查看“︁使用Let's Encrypt全自动更新阿里云oss”︁的源代码
←
使用Let's Encrypt全自动更新阿里云oss
跳转到导航
跳转到搜索
因为以下原因，您没有权限编辑该页面：
您请求的操作仅限属于这些用户组的用户执行：*、
用户
您可以查看和复制此页面的源代码。
<p class="ds-markdown-paragraph"><span class="">本方案将指导你完成从零到全自动的SSL证书配置，包括：</span></p><ol start="1" class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><span class="">在服务器上安装acme.sh</span></p></li><li><p class="ds-markdown-paragraph"><span class="">配置阿里云DNS API密钥（权限最小化）</span></p></li><li><p class="ds-markdown-paragraph"><span class="">申请泛域名证书（一次配置，覆盖所有子域名）</span></p></li><li><p class="ds-markdown-paragraph"><span class="">编写自动部署脚本，将证书推送到OSS</span></p></li><li><p class="ds-markdown-paragraph"><span class="">配置定时任务，实现全自动续期</span></p></li></ol><h2><span class="">第一步：在服务器上安装 acme.sh</span></h2><p class="ds-markdown-paragraph"><span class="">登录你的Linux服务器（使用SSH），执行以下命令：</span></p><pre class="prettyprint"># 安装acme.sh（自动安装在 ~/.acme.sh/ 目录） curl https://get.acme.sh | sh -s email=你的邮箱@example.com # 重新加载环境变量，使acme.sh命令生效 source ~/.bashrc # 验证安装成功 acme.sh --version</pre><p><br/></p><p class="ds-markdown-paragraph"><span class="">安装脚本会自动创建一个每日执行的定时任务（cron job），这是未来自动续期的心脏</span><a href="https://blog.csdn.net/weixin_29305337/article/details/158176455" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。可以用以下命令查看：</span></p><p><span class="d813de27">bash</span></p><pre>crontab -l | grep acme</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h2><span class="">第二步：创建阿里云RAM子账号并授权</span></h2><blockquote><p class="ds-markdown-paragraph"><span class="">⚠️ </span><strong><span class="">安全警告</span></strong><span class="">：千万不要直接使用主账号的AccessKey！必须创建权限最小化的子账号</span><a href="https://blog.csdn.net/weixin_29305337/article/details/158176455" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p></blockquote><h3><span class="">2.1 创建RAM用户</span></h3><ol start="1" class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><span class="">登录</span><a href="https://ram.console.aliyun.com/" target="_blank" rel="noreferrer"><span class="">阿里云RAM控制台</span></a></p></li><li><p class="ds-markdown-paragraph"><span class="">点击 </span><strong><span class="">身份管理 > 用户</span></strong><span class=""> → </span><strong><span class="">创建用户</span></strong></p></li><li><p class="ds-markdown-paragraph"><span class="">填写：</span></p></li><ul class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><strong><span class="">登录名称</span></strong><span class="">：</span><code>acme-dns</code><span class="">（可自定义）</span></p></li><li><p class="ds-markdown-paragraph"><strong><span class="">访问方式</span></strong><span class="">：勾选 </span><strong><span class="">OpenAPI调用访问</span></strong><span class="">（只选这一个）</span></p></li></ul><li><p class="ds-markdown-paragraph"><span class="">点击 </span><strong><span class="">确定</span></strong></p></li></ol><h3><span class="">2.2 记录AccessKey</span></h3><p class="ds-markdown-paragraph"><span class="">创建成功后，系统会生成 </span><strong><span class="">AccessKey ID</span></strong><span class=""> 和 </span><strong><span class="">AccessKey Secret</span></strong><span class="">。</span><strong><span class="">立即保存</span></strong><span class="">这两串字符，关闭页面后就看不到了！