查看“︁使用Let's Encrypt全自动更新阿里云oss”︁的源代码

<p class="ds-markdown-paragraph"><span class="">本方案将指导你完成从零到全自动的SSL证书配置，包括：</span></p><ol start="1" class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><span class="">在服务器上安装acme.sh</span></p></li><li><p class="ds-markdown-paragraph"><span class="">配置阿里云DNS API密钥（权限最小化）</span></p></li><li><p class="ds-markdown-paragraph"><span class="">申请泛域名证书（一次配置，覆盖所有子域名）</span></p></li><li><p class="ds-markdown-paragraph"><span class="">编写自动部署脚本，将证书推送到OSS</span></p></li><li><p class="ds-markdown-paragraph"><span class="">配置定时任务，实现全自动续期</span></p></li></ol><h2><span class="">第一步：在服务器上安装 acme.sh</span></h2><p class="ds-markdown-paragraph"><span class="">登录你的Linux服务器（使用SSH），执行以下命令：</span></p><pre>#&nbsp;安装acme.sh（自动安装在&nbsp;~/.acme.sh/&nbsp;目录）
curl&nbsp;https://get.acme.sh&nbsp;|&nbsp;sh&nbsp;-s&nbsp;email=你的邮箱@example.com

#&nbsp;重新加载环境变量，使acme.sh命令生效
source&nbsp;~/.bashrc

#&nbsp;验证安装成功
acme.sh&nbsp;--version</pre><p><br/></p><p class="ds-markdown-paragraph"><span class="">安装脚本会自动创建一个每日执行的定时任务（cron job），这是未来自动续期的心脏</span><span class="">。可以用以下命令查看：</span></p><pre>crontab&nbsp;-l&nbsp;|&nbsp;grep&nbsp;acme</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h2><span class="">第二步：创建阿里云RAM子账号并授权</span></h2><blockquote><p class="ds-markdown-paragraph"><span class="">⚠️ </span><strong><span class="">安全警告</span></strong><span class="">：千万不要直接使用主账号的AccessKey！必须创建权限最小化的子账号</span><a href="https://blog.csdn.net/weixin_29305337/article/details/158176455" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p></blockquote><h3><span class="">2.1 创建RAM用户</span></h3><ol start="1" class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><span class="">登录</span><a href="https://ram.console.aliyun.com/" target="_blank" rel="noreferrer"><span class="">阿里云RAM控制台</span></a></p></li><li><p class="ds-markdown-paragraph"><span class="">点击 </span><strong><span class="">身份管理 &gt; 用户</span></strong><span class=""> → </span><strong><span class="">创建用户</span></strong></p></li><li><p class="ds-markdown-paragraph"><span class="">填写：</span></p></li><ul class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><strong><span class="">登录名称</span></strong><span class="">：</span><code>acme-dns</code><span class="">（可自定义）</span></p></li><li><p class="ds-markdown-paragraph"><strong><span class="">访问方式</span></strong><span class="">：勾选 </span><strong><span class="">OpenAPI调用访问</span></strong><span class="">（只选这一个）</span></p></li></ul><li><p class="ds-markdown-paragraph"><span class="">点击 </span><strong><span class="">确定</span></strong></p></li></ol><h3><span class="">2.2 记录AccessKey</span></h3><p class="ds-markdown-paragraph"><span class="">创建成功后，系统会生成 </span><strong><span class="">AccessKey ID</span></strong><span class=""> 和 </span><strong><span class="">AccessKey Secret</span></strong><span class="">。</span><strong><span class="">立即保存</span></strong><span class="">这两串字符，关闭页面后就看不到了！</span></p><p class="ds-markdown-paragraph"><span class="">示例格式：</span></p><pre>AccessKey&nbsp;ID:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LTAI5txxxxxx
