笔记——腾讯云使用 Certbot + DNSPod 自动签发泛域名证书

目录背景环境信息为什么使用 DNS-01安装 CertbotDNS 插件选择安装腾讯云 DNS 插件配置腾讯云 API签发泛域名证书Docker Nginx 使用证书自动续期配置 systemd 定时任务最终目录结构总结背景服务器上部署了 GitLab、Jenkins、Kibana、WXBotAssistant 等多个服务统一通过 Docker Nginx 做反向代理。随着服务增加为每个子域名单独维护 HTTPS 证书越来越麻烦因此计划申请一个泛域名证书*.quinlanxie.cloud覆盖gitlab.quinlanxie.cloud jenkins.quinlanxie.cloud kibana.quinlanxie.cloud wx.quinlanxie.cloud api.quinlanxie.cloud最终目标一个证书覆盖所有子域名Certbot 自动续期Nginx 统一引用证书新增服务无需重新申请证书最终结构DNSPod | | Certbot DNS-01 Challenge | | Lets Encrypt | | /data/docker/nginx/certs | | Docker Nginx环境信息服务器cat/etc/os-release系统OpenCloudOS 9.4域名quinlanxie.cloud查看 DNSdigNS quinlanxie.cloud结果quinlanxie.cloud. IN NS columba.dnspod.net. quinlanxie.cloud. IN NS trunk.dnspod.net.说明域名解析托管在 DNSPod。为什么使用 DNS-01Let’s Encrypt 支持 HTTP-01 和 DNS-01 两种验证方式。普通域名example.com可以通过 HTTP 验证。但是泛域名*.quinlanxie.cloud必须使用 DNS-01通过 DNS TXT 记录完成验证_acme-challenge.quinlanxie.cloudCertbot 会调用 DNS API 自动创建 TXT 记录验证完成后自动删除。安装 CertbotOpenCloudOS 9.4 属于 RHEL 9 系环境采用 Python venv 安装避免污染系统 Python。安装依赖dnfinstallpython3 python3-pip python3-devel gcc-y创建虚拟环境mkdir-p/opt/certbot python3-mvenv /opt/certbot/venvsource/opt/certbot/venv/bin/activate升级 pippipinstall--upgradepip安装 Certbotpipinstallcertbot验证certbot--version输出certbot 5.7.0DNS 插件选择最开始尝试使用certbot-dns-dnspod但是申请时出现Record.Create error: http error status: 401原因是该插件依赖 DNSPod 老 API需要dns_dnspod_email dns_dnspod_api_id dns_dnspod_api_token当前账号没有绑定邮箱无法完成认证。最终切换到certbot-dns-tencentcloud使用腾讯云 APISecretId SecretKey进行 DNS 管理。安装腾讯云 DNS 插件进入虚拟环境source/opt/certbot/venv/bin/activate安装pipinstallcertbot-dns-tencentcloud检查certbot plugins确认存在dns-tencentcloud配置腾讯云 API在腾讯云控制台访问管理 - API密钥管理创建密钥获取SecretId SecretKey创建配置文件mkdir-p/root/.secrets/certbotvim/root/.secrets/certbot/tencentcloud.ini内容dns_tencentcloud_secret_id AKIDxxxxxxxx dns_tencentcloud_secret_key xxxxxxxxx设置权限chmod600/root/.secrets/certbot/tencentcloud.ini签发泛域名证书证书统一存放/data/docker/nginx/certs/目录/data/docker/nginx/certs ├── letsencrypt ├── work └── logs执行/opt/certbot/venv/bin/certbot certonly\--config-dir /data/docker/nginx/certs/letsencrypt\--work-dir /data/docker/nginx/certs/work\--logs-dir /data/docker/nginx/certs/logs\--authenticatordns-tencentcloud\--dns-tencentcloud-credentials /root/.secrets/certbot/tencentcloud.ini\-d*.quinlanxie.cloud\-dquinlanxie.cloud注意*.quinlanxie.cloud只能匹配xxx.quinlanxie.cloud不包含quinlanxie.cloud所以需要同时申请*.quinlanxie.cloud quinlanxie.cloud成功后/data/docker/nginx/certs/letsencrypt/live/quinlanxie.cloud/生成cert.pem chain.pem fullchain.pem privkey.pemDocker Nginx 使用证书docker-compose 挂载volumes:-/data/docker/nginx/certs/letsencrypt:/etc/letsencrypt:roNginxserver { listen 443 ssl; server_name jenkins.quinlanxie.cloud; ssl_certificate /etc/letsencrypt/live/quinlanxie.cloud/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/quinlanxie.cloud/privkey.pem; location / { proxy_pass http://jenkins:8080; } }修改后nginx-t重新加载dockerexecnginx nginx-sreload自动续期Let’s Encrypt 证书有效期为 90 天Certbot 会定期检查剩余时间超过 30 天跳过剩余时间不足 30 天自动续期由于 Certbot 安装在 venv 中定时任务不要依赖source/opt/certbot/venv/bin/activate直接调用完整路径。创建续期脚本vim/usr/local/bin/certbot-renew.sh内容#!/bin/bash/opt/certbot/venv/bin/certbot renew\--config-dir /data/docker/nginx/certs/letsencrypt\--work-dir /data/docker/nginx/certs/work\--logs-dir /data/docker/nginx/certs/logs\--quiet\--deploy-hookdocker exec nginx nginx -s reload授权chmodx /usr/local/bin/certbot-renew.sh测试/usr/local/bin/certbot-renew.sh配置 systemd 定时任务创建vim/etc/systemd/system/certbot-renew.service内容[Unit] DescriptionCertbot renew [Service] Typeoneshot ExecStart/usr/local/bin/certbot-renew.sh创建定时器vim/etc/systemd/system/certbot-renew.timer内容[Unit] DescriptionCertbot renew timer [Timer] OnCalendar*-*-* 03:30:00 Persistenttrue [Install] WantedBytimers.target启用systemctl daemon-reload systemctlenable--nowcertbot-renew.timer查看systemctl list-timers|grepcertbot测试续期/opt/certbot/venv/bin/certbot renew\--config-dir /data/docker/nginx/certs/letsencrypt\--dry-run成功Congratulations, all simulated renewals succeeded最终目录结构/data/docker/nginx ├── conf.d ├── docker-compose.yml └── certs | ├── letsencrypt | | | └── live | | | └── quinlanxie.cloud | | | ├── fullchain.pem | └── privkey.pem | ├── work └── logs总结最终方案OpenCloudOS 9.4 Python venv Certbot 5.7.0 certbot-dns-tencentcloud DNSPod DNS Lets Encrypt Wildcard Certificate Docker Nginx这套方案解决了多服务 HTTPS 维护问题。以后新增xxx.quinlanxie.cloud只需要增加 Nginx 反向代理配置reload Nginx无需重新申请证书。