Change acme.sh command parameters for test server (#684)
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com>pull/686/head
Sergei Malchits
GitHub
parent
dceaffac5c
commit
fb60cd98a7
|
|
@ -44,12 +44,12 @@
|
|||
|
||||
## 6.3 测试证书申请
|
||||
|
||||
在正式申请证书之前，我们先用测试命令(`--issue --test`)来验证是否可以成功申请，这样可以避免在本地配置有误时，反复申请证书失败，超过 Let's Encrypt 的频率上限（比如，每小时、每个域名、每个用户失败最多 5 次），导致后面的步骤无法进行。
|
||||
在正式申请证书之前，我们先用测试命令(`--issue --server letsencrypt_test`)来验证是否可以成功申请，这样可以避免在本地配置有误时，反复申请证书失败，超过 Let's Encrypt 的频率上限（比如，每小时、每个域名、每个用户失败最多 5 次），导致后面的步骤无法进行。
|
||||
|
||||
1. 测试证书申请的命令如下（本文均以 `ECC` 证书为例，因为时至今日，实在没什么理由不用它）：
|
||||
|
||||
```shell
|
||||
acme.sh --issue --server letsencrypt --test -d 二级域名.你的域名.com -w /home/vpsadmin/www/webpage --keylength ec-256
|
||||
acme.sh --issue --server letsencrypt_test -d 二级域名.你的域名.com -w /home/vpsadmin/www/webpage --keylength ec-256
|
||||
```
|
||||
|
||||
::: warning 说明
|
||||
|
|
@ -118,7 +118,7 @@
|
|||
4. 如果这一步出错的话，你可以运行下面的命令，来查看详细的申请过程和具体的错误。（看不懂就隐藏掉敏感信息后，去 Xray 群里问吧）
|
||||
|
||||
```shell
|
||||
acme.sh --issue --server letsencrypt --test -d 二级域名.你的域名.com -w /home/vpsadmin/www/webpage --keylength ec-256 --debug
|
||||
acme.sh --issue --server letsencrypt_test -d 二级域名.你的域名.com -w /home/vpsadmin/www/webpage --keylength ec-256 --debug
|
||||
```
|
||||
|
||||
嗯没错，就是在命令的最后加了一个 `--debug` 参数
|
||||
|
|
@ -127,7 +127,7 @@
|
|||
|
||||
## 6.4 正式证书申请
|
||||
|
||||
1. 申请正式证书的命令如下（即删掉 `--test` 参数，并在最后加入 `--force`参数）：
|
||||
1. 申请正式证书的命令如下（即将 `--server letsencrypt_test` 参数修改为 `--server letsencrypt`，并在最后加入 `--force`参数）：
|
||||
|
||||
```shell
|
||||
acme.sh --set-default-ca --server letsencrypt
|
||||
|
|
|
|||
|
|
@ -46,12 +46,12 @@ acme.sh --upgrade --auto-upgrade
|
|||
|
||||
## 6.3 Testing Certificate Application
|
||||
|
||||
Before officially applying for the certificate, we use the testing command (`--issue --test`) to verify if the application can be successfully submitted. This can avoid repeated failures in applying for a certificate due to incorrect local configuration, exceeding the frequency limit of Let's Encrypt (such as a maximum of 5 failures per hour, per domain, or per user), which may prevent the subsequent steps from being carried out.
|
||||
Before officially applying for the certificate, we use the testing command (`--issue --server letsencrypt_test`) to verify if the application can be successfully submitted. This can avoid repeated failures in applying for a certificate due to incorrect local configuration, exceeding the frequency limit of Let's Encrypt (such as a maximum of 5 failures per hour, per domain, or per user), which may prevent the subsequent steps from being carried out.
|
||||
|
||||
1. The command to apply for a test certificate is as follows (this article uses ECC certificate as an example, because there is really no reason not to use it nowadays):
|
||||
|
||||
```shell
|
||||
acme.sh --issue --server letsencrypt --test -d subdomain.yourdomain.com -w /home/vpsadmin/www/webpage --keylength ec-256
|
||||
acme.sh --issue --server letsencrypt_test -d subdomain.yourdomain.com -w /home/vpsadmin/www/webpage --keylength ec-256
|
||||
```
|
||||
|
||||
(Note: This is a command in shell script for obtaining SSL certificate from Let's Encrypt CA using ACME protocol. It specifies the test server, the subdomain for which the certificate is requested, the webroot directory of the subdomain, and the key length to use for the certificate.)
|
||||
|
|
@ -63,7 +63,7 @@ In addition, if some websites do need to be compatible with certain old devices,
|
|||
|
||||
2. You should eventually see a prompt similar to this:
|
||||
|
||||
````log
|
||||
```log
|
||||
[Wed 30 Dec 2022 04:25:12 AM EST] Using ACME_DIRECTORY: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
[Wed 30 Dec 2022 04:25:13 AM EST] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
[Wed 30 Dec 2022 04:25:13 AM EST] Create account key ok.