AccessKey&nbsp;Secret:&nbsp;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">2.3 授权DNS完全访问权限</span></h3><p class="ds-markdown-paragraph">直接授权<span aria-haspopup="true" aria-expanded="false" class="sc-dmyDGl hwjvWO" data-spm-anchor-id="5176.2020520153.0.i130.2a9a336aAnEMtx">AliyunDNSFullAccess</span>，或者自定义策略（DNS编辑权限，用于域名签名验证 - 最小权限原则，推荐）：</p><p><span style="color: #000000;"></span></p><pre class="prettyprint">{
&nbsp;&nbsp;&quot;Version&quot;:&nbsp;&quot;1&quot;,
&nbsp;&nbsp;&quot;Statement&quot;:&nbsp;[
&nbsp;&nbsp;&nbsp;&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;Effect&quot;:&nbsp;&quot;Allow&quot;,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;Action&quot;:&nbsp;[
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;alidns:AddDomainRecord&quot;,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;alidns:DeleteDomainRecord&quot;,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;alidns:DescribeDomainRecords&quot;,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;alidns:DescribeSubDomainRecords&quot;,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;alidns:GetTxtRecordForVerify&quot;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;],
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;Resource&quot;:&nbsp;&quot;*&quot;
&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;]
}</pre><p><span style="color: #000000;"><br/></span></p><p class="ds-markdown-paragraph">直接授权系统策略：AliyunOSSFullAccess（OSS 完全访问权限，包含 oss:PutCname）或&nbsp;自定义策略：</p><pre class="prettyprint">{
&nbsp;&nbsp;&nbsp;&nbsp;&quot;Version&quot;:&nbsp;&quot;1&quot;,
&nbsp;&nbsp;&nbsp;&nbsp;&quot;Statement&quot;:&nbsp;[
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;Effect&quot;:&nbsp;&quot;Allow&quot;,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;Action&quot;:&nbsp;[
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;oss:PutCname&quot;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;],
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;Resource&quot;:&nbsp;[
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;acs:oss:*:*:your-bucket-name&quot;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;]
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;]
}</pre><p class="ds-markdown-paragraph"><br/>如果你用了阿里云数字证书管理服务（云盾）的免费证书，还需要额外加：<br/></p><pre class="prettyprint">{
&nbsp;&nbsp;&nbsp;&nbsp;&quot;Effect&quot;:&nbsp;&quot;Allow&quot;,
&nbsp;&nbsp;&nbsp;&nbsp;&quot;Action&quot;:&nbsp;[
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;yundun-cert:DescribeSSLCertificatePrivateKey&quot;,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;yundun-cert:DescribeSSLCertificatePublicKeyDetail&quot;,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;yundun-cert:CreateSSLCertificate&quot;
&nbsp;&nbsp;&nbsp;&nbsp;],
&nbsp;&nbsp;&nbsp;&nbsp;&quot;Resource&quot;:&nbsp;&quot;*&quot;
}</pre><h2><span class="">第三步：配置acme.sh的阿里云DNS API密钥</span></h2><p class="ds-markdown-paragraph"><span class="">将刚才获取的AccessKey配置到acme.sh中：</span></p><pre>#&nbsp;编辑acme.sh的配置文件
vim&nbsp;~/.acme.sh/account.conf</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">在文件末尾添加以下两行（替换成你自己的密钥）：</span></p><pre>export&nbsp;Ali_Key=&quot;LTAI5txxxxxx&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;替换为你的AccessKey&nbsp;ID