</span></p><p class="ds-markdown-paragraph"><span class="">示例格式：</span></p><p><span class="d813de27">text</span></p><pre>AccessKey ID: LTAI5txxxxxxAccessKey Secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">2.3 授权DNS完全访问权限</span></h3><ol start="1" class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><span class="">在用户详情页，点击 </span><strong><span class="">权限管理</span></strong><span class=""> → </span><strong><span class="">添加权限</span></strong></p></li><li><p class="ds-markdown-paragraph"><span class="">搜索框输入 </span><code>AliyunDNSFullAccess</code><span class="">，勾选这个策略</span></p></li><li><p class="ds-markdown-paragraph"><span class="">点击 </span><strong><span class="">确定</span></strong></p></li></ol><blockquote><p class="ds-markdown-paragraph"><span class="">这个策略只授权操作云解析DNS的权限，无法访问你的OSS、ECS等其他资源</span><a href="https://cloud.tencent.com.cn/developer/article/2548435?policyId=1004" target="_blank" rel="noreferrer" style="cursor: default;"></a><a href="https://blog.csdn.net/weixin_29305337/article/details/158176455" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p></blockquote><h2><span class="">第三步：配置acme.sh的阿里云DNS API密钥</span></h2><p class="ds-markdown-paragraph"><span class="">将刚才获取的AccessKey配置到acme.sh中：</span></p><pre># 编辑acme.sh的配置文件 vim ~/.acme.sh/account.conf</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">在文件末尾添加以下两行（替换成你自己的密钥）：</span></p><pre>export Ali_Key="LTAI5txxxxxx" # 替换为你的AccessKey ID export Ali_Secret="xxxxxxxxxxxxxxxx" # 替换为你的AccessKey Secret</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">保存退出后，让配置生效：</span></p><pre>source ~/.acme.sh/account.conf</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><blockquote><p class="ds-markdown-paragraph"><span class="">📌 </span><strong><span class="">说明</span></strong><span class="">：acme.sh会自动从 </span><code>account.conf</code><span class=""> 读取这两个环境变量，后续所有操作无需再手动输入</span><a href="https://developer.aliyun.com/article/1721022" target="_blank" rel="noreferrer" style="cursor: default;"></a><a href="https://cloud.tencent.com.cn/developer/article/2548435?policyId=1004" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p></blockquote><h2><span class="">第四步：申请泛域名证书</span></h2><h3><span class="">4.1 选择CA机构（可选）</span></h3><p class="ds-markdown-paragraph"><span class="">acme.sh默认使用ZeroSSL，如果你偏爱Let's Encrypt，可以切换：</span></p><pre>acme.sh --set-default-ca --server letsencrypt</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">4.2 执行申请命令</span></h3><p class="ds-markdown-paragraph"><span class="">假设你的域名是 </span><code>example.com</code><span class="">，图片使用的OSS域名是 </span><code>img.example.com</code><span class="">：</span></p><pre>acme.sh --issue --dns dns_ali \ -d "example.com" \ -d "*.example.com" \ --keylength ec-256</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">命令说明</span><a href="https://developer.aliyun.com/article/1721022" target="_blank" rel="noreferrer" style="cursor: default;"></a><a href="https://itrustssl.cn/column/wiki/225.html" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">：</span></p><table><thead><tr class="firstRow"><th><span class="">参数</span></th><th><span class="">含义</span></th></tr></thead><tbody><tr><td><code>--issue</code></td><td><span class="">申请新证书</span></td></tr><tr><td><code>--dns dns_ali</code></td><td><span class="">使用阿里云DNS API进行验证</span></td></tr><tr><td><code>-d "example.com"</code></td><td><span class="">申请主域名证书</span></td></tr><tr><td><code>-d "*.example.com"</code></td><td><span class="">申请泛域名证书（覆盖所有子域名）</span></td></tr><tr><td><code>--keylength