标签： linux

大嘎好，半吊子运维又出现了。

一个网站，用得好好的，忽然说不安全了。登上去一看，果然不安全。

显示NET::ERR_CERT_DATE_INVALID

赶紧登录到服务器上看一看是怎么肥事

得知是nginx的搭的服务器

nginx -t 看一下

再看一下 /etc/nginx/nginx.conf， 啥也没有，再仔细瞄一下原来放在 include /etc/nginx/conf.d/*.conf;

server
{
listen 80;

            listen [::]:80;

            server_name sub.xxx.com;

            location / {
                    return 301 https://sub.xxx.com$request_uri;
            }
    access_log /data/logs/www.log main;
            error_log /data/logs/www_error.log error;

}

server
{
listen 443 ssl http2;
server_name sub.xxx.com;
index index.php index.html;
root /data/wwwroot/xxxxxx;

    location / {
        rewrite ^/$ /index.php last;
        if (!-e $request_filename) {
            rewrite "^/(.*)$" /index.php/$1 last;
        }
    }

    location ~ ^(.+\\.php)(.*)$ {

        fastcgi_connect_timeout 300;
        fastcgi_send_timeout 300;
        fastcgi_read_timeout 300;

        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fcgi.conf;
    }
    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
    {
        expires      30d;
        access_log off;
    }

    location ~ .*\.(js|css)?$
    {
        expires      12h;
        access_log off;
    }
    location /_log {
       autoindex on;
       autoindex_localtime on;
    }
    access_log /data/logs/www.log main;
            error_log /data/logs/www_error.log error;
            ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_certificate /etc/letsencrypt/live/sub.xxx.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/sub.xxx.com/privkey.pem; # managed by Certbot

}

看来用的是Let’s Encrypt免费SSL证书，这个证书有个麻烦一点的地方就是90天过期，看来自从上次更新之后已经有90天了，所以过期了。

找到原因就好办了，将证书续期一下完事。

发现原来运维使用了 certbot ，那就更简单了。

# certbot certificates 看一下，果然有相应的证书

那就用certbot 更新一下证书 renew ，成功完成。

如果显示不成功，需要先暂停 nginx (systemctl stop nginx.service)

# certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/sub.xxx.com.conf

Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator nginx, Installer nginx
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for sub.xxx.com
Waiting for verification…
Cleaning up challenges

new certificate deployed with reload of nginx server; fullchain is
/etc/letsencrypt/live/sub.xxx.com/fullchain.pem

Processing /etc/letsencrypt/renewal/xxx.com.conf

Cert is due for renewal, auto-renewing…
Plugins selected: Authenticator nginx, Installer nginx
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for xxx.com
Waiting for verification…
Cleaning up challenges

new certificate deployed with reload of nginx server; fullchain is
/etc/letsencrypt/live/xxx.com/fullchain.pem

Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/sub.xxx.com/fullchain.pem (success)
/etc/letsencrypt/live/xxx.com/fullchain.pem (success)

参考文章： https://www.liaosam.com/use-cron-service-and-certbot-for-renewal-of-letsencrypt-ssl-certificates.html