export&nbsp;Ali_Secret=&quot;xxxxxxxxxxxxxxxx&quot;&nbsp;&nbsp;&nbsp;#&nbsp;替换为你的AccessKey&nbsp;Secret</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">保存退出后，让配置生效：</span></p><pre>source&nbsp;~/.acme.sh/account.conf</pre><blockquote><p class="ds-markdown-paragraph"><span class="">📌 </span><strong><span class="">说明</span></strong><span class="">：acme.sh会自动从 </span><code>account.conf</code><span class=""> 读取这两个环境变量，后续所有操作无需再手动输入</span><a href="https://developer.aliyun.com/article/1721022" target="_blank" rel="noreferrer" style="cursor: default;"></a><a href="https://cloud.tencent.com.cn/developer/article/2548435?policyId=1004" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p><p class="ds-markdown-paragraph"><span class=""><br/></span></p></blockquote><h2><span class="">第四步：申请泛域名证书</span></h2><h3><span class="">4.1 选择CA机构（可选）</span></h3><p class="ds-markdown-paragraph"><span class="">acme.sh默认使用ZeroSSL，如果你偏爱Let&#39;s Encrypt，可以切换：</span></p><pre>acme.sh&nbsp;--set-default-ca&nbsp;--server&nbsp;letsencrypt</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">4.2 执行申请命令</span></h3><p class="ds-markdown-paragraph"><span class="">假设你的域名是 </span><code>example.com</code><span class="">，图片使用的OSS域名是 </span><code>img.example.com</code><span class="">：</span></p><pre>acme.sh&nbsp;--issue&nbsp;--dns&nbsp;dns_ali&nbsp;\
&nbsp;&nbsp;-d&nbsp;&quot;example.com&quot;&nbsp;\
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-d&nbsp;&quot;*.example.com&quot;&nbsp;\&nbsp;&nbsp;--keylength&nbsp;ec-256</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">命令说明</span><a href="https://developer.aliyun.com/article/1721022" target="_blank" rel="noreferrer" style="cursor: default;"></a><a href="https://itrustssl.cn/column/wiki/225.html" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">：</span></p><table><thead><tr class="firstRow"><th><span class="">参数</span></th><th><span class="">含义</span></th></tr></thead><tbody><tr><td><code>--issue</code></td><td><span class="">申请新证书</span></td></tr><tr><td><code>--dns dns_ali</code></td><td><span class="">使用阿里云DNS API进行验证</span></td></tr><tr><td><code>-d &quot;example.com&quot;</code></td><td><span class="">申请主域名证书</span></td></tr><tr><td><code>-d &quot;*.example.com&quot;</code></td><td><span class="">申请泛域名证书（覆盖所有子域名）</span></td></tr><tr><td><code>--keylength ec-256</code></td><td><span class="">使用ECC加密（更安全、更快，推荐）</span></td></tr></tbody></table><blockquote><p class="ds-markdown-paragraph"><span class="">💡 </span><strong><span class="">注意</span></strong><span class="">：如果同时申请泛域名 </span><code>*.example.com</code><span class=""> 和主域名 </span><code>example.com</code><span class="">，建议两个都写上，否则访问 </span><code>https://example.com</code><span class=""> 时会提示证书不匹配</span><a href="https://developer.aliyun.com/article/1721022" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p></blockquote><h3><span class="">4.3 等待签发</span></h3><p class="ds-markdown-paragraph"><span class="">执行后，acme.sh会自动：</span></p><ol start="1" class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><span class="">调用阿里云DNS API，添加 </span><code>_acme-challenge.example.com</code><span class=""> 的TXT验证记录</span></p></li><li><p class="ds-markdown-paragraph"><span class="">等待CA机构验证（约10-30秒）</span></p></li><li><p class="ds-markdown-paragraph"><span class="">验证通过后，自动删除该TXT记录</span></p></li><li><p class="ds-markdown-paragraph"><span class="">证书签发完成</span></p></li></ol><p class="ds-markdown-paragraph"><span class="">看到类似以下输出表示成功：</span></p><pre>[INFO]&nbsp;Your&nbsp;cert&nbsp;is&nbsp;in:&nbsp;/root/.acme.sh/example.com/example.com.cer
