\u80fd\u8bbf\u95ee\u540e\uff0c\u6dfb\u52a0\u81ea\u52a8\u6267\u884c\u4efb\u52a1\uff0c\u8f93\u5165 crontab -e \u6253\u5f00\u5f53\u524d\u7528\u6237\u7684\u8ba1\u5212\u4efb\u52a1\u5217\u8868\uff0c\u5efa\u8bae\u628aacme.sh\u9ed8\u8ba4\u7684\u5b9a\u65f6\u4efb\u52a1\u6ce8\u91ca\u6389\uff0c\u65b0\u589e\u4e00\u6761\uff0c\u6bcf\u670820\u53f7\u6267\u884c\u4e00\u6b21\uff0c\u8bc1\u4e66\u6709\u6548\u671f\u670990\u5929\uff0c\u6240\u4ee5\u8c03\u6574\u4e3a\u6bcf\u4e2a\u6708\u6267\u884c\u4e00\u6b21\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0 0 20 * * bash \/opt\/acme\/acmedeploy.sh &gt;&gt; \/opt\/acme\/acmedeploy.log 2&gt;&amp;1<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"979\" height=\"382\" src=\"https:\/\/www.jumoon.top\/wp-content\/uploads\/2025\/08\/\u98de\u725bssl1.png\" alt=\"\" class=\"wp-image-1246\" srcset=\"https:\/\/www.jumoon.top\/wp-content\/uploads\/2025\/08\/\u98de\u725bssl1.png 979w, https:\/\/www.jumoon.top\/wp-content\/uploads\/2025\/08\/\u98de\u725bssl1-300x117.png 300w, https:\/\/www.jumoon.top\/wp-content\/uploads\/2025\/08\/\u98de\u725bssl1-768x300.png 768w\" sizes=\"auto, (max-width: 979px) 100vw, 979px\" \/><\/figure>\n\n\n\n<p><br>\u4ee5\u4e0b\u662f\u4ee3\u7801\uff1a<br>\u5982\u679c\u8bc1\u4e66\u6709\u6548\u671f\u5269\u4f59\u8d85\u8fc730\u5929\uff0c\u8df3\u8fc7\u8bc1\u4e66\u7533\u8bf7\u8fc7\u7a0b\uff0c\u76f4\u63a5\u4f7f\u7528\u73b0\u6709\u8bc1\u4e66\u3002\u66f4\u65b0\u73b0\u6709\u8bc1\u4e66\u8bb0\u5f55\u524d\uff0c\u53d6\u6d88\u8be5\u57df\u540d\u4e0b\u6240\u6709\u8bc1\u4e66\u9ed8\u8ba4\u72b6\u6001\uff0c\u5728\u66f4\u65b0\u73b0\u6709\u8bc1\u4e66\u8bb0\u5f55\u65f6\u6dfb\u52a0\u4e86is_default = 1\uff0c\u63d2\u5165\u65b0\u8bc1\u4e66\u8bb0\u5f55\u65f6\u5c06is_default\u8bbe\u7f6e\u4e3a1\uff0c\u786e\u4fdd\u65b0\u8bc1\u4e66\u8bbe\u7f6e\u4e3a\u9ed8\u8ba4\u8bc1\u4e66\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/bin\/bash\n\n# \u83b7\u53d6\u811a\u672c\u5f00\u59cb\u8fd0\u884c\u65f6\u95f4\u6233\nTT=$(date +%s%3N)\n\n# acme.sh \u811a\u672c\u8def\u5f84\nACME_DIR=\"\/opt\/acme\/acme.sh\"\n\n# SSL\u8bc1\u4e66\u57df\u540d\uff08xxxx.com)\nexport DOMAIN=\"your domain\"\n\n# DNS\u7c7b\u578b CF\nexport DNS=\"dns_cf\"\n\n# Cloudflare API\u5bc6\u94a5\nexport CF_Key=\"your key\"\nexport CF_Email=\"your email address\"\n\n# DNS API \u751f\u6548\u7b49\u5f85\u65f6\u95f4 \u503c(\u5355\u4f4d\uff1a\u79d2)\uff0c\u4e00\u822c120\u5373\u53ef\nDNS_SLEEP=\"120\"\n\n# \u8bc1\u4e66\u670d\u52a1\u5546\uff0czerossl \u548c letsencrypt\uff0c\u8fd9\u91cc\u7528letsencrypt\nCERT_SERVER=\"letsencrypt\"\n\n# \u98de\u725bOS