免费ssl证书自动续签

经验与学习 2026-11-11 2

通过阿里云+acme.sh 实现ssl证书自动续签，下面以www.forasp.cn为例,支持泛域名解析

1. 下载 acme.sh 程序

apt install -y curl socat cron openssl
curl https://get.acme.sh | sh -s email=你的邮箱

2. 在阿里云，创建RAM 用户，并生成一个 AccessKey
然后创建一个独立资源组，把域名放进去，然后给RAM对应的资源组权限为AliyunDNSFullAccess

export Ali_Key="LTAI5t8YbXXX"
export Ali_Secret="A687b6sXXX"

# 服务器配置，下面执行后，acme.sh 会自动记住

3，验证并生成对应的证书

/root/.acme.sh/acme.sh --issue \
  --dns dns_ali \
  -d forasp.cn \
  -d '*.forasp.cn' \
  --keylength ec-256 \
  --server letsencrypt
#.....省略
[Wed Nov 11 08:06:46 PM CST 2026] Cert success.
-----BEGIN CERTIFICATE-----
MIIDizCCAxKgAwIBAgISBaikAFkzQzewo8wgVdRlR1SQMAoGCCqGSM49BAMDMDMx
#省略......
exuQpTk3aREmLB/bF3nloU5Y3koHJ5Yzd4YhdyAn30VnUjMAgYf6a39uxogK5fE=
-----END CERTIFICATE-----
[Wed Nov 11 08:06:46 PM CST 2026] Your cert is in: /root/.acme.sh/forasp.cn_ecc/forasp.cn.cer
[Wed Nov 11 08:06:46 PM CST 2026] Your cert key is in: /root/.acme.sh/forasp.cn_ecc/forasp.cn.key
[Wed Nov 11 08:06:46 PM CST 2026] The intermediate CA cert is in: /root/.acme.sh/forasp.cn_ecc/ca.cer
[Wed Nov 11 08:06:46 PM CST 2026] And the full-chain cert is in: /root/.acme.sh/forasp.cn_ecc/fullchain.cer
[Wed Nov 11 08:06:46 PM CST 2026] ARI suggestedWindow: 2027-01-09T13:52:17Z to 2027-01-11T09:03:07Z
[Wed Nov 11 08:06:46 PM CST 2026] Next renewal time picked from ARI window: 2027-01-10T00:49:53Z
# 证书生成完毕

4. 创建证书文件夹和配置
# 创建证书位置

mkdir -p /etc/nginx/ssl/forasp.cn
chmod 700 /etc/nginx/ssl/forasp.cn

nginx 对应域名下新增

# SSL 证书
ssl_certificate /etc/nginx/ssl/forasp.cn/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/forasp.cn/privkey.pem;

# TLS 配置
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off;

# 安全响应头
add_header Strict-Transport-Security "max-age=31536000" always;

5. 将生成证书放入到nginx 对应目录，并重启nginx
# 执行自动迁移到对应位置，并重启nginx （它会记录下来，下次也会这样执行）

/root/.acme.sh/acme.sh --install-cert \
  -d forasp.cn \
  --ecc \
  --key-file /etc/nginx/ssl/forasp.cn/privkey.pem \
  --fullchain-file /etc/nginx/ssl/forasp.cn/fullchain.pem \
  --reloadcmd "systemctl reload nginx"

6. 创建定时任务，自动在到期前重新运行，

/root/.acme.sh/acme.sh --install-cronjob
# 验证查看 任务
root@jackgjonline:~# crontab -l
37 2,8,14,20 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null