[INFO]&nbsp;Your&nbsp;cert&nbsp;key&nbsp;is&nbsp;in:&nbsp;/root/.acme.sh/example.com/example.com.key
[INFO]&nbsp;The&nbsp;intermediate&nbsp;CA&nbsp;cert&nbsp;is&nbsp;in:&nbsp;/root/.acme.sh/example.com/ca.cer
[INFO]&nbsp;And&nbsp;the&nbsp;full&nbsp;chain&nbsp;certs&nbsp;is&nbsp;there:&nbsp;/root/.acme.sh/example.com/fullchain.cer</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h2><span class="">第五步：安装ossutil工具（用于自动推送到OSS）</span></h2><h3><span class="">5.1 下载并安装ossutil</span></h3><pre>#&nbsp;下载ossutil，以下是官网方法，不放心可以直接下载&nbsp;https://gosspublic.alicdn.com/ossutil/1.7.18/ossutil64
sudo&nbsp;curl&nbsp;https://gosspublic.alicdn.com/ossutil/install.sh&nbsp;|&nbsp;sudo&nbsp;bash</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">5.2 配置ossutil</span></h3><pre>ossutil&nbsp;config</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">按提示输入：</span></p><ul class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><strong><span class="">endpoint</span></strong><span class="">：你的OSS Bucket所在地域，例如 </span><code>oss-cn-hangzhou.aliyuncs.com</code></p></li><li><p class="ds-markdown-paragraph"><strong><span class="">accessKeyID</span></strong><span class="">：</span><strong><span class="">这里需要重新创建一个RAM子账号</span></strong><span class="">（和DNS那个分开，权限更小）</span></p></li><li><p class="ds-markdown-paragraph"><span class=""><strong><span class=""><span class="">stsToken</span></span></strong><span class="">：可以不输入（临时授权用）</span></span></p></li><li><p class="ds-markdown-paragraph"><strong><span class="">accessKeySecret</span></strong><span class="">：对应的密钥</span></p></li></ul><blockquote><p class="ds-markdown-paragraph"><span class="">📌 </span><strong><span class="">最佳实践</span></strong><span class="">：建议为ossutil单独创建一个RAM子账号，只授权OSS相关权限（如 </span><code>AliyunOSSFullAccess</code><span class="">），不要复用DNS的那个密钥。</span></p></blockquote><p class="ds-markdown-paragraph"><span class="">配置文件会保存在 </span><code>~/.ossutilconfig</code><a href="https://www.alibabacloud.com/help/zh/oss/developer-reference/config?spm=a2c63.p38356.879954.17.65d33782KrI9A4" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p><h2><span class="">第六步：编写自动部署脚本</span></h2><p class="ds-markdown-paragraph"><span class="">创建脚本文件：</span></p><pre>vim&nbsp;~/software/oss-key-deploy.sh</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">将以下内容复制进去（</span><strong><span class="">根据实际情况修改变量值</span></strong><span class="">）：</span></p><pre class="prettyprint">#!/bin/bash
#&nbsp;acme.sh&nbsp;deploy&nbsp;hook&nbsp;-&nbsp;通配符证书&nbsp;*.example.com&nbsp;→&nbsp;OSS&nbsp;your-bucket-name
set&nbsp;-e
set&nbsp;-x

LOG_FILE=&quot;/var/log/cert_deploy.log&quot;
exec&nbsp;&gt;&gt;&nbsp;&quot;$LOG_FILE&quot;&nbsp;2&gt;&amp;1

BUCKET=&quot;your-bucket-name&quot;
DOMAINS=(&quot;img.example.com&quot;&nbsp;&quot;music.example.com&quot;&nbsp;&quot;oss.example.com&quot;)

if&nbsp;[&nbsp;!&nbsp;-f&nbsp;&quot;$CERT_PATH&quot;&nbsp;]&nbsp;||&nbsp;[&nbsp;!&nbsp;-f&nbsp;&quot;$CERT_KEY_PATH&quot;&nbsp;];&nbsp;then