ec-256</code></td><td><span class="">使用ECC加密（更安全、更快，推荐）</span></td></tr></tbody></table><blockquote><p class="ds-markdown-paragraph"><span class="">💡 </span><strong><span class="">注意</span></strong><span class="">：如果同时申请泛域名 </span><code>*.example.com</code><span class=""> 和主域名 </span><code>example.com</code><span class="">，建议两个都写上，否则访问 </span><code>https://example.com</code><span class=""> 时会提示证书不匹配</span><a href="https://developer.aliyun.com/article/1721022" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p></blockquote><h3><span class="">4.3 等待签发</span></h3><p class="ds-markdown-paragraph"><span class="">执行后，acme.sh会自动：</span></p><ol start="1" class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><span class="">调用阿里云DNS API，添加 </span><code>_acme-challenge.example.com</code><span class=""> 的TXT验证记录</span></p></li><li><p class="ds-markdown-paragraph"><span class="">等待CA机构验证（约10-30秒）</span></p></li><li><p class="ds-markdown-paragraph"><span class="">验证通过后，自动删除该TXT记录</span></p></li><li><p class="ds-markdown-paragraph"><span class="">证书签发完成</span></p></li></ol><p class="ds-markdown-paragraph"><span class="">看到类似以下输出表示成功：</span></p><pre>[INFO] Your cert is in: /root/.acme.sh/example.com/example.com.cer[INFO] Your cert key is in: /root/.acme.sh/example.com/example.com.key[INFO] The intermediate CA cert is in: /root/.acme.sh/example.com/ca.cer[INFO] And the full chain certs is there: /root/.acme.sh/example.com/fullchain.cer</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h2><span class="">第五步：安装ossutil工具（用于自动推送到OSS）</span></h2><h3><span class="">5.1 下载并安装ossutil</span></h3><pre># 下载ossutil wget # 添加执行权限 chmod +x ossutil64 # 移动到系统路径 sudo mv ossutil64 /usr/local/bin/ossutil</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">5.2 配置ossutil</span></h3><p><span class="d813de27">bash</span></p><pre>ossutil config</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">按提示输入：</span></p><ul class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><strong><span class="">endpoint</span></strong><span class="">：你的OSS Bucket所在地域，例如 </span><code>oss-cn-hangzhou.aliyuncs.com</code></p></li><li><p class="ds-markdown-paragraph"><strong><span class="">accessKeyID</span></strong><span class="">：</span><strong><span class="">这里需要重新创建一个RAM子账号</span></strong><span class="">（和DNS那个分开，权限更小）</span></p></li><li><p class="ds-markdown-paragraph"><span class=""><strong><span class=""><span class="">stsToken</span></span></strong><span class="">：可以不输入（临时授权用）</span></span></p></li><li><p class="ds-markdown-paragraph"><strong><span class="">accessKeySecret</span></strong><span class="">：对应的密钥</span></p></li></ul><blockquote><p class="ds-markdown-paragraph"><span class="">📌 </span><strong><span class="">最佳实践</span></strong><span class="">：建议为ossutil单独创建一个RAM子账号，只授权OSS相关权限（如 </span><code>AliyunOSSFullAccess</code><span class="">），不要复用DNS的那个密钥。</span></p></blockquote><p class="ds-markdown-paragraph"><span class="">配置文件会保存在 </span><code>~/.ossutilconfig</code><a href="https://www.alibabacloud.com/help/zh/oss/developer-reference/config?spm=a2c63.p38356.879954.17.65d33782KrI9A4" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p><h2><span class="">第六步：编写自动部署脚本</span></h2><p class="ds-markdown-paragraph"><span class="">创建脚本文件：</span></p><pre>vim ~/deploy_cert_to_oss.sh</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">将以下内容复制进去（</span><strong><span class="">根据实际情况修改变量值</span></strong><span class="">）：</span></p><pre>#!