SSL\u8bc1\u4e66\u8def\u5f84\nSSLS_DIR=\"\/usr\/trim\/var\/trim_connect\/ssls\"\n\n# \u98de\u725bOS\u91cd\u542f\u670d\u52a1\u547d\u4ee4\u884c\nReloadCMD=\"systemctl restart webdav.service smbftpd.service trim_nginx.service\"\n\n# \u68c0\u67e5\u73b0\u6709\u8bc1\u4e66\u6709\u6548\u671f\uff08\u5982\u679c\u5b58\u5728\uff09\nCURRENT_CERT_DIR=$(psql -t -A -U postgres -d trim_connect -c \"SELECT private_key FROM cert WHERE domain = '\"${DOMAIN}\"' AND is_default = 1;\" | sed 's|\/'\"${DOMAIN}\"'.key||g' 2>\/dev\/null)\nif &#91; -n \"${CURRENT_CERT_DIR}\" ] &amp;&amp; &#91; -f \"${CURRENT_CERT_DIR}\/\"${DOMAIN}\".crt\" ]; then\n    CURRENT_CERT_EXPIRE=$(date -d \"$(openssl x509 -in \"${CURRENT_CERT_DIR}\/\"${DOMAIN}\".crt\" -noout -enddate | cut -d= -f2)\" +%s)\n    CURRENT_TIME=$(date +%s)\n    DAYS_REMAINING=$(( (CURRENT_CERT_EXPIRE - CURRENT_TIME) \/ 86400 ))\n    \n    if &#91; ${DAYS_REMAINING} -gt 30 ]; then\n        echo \"\u5f53\u524d\u8bc1\u4e66\u8fd8\u6709 ${DAYS_REMAINING} \u5929\u6709\u6548\u671f\uff0c\u5927\u4e8e30\u5929\uff0c\u8df3\u8fc7\u8bc1\u4e66\u7533\u8bf7\"\n        # \u8bbe\u7f6e\u53d8\u91cf\u4ee5\u4fbf\u540e\u7eed\u6b65\u9aa4\u4f7f\u7528\u73b0\u6709\u8bc1\u4e66\u76ee\u5f55\n        DOMAIN_SSL_DIR=${CURRENT_CERT_DIR}\n        # \u83b7\u53d6\u73b0\u6709\u8bc1\u4e66\u7684\u65f6\u95f4\u4fe1\u606f\n        CERT_CREATE=$(stat -c %Y \"${DOMAIN_SSL_DIR}\/\"${DOMAIN}\".crt\")\n        CERT_CREATE_TT=${CERT_CREATE}000\n        CERT_RENEW=$(date -d @${CERT_CREATE} +%s --date=\"+90 days\")\n        CERT_RENEW_TT=${CERT_RENEW}000\n        # \u8df3\u8f6c\u5230\u8bc1\u4e66\u5b89\u88c5\u540e\u6b65\u9aa4\n        goto_install=\"yes\"\n    fi\nfi\n\n# \u5236\u4f5c\u8bc1\u4e66\uff08\u53ea\u5728\u9700\u8981\u65f6\u6267\u884c\uff09\nif &#91; \"${goto_install}\" != \"yes\" ]; then\n    if &#91;&#91; \"${CERT_SERVER}\" == \"letsencrypt\" ]] ; then\n        ${ACME_DIR}\/acme.sh --force --log --issue --server ${CERT_SERVER} --dns ${DNS} --dnssleep ${DNS_SLEEP} -d \"${DOMAIN}\" -d \"*.${DOMAIN}\"\n        if &#91; $? -ne 0 ] ; then\n            echo -e  \"\u5236\u4f5c\u8bc1\u4e66\u5931\u8d25\uff0c\u811a\u672c\u9000\u51fa. . .\"\n            exit\n        fi\n    fi\n\n    if &#91;&#91; \"${CERT_SERVER}\" == \"zerossl\" ]] ; then\n        ${ACME_DIR}\/acme.sh --register-account -m ${Email} --server ${CERT_SERVER} --eab-kid ${EAB_kid} --eab-hmac-key ${EAB_hmac_key} --issue --dns ${DNS} --dnssleep ${DNS_SLEEP} -d \"${DOMAIN}\" -d \"*.