&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;&quot;[ERROR]&nbsp;证书文件不存在:&nbsp;CERT_PATH=$CERT_PATH,&nbsp;CERT_KEY_PATH=$CERT_KEY_PATH&quot;
&nbsp;&nbsp;&nbsp;&nbsp;exit&nbsp;1
fi

for&nbsp;DOMAIN&nbsp;in&nbsp;&quot;${DOMAINS[@]}&quot;;&nbsp;do
&nbsp;&nbsp;&nbsp;&nbsp;TMP_XML=$(mktemp&nbsp;/tmp/oss-cname-XXXXXX.xml)

&nbsp;&nbsp;&nbsp;&nbsp;python3&nbsp;-c&nbsp;&quot;
import&nbsp;sys
with&nbsp;open(sys.argv[1])&nbsp;as&nbsp;f:&nbsp;cert&nbsp;=&nbsp;f.read()
with&nbsp;open(sys.argv[2])&nbsp;as&nbsp;f:&nbsp;key&nbsp;&nbsp;=&nbsp;f.read()
xml&nbsp;=&nbsp;&#39;&#39;&#39;&lt;?xml&nbsp;version=\&quot;1.0\&quot;&nbsp;encoding=\&quot;UTF-8\&quot;?&gt;
&lt;BucketCnameConfiguration&gt;
&nbsp;&nbsp;&lt;Cname&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;Domain&gt;{domain}&lt;/Domain&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;CertificateConfiguration&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;Certificate&gt;{cert}&lt;/Certificate&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;PrivateKey&gt;{key}&lt;/PrivateKey&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;Force&gt;true&lt;/Force&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;/CertificateConfiguration&gt;
&nbsp;&nbsp;&lt;/Cname&gt;
&lt;/BucketCnameConfiguration&gt;&#39;&#39;&#39;.format(domain=sys.argv[3],&nbsp;cert=cert,&nbsp;key=key)
with&nbsp;open(sys.argv[4],&nbsp;&#39;w&#39;)&nbsp;as&nbsp;f:
&nbsp;&nbsp;&nbsp;&nbsp;f.write(xml)
&quot;&nbsp;&quot;$CERT_PATH&quot;&nbsp;&quot;$CERT_KEY_PATH&quot;&nbsp;&quot;$DOMAIN&quot;&nbsp;&quot;$TMP_XML&quot;

&nbsp;&nbsp;&nbsp;&nbsp;ossutil&nbsp;bucket-cname&nbsp;--method&nbsp;put&nbsp;--item&nbsp;certificate&nbsp;&quot;oss://${BUCKET}&quot;&nbsp;&quot;$TMP_XML&quot;
&nbsp;&nbsp;&nbsp;&nbsp;rm&nbsp;-f&nbsp;&quot;$TMP_XML&quot;
&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;&quot;[OK]&nbsp;$(date)&nbsp;${DOMAIN}&nbsp;证书已更新&quot;
done

echo&nbsp;&quot;[DONE]&nbsp;$(date)&nbsp;全部&nbsp;${#DOMAINS[@]}&nbsp;个域名证书更新完成&quot;</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">赋予脚本执行权限：</span></p><pre>chmod&nbsp;+x&nbsp;~/software/oss-key-deploy.sh</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">6.1 手动测试脚本</span></h3><p class="ds-markdown-paragraph"><span class="">先手动执行一次，验证是否能成功推送到OSS：</span></p><pre>~/software/oss-key-deploy.sh</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">检查日志：</span></p><pre>cat&nbsp;/var/log/cert_deploy.log</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">如果看到 </span><code>✅ 证书部署成功</code><span class="">，说明脚本正常。然后去阿里云OSS控制台的域名管理页面确认证书是否已更新。</span></p><h2><span class="">第七步：配置自动续期 + 自动部署</span></h2><p class="ds-markdown-paragraph"><span class="">acme.sh 支持 </span><code>--<code>deploy</code>-hook</code><span class=""> 参数，可以在每次成功续期后自动执行自定义脚本</span><span class="">。</span></p><h3><span class="">7.1 使用renew-hook重新申请证书</span></h3><pre>acme.sh&nbsp;--issue&nbsp;-d&nbsp;&#39;*.example.com&#39;&nbsp;\
&nbsp;&nbsp;--dns&nbsp;dns_ali&nbsp;\
&nbsp;&nbsp;--keylength&nbsp;ec-256&nbsp;\