/bin/bash # ========== 请修改变量值 ========== DOMAIN="example.com" # 你的主域名 BUCKET_NAME="your-bucket-name" # OSS Bucket名称 # 列出所有需要更新证书的OSS自定义域名（用空格分隔） OSS_DOMAINS="img.example.com music.example.com oss.example.com" # ================================= # 证书文件路径（泛域名证书，所有子域名共用） CERT_PATH="/root/.acme.sh/${DOMAIN}/fullchain.cer" KEY_PATH="/root/.acme.sh/${DOMAIN}/${DOMAIN}.key" LOG_FILE="/var/log/cert_deploy.log" log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> ${LOG_FILE} } log "开始部署证书到OSS（共 $(echo ${OSS_DOMAINS} | wc -w) 个域名）" for OSS_DOMAIN in ${OSS_DOMAINS}; do log "正在部署: ${OSS_DOMAIN}" ossutil bucket-https \ --method put \ --bucket ${BUCKET_NAME} \ --cert ${CERT_PATH} \ --key ${KEY_PATH} \ --domain ${OSS_DOMAIN} \ --force >> ${LOG_FILE} 2>&1 if [ $? -eq 0 ]; then log "✅ ${OSS_DOMAIN} 证书部署成功" else log "❌ ${OSS_DOMAIN} 证书部署失败" fi done log "全部部署完成"</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><blockquote><p class="ds-markdown-paragraph"><span class="">⚠️ </span><strong><span class="">重要提示</span></strong><span class="">：</span><code>ossutil bucket-https</code><span class=""> 的具体参数可能因版本不同而有差异。建议先执行 </span><code>ossutil bucket-https --help</code><span class=""> 查看帮助，确认命令格式</span><a href="https://www.alibabacloud.com/help/zh/oss/developer-reference/config?spm=a2c63.p38356.879954.17.65d33782KrI9A4" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p></blockquote><p class="ds-markdown-paragraph"><span class="">赋予脚本执行权限：</span></p><p><span class="d813de27">bash</span></p><pre>chmod +x ~/deploy_cert_to_oss.sh</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">6.1 手动测试脚本</span></h3><p class="ds-markdown-paragraph"><span class="">先手动执行一次，验证是否能成功推送到OSS：</span></p><p><span class="d813de27">bash</span></p><pre>~/deploy_cert_to_oss.sh</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">检查日志：</span></p><p><span class="d813de27">bash</span></p><pre>cat /var/log/cert_deploy.log</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">如果看到 </span><code>✅ 证书部署成功</code><span class="">，说明脚本正常。然后去阿里云OSS控制台的域名管理页面确认证书是否已更新。</span></p><h2><span class="">第七步：配置自动续期 + 自动部署</span></h2><p class="ds-markdown-paragraph"><span class="">acme.sh 支持 </span><code>--renew-hook</code><span class=""> 参数，可以在每次成功续期后自动执行自定义脚本</span><a href="https://deepwiki.com/acmesh-official/acme.sh/5.6-creating-custom-deployment-hooks" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p><h3><span class="">7.1 使用renew-hook重新申请证书</span></h3><pre>acme.sh --issue --dns dns_ali \ -d "example.com" \ -d "*.example.com" \ --keylength ec-256 \ --renew-hook "~/deploy_cert_to_oss.sh"</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">这条命令会：</span></p><ol start="1" class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><span class="">申请证书（如果已有证书则更新）</span></p></li><li><p class="ds-markdown-paragraph"><span class="">证书更新成功后，自动执行 </span><code>deploy_cert_to_oss.sh</code><span class=""> 脚本</span></p></li></ol><h3><span class="">7.2 验证定时任务已配置</span></h3><p class="ds-markdown-paragraph"><span class="">acme.sh安装时会自动添加定时任务，每60天检查并续期证书</span><a href="https://developer.aliyun.com/article/1721022" target="_blank" rel="noreferrer" style="cursor: default;"></a><a href="https://cloud.tencent.com.cn/developer/article/2548435?policyId=1004" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p><pre>crontab -l | grep acme</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">应该能看到类似这样的输出：</span></p><pre>0 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">这个定时任务会在每天零点执行，检查所有证书是否需要续期。