${DOMAIN}\"\n        if &#91; $? -ne 0 ] ; then\n            echo -e  \"\u5236\u4f5c\u8bc1\u4e66\u5931\u8d25\uff0c\u811a\u672c\u9000\u51fa. . .\"\n            exit\n        fi\n    fi\n\n    # \u83b7\u53d6\u8bc1\u4e66\u8be6\u7ec6\u65f6\u95f4\u6233\u5e76\u521b\u5efa\u76ee\u5f55\n    CertCreateTime=\"$(${ACME_DIR}\/acme.sh --info -d \"${DOMAIN}\" | grep CertCreateTimeStr= | awk -F= '{print $2}' | sed 's|T| |g' | sed 's|Z||g')\"\n    NextRenewTime=\"$(${ACME_DIR}\/acme.sh --info -d \"${DOMAIN}\" | grep Le_NextRenewTimeStr= | awk -F= '{print $2}' | sed 's|T| |g' | sed 's|Z||g')\"\n    CERT_CREATE=$(date -d \"${CertCreateTime} 7 hour\" +%s)\n    CERT_CREATE_TT=$(date -d \"${CertCreateTime} 7 hour\" +%s%3N)\n    CERT_RENEW=$(date -d \"${NextRenewTime} 1 month 7 hour\" +%s)\n    CERT_RENEW_TT=$(date -d \"${NextRenewTime} 1 month 7 hour\" +%s%3N)\n    mkdir -p ${SSLS_DIR}\/\"${DOMAIN}\"\/${CERT_CREATE}\n    DOMAIN_SSL_DIR=${SSLS_DIR}\/\"${DOMAIN}\"\/${CERT_CREATE}\n\n    # \u5b89\u88c5\u8bc1\u4e66\u5230\u57df\u540d\u8bc1\u4e66\u76ee\u5f55\n    ${ACME_DIR}\/acme.sh --install-cert -d \"${DOMAIN}\" --cert-file ${DOMAIN_SSL_DIR}\/\"${DOMAIN}\".crt --key-file ${DOMAIN_SSL_DIR}\/\"${DOMAIN}\".key --fullchain-file ${DOMAIN_SSL_DIR}\/fullchain.crt --ca-file ${DOMAIN_SSL_DIR}\/issuer_certificate.crt --reloadcmd \"${ReloadCMD}\"\n\n# \u914d\u7f6e\u8bc1\u4e66\u6587\u4ef6\u6743\u9650\uff08\u516c\u5f00\uff0c\u4f46\u65e0\u9700\u6267\u884c\u6743\u9650\uff09\nchmod 644 \"${DOMAIN_SSL_DIR}\/${DOMAIN}.crt\"\nchmod 644 \"${DOMAIN_SSL_DIR}\/fullchain.crt\"\nchmod 644 \"${DOMAIN_SSL_DIR}\/issuer_certificate.crt\"\n# \u79c1\u94a5\u6587\u4ef6\uff08\u4e25\u683c\u9650\u5236\uff09\nchmod 600 \"${DOMAIN_SSL_DIR}\/${DOMAIN}.key\"\n# \u76ee\u5f55\u6743\u9650\uff08\u53ef\u9009\uff09\nchmod 750 \"${DOMAIN_SSL_DIR}\"\nfi\n\n# \u83b7\u53d6\u8bc1\u4e66\u9881\u53d1\u8005\u4fe1\u606f\nCERT_ISSUED_BY=$(openssl x509 -in ${DOMAIN_SSL_DIR}\/\"${DOMAIN}\".crt -noout -issuer | awk -F' = ' '{print $4}')\n\n# \u83b7\u53d6\u8bc1\u4e66\u52a0\u5bc6\u7c7b\u578b\u4fe1\u606f\nSIG_ALGO=$(openssl x509 -in ${DOMAIN_SSL_DIR}\/\"${DOMAIN}\".crt -noout -text | awk '\/Signature Algorithm\/ {print $3}' | awk 'END {print}')\nshopt -s nocasematch\ncase $SIG_ALGO in\n    *RSA*)\n        ALGO_TYPE=\"RSA\"\n        ;;\n    *ECDSA*)\n        ALGO_TYPE=\"ECDSA\"\n        ;;\n    *ECC*)\n        ALGO_TYPE=\"ECC\"\n        ;;\n    *SM2*)\n        ALGO_TYPE=\"SM2\"\n        ;;\n    *)\n        ALGO_TYPE=\"UNKNOW\"\n        ;;\nesac\n\n# \u65b0\u589e\u6216\u66f4\u65b0\u98de\u725bOS\u8bc1\u4e66\u6570\u636e\u5e93\u4fe1\u606f\nif &#91; ! -z $(psql -t -A -U postgres -d trim_connect -c \"SELECT domain FROM cert WHERE domain = '\"${DOMAIN}\"';\" | sed  '\/^\\s*$\/d') ] ; then\n    # \u5148\u53d6\u6d88\u8be5\u57df\u540d\u4e0b\u6240\u6709\u8bc1\u4e66\u7684\u9ed8\u8ba4\u72b6\u6001\n    psql -U postgres -d trim_connect -c \"UPDATE cert SET is_default = 0 WHERE domain = '\"${DOMAIN}\"';\"\n    # \u98de\u725bOS\u66f4\u65b0\u6570\u636e\u5e93\u8bc1\u4e66\u4fe1\u606f\n    psql -U postgres -d trim_connect -c \"UPDATE cert SET valid_from = ${CERT_CREATE_TT}, valid_to = ${CERT_RENEW_TT}, encrypt_type = '${ALGO_TYPE}', issued_by = '${CERT_ISSUED_BY}', last_renew_time =  ${TT}, des = '\u7531acme.sh\u81ea\u52a8\u751f\u6210\u7684\u8bc1\u4e66', private_key = '${DOMAIN_SSL_DIR}\/\"${DOMAIN}\".key', certificate = '${DOMAIN_SSL_DIR}\/\"${DOMAIN}\".crt', issuer_certificate = '${DOMAIN_SSL_DIR}\/issuer_certificate.crt', status = 'suc', created_time =  ${TT}, updated_time =  ${TT}, is_default = 1 WHERE domain = '\"${DOMAIN}\"';\"\n    if &#91; $? -ne 0 ] ; then\n        echo -e  \"\u66f4\u65b0\u6570\u636e\u5e93\u8bc1\u4e66\u4fe1\u606f\u5931\u8d25\uff0c\u811a\u672c\u9000\u51fa. . .\"\n        exit\n    fi\nelse\n    DOMAIN_ID=$&#91;$(psql -t -A -U postgres -d trim_connect -c \"SELECT id FROM cert ORDER BY id ASC;\" | awk 'END {print}')+1]\n    psql -U postgres -d trim_connect -c \"INSERT INTO cert VALUES (\"${DOMAIN_ID}\", '\"${DOMAIN}\"', '*.\"${DOMAIN}\",\"${DOMAIN}\"', ${CERT_CREATE_TT}, ${CERT_RENEW_TT}, '${ALGO_TYPE}', '${CERT_ISSUED_BY}', ${TT}, '\u7531acme.sh\u81ea\u52a8\u751f\u6210\u7684\u8bc1\u4e66', 1, null, 'upload', null, '${DOMAIN_SSL_DIR}\/\"${DOMAIN}\".key', '${DOMAIN_SSL_DIR}\/\"${DOMAIN}\".crt', '${DOMAIN_SSL_DIR}\/issuer_certificate.crt', 'suc', ${TT}, ${TT});\"\n    if &#91; $? -ne 0 ] ; then\n        echo -e  \"\u66f4\u65b0\u6570\u636e\u5e93\u8bc1\u4e66\u4fe1\u606f\u5931\u8d25\uff0c\u811a\u672c\u9000\u51fa. . .\"\n        exit\n    fi\nfi\n\n# \u66f4\u65b0\u98de\u725bOS NGINX \u914d\u7f6e\u6587\u4ef6\n\\cp -rfL \/usr\/trim\/etc\/network_gateway_cert.conf \/usr\/trim\/etc\/network_gateway_cert.conf.${TT}.bak\nNETWORK_GATEWAY_CERT=\"{\\\"host\\\":\\\"\"${DOMAIN}\"\\\",\\\"cert\\\":\\\"${DOMAIN_SSL_DIR}\/fullchain.crt\\\",\\\"key\\\":\\\"${DOMAIN_SSL_DIR}\/\"${DOMAIN}\".key\\\"},\"\ngrep -E \"\"${DOMAIN}\"\" \/usr\/trim\/etc\/network_gateway_cert.conf >\/dev\/null 2>&amp;1\nif &#91; $? -eq 0 ] ; then\n    sed -i \"s|{\\\"host\\\":.*\\\/usr\\\/.*\"${DOMAIN}\".*},|${NETWORK_GATEWAY_CERT}|g\" \/usr\/trim\/etc\/network_gateway_cert.conf\nelse\n    awk '{gsub(\/^.