&nbsp;&nbsp;--renew-hook&nbsp;&quot;$HOME/software/oss-key-deploy.sh&quot;</pre><p class="ds-markdown-paragraph"><span class="">这条命令会：</span></p><ol start="1" class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><span class="">申请证书（如果已有证书则更新）</span></p></li><li><p class="ds-markdown-paragraph"><span class="">证书更新成功后，自动执行 </span><code>oss-key-deploy.sh</code><span class=""> 脚本</span></p><p class="ds-markdown-paragraph"><span class=""></span></p></li></ol><p class="ds-markdown-paragraph"><span class=""></span></p><h3><span class="">7.2 验证定时任务已配置</span></h3><p class="ds-markdown-paragraph"><span class="">acme.sh安装时会自动添加定时任务，每60天检查并续期证书</span><a href="https://developer.aliyun.com/article/1721022" target="_blank" rel="noreferrer" style="cursor: default;"></a><a href="https://cloud.tencent.com.cn/developer/article/2548435?policyId=1004" target="_blank" rel="noreferrer" style="cursor: default;"></a><span class="">。</span></p><pre>crontab&nbsp;-l&nbsp;|&nbsp;grep&nbsp;acme</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">应该能看到类似这样的输出：</span></p><pre>0&nbsp;0&nbsp;*&nbsp;*&nbsp;*&nbsp;&quot;/root/.acme.sh&quot;/acme.sh&nbsp;--cron&nbsp;--home&nbsp;&quot;/root/.acme.sh&quot;&nbsp;&gt;&nbsp;/dev/null</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><p class="ds-markdown-paragraph"><span class="">这个定时任务会在每天零点执行，检查所有证书是否需要续期。当续期发生时，会自动触发 </span><code>--deploy-hook</code><span class=""> 脚本，将新证书推送到OSS。</span></p><p><br/></p><h2><span class="">验证与测试</span></h2><h3><span class="">1. 检查证书信息</span></h3><pre class="prettyprint">acme.sh&nbsp;--info&nbsp;-d&nbsp;*.example.com</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">2. 强制测试续期</span></h3><pre>＃强制更新证书（注意不要频繁调用，更新有次数限制）
acme.sh&nbsp;--renew&nbsp;-d&nbsp;&#39;*.wordstaste.com&#39;&nbsp;--force</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h3><span class="">3. 浏览器访问验证</span></h3><p class="ds-markdown-paragraph"><span class="">用浏览器打开 </span><code>https://img.yourdomain.com/任意图片.jpg</code><span class="">，点击地址栏的锁图标，查看证书详情：</span></p><ul class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><strong><span class="">颁发者</span></strong><span class="">：Let&#39;s Encrypt（或ZeroSSL）</span></p></li><li><p class="ds-markdown-paragraph"><strong><span class="">有效期</span></strong><span class="">：应该是90天内</span></p></li><li><p class="ds-markdown-paragraph"><strong><span class="">使用者</span></strong><span class="">：包含 </span><code>*.yourdomain.com</code></p></li></ul><h3><span class=""><br/></span></h3><h3><span class="">4. 检查部署日志</span></h3><p><span class="d813de27">bash</span></p><pre>cat&nbsp;/var/log/cert_deploy.log</pre><p><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _33882ae"></svg><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewbox="0 0 12 12" fill="none" class="_9bc997d _28d7e84"></svg></p><h2><span class="">最终效果</span></h2><p class="ds-markdown-paragraph"><span class="">配置完成后，你什么都不用做。acme.sh的定时任务会自动：</span></p><ul class=" list-paddingleft-2"><li><p class="ds-markdown-paragraph"><span class="">每60天检查证书有效期</span></p></li><li><p class="ds-markdown-paragraph"><span class="">到期前30天自动续期</span></p></li><li><p class="ds-markdown-paragraph"><span class="">续期成功后自动推送到OSS</span></p></li><li><p class="ds-markdown-paragraph"><span class="">你的网站图片始终保持HTTPS访问</span></p></li></ul><p class="ds-markdown-paragraph"><span class="">一次配置，终身免维护🎉</span></p><p><br/></p>