|
||||
|
|
@ -110,15 +110,19 @@ NZFQWYJLNVf2M9CCJfbEImPYgvctrxl39H6KVYPCw1SAdaj9NneUqmREOQkKoEB0
|
|||
x6PmNirbMscHhQPSC0JQaqUgaQFgba1ALmzRYAnYhNb0twkTxWbY7DBkAarxqMIp
|
||||
yiLKcBFc5H7dgJCImo7us7aJeftC44uWkPIjw9AKH=
|
||||
--END CERTIFICAT--
|
||||
[Wed 30 Dec 2022 15:21:52 AM
|
||||
[Wed 30 Dec 2022 15:21:52 AM EST] Your cert is in /home/vpsadmin/.acme.sh/subdomain.yourdomain.com_ecc/subdomain.yourdomain.com.cer
|
||||
[Wed 30 Dec 2022 15:21:52 AM EST] Your cert key is in /home/vpsadmin/.acme.sh/subdomain.yourdomain.com_ecc/subdomain.yourdomain.com.key
|
||||
[Wed 30 Dec 2022 15:21:52 AM EST] The intermediate CA cert is in /home/vpsadmin/.acme.sh/subdomain.yourdomain.com_ecc/ca.cer
|
||||
[Wed 30 Dec 2022 15:21:52 AM EST] And the full chain certs is there: /home/vpsadmin/.acme.sh/subdomain.yourdomain.com_ecc/fullchain.cer
|
||||
```
|
||||
|
||||
3. Note: The certificate applied for here is a test certificate, which cannot be used directly. It is only used to prove that your domain and configuration are correct. If you observe carefully, you will find that the domain that issues the certificate to you is `https://acme-staging-v02.api.letsencrypt.org`, and this `staging` can be understood as a "test server"!
|
||||
|
||||
4. If this step goes wrong, you can run the following command to check the detailed application process and specific errors. If you don't understand, you can hide sensitive information and ask in the Xray group.
|
||||
|
||||
```shell
|
||||
acme.sh --issue --server letsencrypt --test -d subdomain.yourdomain.com -w /home/vpsadmin/www/webpage --keylength ec-256 --debug
|
||||
````
|
||||
acme.sh --issue --server letsencrypt_test -d subdomain.yourdomain.com -w /home/vpsadmin/www/webpage --keylength ec-256 --debug
|
||||
```
|
||||
|
||||
(Note: This command is written in Chinese characters, therefore I have translated it into English. The command is used to issue SSL/TLS certificates using acme.sh client with Let's Encrypt CA in test mode for a subdomain of your domain with the specified webroot path, key length and in debug mode.)
|
||||
|
||||
|
|
@ -128,7 +132,7 @@ Hmm, that's right. Just added a `--debug` parameter at the end of the command.
|
|||
|
||||
## 6.4 Application for Official Certification
|
||||
|
||||
1. The command for applying for an official certificate is as follows (i.e., remove the `--test` parameter and add the `--force` parameter at the end):
|
||||
1. The command for applying for an official certificate is as follows (i.e., replace `letsencrypt_test` with `letsencrypt` and add the `--force` parameter at the end):
|
||||
|
||||
```shell
|
||||
acme.sh --set-default-ca --server letsencrypt
|
||||
|
|
|
|||
|
|
@ -44,12 +44,12 @@
|
|||
|
||||
## 6.3 Тестовый запрос сертификата
|
||||
|
||||
Перед тем, как запросить настоящий сертификат, давайте сделаем тестовый запрос (`--issue --test`), чтобы убедиться, что всё настроено правильно. Это позволит избежать превышения лимита на количество запросов Let's Encrypt (например, не более 5 неудачных запросов в час для одного домена и одного аккаунта).
|
||||
Перед тем, как запросить настоящий сертификат, давайте сделаем тестовый запрос (`--issue --server letsencrypt_test`), чтобы убедиться, что всё настроено правильно. Это позволит избежать превышения лимита на количество запросов Let's Encrypt (например, не более 5 неудачных запросов в час для одного домена и одного аккаунта).
|
||||
|
||||
1. Команда для тестового запроса сертификата (в этой статье мы будем использовать сертификаты **ECC**, поскольку на сегодняшний день нет причин не использовать их):
|
||||
|
||||
```shell
|
||||
acme.sh --issue --server letsencrypt --test -d поддомен.ваш_домен.com -w /home/vpsadmin/www/webpage --keylength ec-256
|
||||
acme.sh --issue --server letsencrypt_test -d поддомен.ваш_домен.com -w /home/vpsadmin/www/webpage --keylength ec-256
|
||||
```
|
||||
|
||||
::: warning Пояснение
|
||||
|
|
@ -118,7 +118,7 @@
|
|||
4. Если на этом этапе возникли ошибки, выполните следующую команду, чтобы увидеть подробную информацию о процессе запроса сертификата:
|
||||
|
||||
```shell
|
||||
acme.sh --issue --server letsencrypt --test -d поддомен.ваш_домен.com -w /home/vpsadmin/www/webpage --keylength ec-256 --debug
|
||||
acme.sh --issue --server letsencrypt_test -d поддомен.ваш_домен.com -w /home/vpsadmin/www/webpage --keylength ec-256 --debug
|
||||
```
|
||||
|
||||
Мы просто добавили параметр `--debug` в конец команды.
|
||||
|
|
@ -127,7 +127,7 @@
|
|||
|
||||
## 6.4 Запрос настоящего сертификата
|
||||
|
||||
1. Команда для запроса настоящего сертификата (мы просто убираем параметр `--test` и добавляем параметр `--force`):
|
||||
1. Команда для запроса настоящего сертификата (мы просто заменяем сервер `letsencrypt_test` на `letsencrypt` и добавляем параметр `--force`):
|
||||
|
||||
```shell
|
||||
acme.sh --set-default-ca --server letsencrypt
|
||||
|
|
|
|||
Loading…
Reference in New Issue