\/,\"\"); print}' \/usr\/trim\/etc\/network_gateway_cert.conf > \/tmp\/fn1\n    sed -i \"1i&#91;${NETWORK_GATEWAY_CERT}\" \/tmp\/fn1\n    sed -i ':a;N;$!ba;s\/\\n\/\/g' \/tmp\/fn1\n    \\cp -rfL \/tmp\/fn1 \/usr\/trim\/etc\/network_gateway_cert.conf\n    rm -rf \/tmp\/fn1\nfi\n\n# \u98de\u725bOS\u5220\u9664\u65e0\u6548\u8bc1\u4e66\uff08\u4fdd\u7559\u5f53\u524d\u8bc1\u4e66\u76ee\u5f55\uff0c\u5220\u9664\u5176\u4ed6\u6240\u6709\uff09\nif &#91; -n \"${DOMAIN_SSL_DIR}\" ]; then\n    find ${SSLS_DIR}\/\"${DOMAIN}\"\/ -mindepth 1 -maxdepth 1 -type d ! -path \"${DOMAIN_SSL_DIR}\" -exec rm -rf {} \\; > \/dev\/null 2>&amp;1\nfi\n\n# \u91cd\u542f\u670d\u52a1\u5e76\u589e\u52a0\u65e5\u5fd7\u8f93\u51fa\necho \"\u6b63\u5728\u91cd\u542f\u670d\u52a1: ${ReloadCMD}\"\nif ${ReloadCMD}; then\n    echo \"\u670d\u52a1\u91cd\u542f\u6210\u529f\"\nelse\n    echo \"\u670d\u52a1\u91cd\u542f\u5931\u8d25\uff0c\u8bf7\u68c0\u67e5\"\n    exit 1\nfi\n\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>\u98de\u725bOS\u7ed1\u5b9a\u81ea\u6709\u57df\u540d\u540e\uff0c\u901a\u8fc7acme.sh\u5de5\u5177+CF\u7ec4\u5408\uff0c\u81ea\u52a8\u66f4\u65b0ssl\u8bc1\u4e66\uff0c\u81ea\u52a8\u7eed\u7b7e\u7684\u65b9\u6848\u3002\u4ee5\u4e0b\u6240\u6709\u547d\u4ee4\u5728r [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","site-transparent-header":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[19],"tags":[],"class_list":["post-1245","post","type-post","status-publish","format-standard","hentry","category-19"],"_links":{"self":[{"href":"https:\/\/www.jumoon.top\/index.php?rest_route=\/wp\/v2\/posts\/1245","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jumoon.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jumoon.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jumoon.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jumoon.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1245"}],"version-history":[{"count":2,"href":"https:\/\/www.jumoon.top\/index.php?rest_route=\/wp\/v2\/posts\/1245\/revisions"}],"predecessor-version":[{"id":1248,"href":"https:\/\/www.jumoon.top\/index.php?rest_route=\/wp\/v2\/posts\/1245\/revisions\/1248"}],"wp:attachment":[{"href":"https:\/\/www.jumoon.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1245"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jumoon.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1245"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jumoon.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1245"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}