当续期发生时，会自动触发 </span><code>--renew-hook</code><span class=""> 脚本，将新证书推送到OSS。</span></p><p><br/></p><h2><span class="">验证与测试</span></h2><h3><span class="">1. 检查证书信息</span></h3><pre>acme.sh --info -d example.com</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">2. 强制测试续期（不实际更新证书）</span></h3><p><span class="d813de27">bash</span></p><pre>acme.sh --renew -d example.com --force --renew-hook "~/deploy_cert_to_oss.sh"</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">3. 浏览器访问验证</span></h3><p class="ds-markdown-paragraph"><span class="">用浏览器打开 </span><code>https://img.yourdomain.com/任意图片.jpg</code><span class="">，点击地址栏的锁图标，查看证书详情：</span></p><ul class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><strong><span class="">颁发者</span></strong><span class="">：Let's Encrypt（或ZeroSSL）</span></p></li><li><p class="ds-markdown-paragraph"><strong><span class="">有效期</span></strong><span class="">：应该是90天内</span></p></li><li><p class="ds-markdown-paragraph"><strong><span class="">使用者</span></strong><span class="">：包含 </span><code>*.yourdomain.com</code></p></li></ul><h3><span class="">4. 检查部署日志</span></h3><p><span class="d813de27">bash</span></p><pre>cat /var/log/cert_deploy.log</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h2><span class="">常见问题与解决</span></h2><table><thead><tr class="firstRow"><th><span class="">问题</span></th><th><span class="">可能原因</span></th><th><span class="">解决方案</span></th></tr></thead><tbody><tr><td><span class="">申请证书失败，提示DNS错误</span></td><td><span class="">DNS解析延迟</span></td><td><span class="">添加 </span><code>--dnssleep 300</code><span class=""> 参数，等待5分钟再验证</span><a href="https://developer.aliyun.com/article/1721022" target="_blank" rel="noreferrer" style="cursor: default;"></a></td></tr><tr><td><code>ossutil bucket-https</code><span class=""> 报错</span></td><td><span class="">版本差异或参数错误</span></td><td><span class="">先执行 </span><code>ossutil bucket-https --help</code><span class=""> 查看正确格式</span></td></tr><tr><td><span class="">证书部署后浏览器不认</span></td><td><span class="">缓存问题</span></td><td><span class="">清除CDN缓存（如有），或等待5-10分钟</span></td></tr><tr><td><span class="">RAM用户权限不足</span></td><td><span class="">授权策略有遗漏</span></td><td><span class="">检查是否添加了 </span><code>AliyunDNSFullAccess</code><span class="">（DNS用）和OSS相关权限（ossutil用）</span></td></tr></tbody></table><h2><span class="">最终效果</span></h2><p class="ds-markdown-paragraph"><span class="">配置完成后，你什么都不用做。acme.sh的定时任务会自动：</span></p><ul class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><span class="">每60天检查证书有效期</span></p></li><li><p class="ds-markdown-paragraph"><span class="">到期前30天自动续期</span></p></li><li><p class="ds-markdown-paragraph"><span class="">续期成功后自动推送到OSS</span></p></li><li><p class="ds-markdown-paragraph"><span class="">你的网站图片始终保持HTTPS访问</span></p></li></ul><p class="ds-markdown-paragraph"><span class="">一次配置，终身免维护🎉</span></p><p><br/></p>
返回
使用Let's Encrypt全自动更新阿里云oss
。
导航菜单
个人工具
创建账号
登录
命名空间
页面
讨论
大陆简体
查看
阅读
查看源代码
设置
查看历史
更多
搜索
导航
首页
Ubuntu
Android
C&CPP
Java
Python
AI
大杂烩
最近更改
工具
所有页面
文件列表
页面信息
特殊页面