yisou 发表于 2022-9-5 10:11:21

安全证书不能自己更新

upstream fastcgi_backend {
    server   unix:/tmp/php-cgi.sock;
}

server
    {
      listen 443 ssl http2;
      #listen [::]:443 ssl http2;
      server_name www.eyeglassespro.com eyeglassespro.com;
      set $MAGE_ROOT /home/wwwroot/www.eyeglassespro.com;

      ssl_certificate /usr/local/nginx/conf/ssl/www.eyeglassespro.com/fullchain.cer;
      ssl_certificate_key /usr/local/nginx/conf/ssl/www.eyeglassespro.com/www.eyeglassespro.com.key;
      ssl_session_timeout 5m;
      ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
      ssl_prefer_server_ciphers on;
      ssl_ciphers "TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5";
      ssl_session_cache builtin:1000 shared:SSL:10m;
      # openssl dhparam -out /usr/local/nginx/conf/ssl/dhparam.pem 2048
      ssl_dhparam /usr/local/nginx/conf/ssl/dhparam.pem;

      

      root $MAGE_ROOT/pub;

      index index.php;
      autoindex off;
      charset UTF-8;
      error_page 404 403 = /errors/404.php;
      #add_header "X-UA-Compatible" "IE=Edge";


      # Deny access to sensitive files
      location /.user.ini {
            deny all;
      }

      # PHP entry point for setup application
      location ~* ^/setup($|/) {
            root $MAGE_ROOT;
            location ~ ^/setup/index.php {
                fastcgi_pass   fastcgi_backend;

                fastcgi_paramPHP_FLAG"session.auto_start=off \n suhosin.session.cryptua=off";
                fastcgi_paramPHP_VALUE "memory_limit=756M \n max_execution_time=600";
                fastcgi_read_timeout 600s;
                fastcgi_connect_timeout 600s;

                fastcgi_indexindex.php;
                fastcgi_paramSCRIPT_FILENAME$document_root$fastcgi_script_name;
                include      fastcgi_params;
            }

            location ~ ^/setup/(?!pub/). {
                deny all;
            }

            location ~ ^/setup/pub/ {
                add_header X-Frame-Options "SAMEORIGIN";
            }
      }

      # PHP entry point for update application
      location ~* ^/update($|/) {
            root $MAGE_ROOT;

            location ~ ^/update/index.php {
                fastcgi_split_path_info ^(/update/index.php)(/.+)$;
                fastcgi_pass   fastcgi_backend;
                fastcgi_indexindex.php;
                fastcgi_paramSCRIPT_FILENAME$document_root$fastcgi_script_name;
                fastcgi_paramPATH_INFO      $fastcgi_path_info;
                include      fastcgi_params;
            }

            # Deny everything but index.php
            location ~ ^/update/(?!pub/). {
                deny all;
            }

            location ~ ^/update/pub/ {
                add_header X-Frame-Options "SAMEORIGIN";
            }
      }

      location / {
            try_files $uri $uri/ /index.php$is_args$args;
      }

      location /pub/ {
            location ~ ^/pub/media/(downloadable|customer|import|custom_options|theme_customization/.*\.xml) {
                deny all;
            }
            alias $MAGE_ROOT/pub/;
            add_header X-Frame-Options "SAMEORIGIN";
      }

      location /static/ {
            # Uncomment the following line in production mode
            # expires max;

            # Remove signature of the static files that is used to overcome the browser cache
            location ~ ^/static/version {
                rewrite ^/static/(version\d*/)?(.*)$ /static/$2 last;
            }

            location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2|html|json)$ {
                add_header Cache-Control "public";
                add_header X-Frame-Options "SAMEORIGIN";
                expires +1y;

                if (!-f $request_filename) {
                  rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
                }
            }
            location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
                add_header Cache-Control "no-store";
                add_header X-Frame-Options "SAMEORIGIN";
                expires    off;

                if (!-f $request_filename) {
                   rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
                }
            }
            if (!-f $request_filename) {
                rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
            }
            add_header X-Frame-Options "SAMEORIGIN";
      }

      location /media/ {
            try_files $uri $uri/ /get.php$is_args$args;

            location ~ ^/media/theme_customization/.*\.xml {
                deny all;
            }

            location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
                add_header Cache-Control "public";
                add_header X-Frame-Options "SAMEORIGIN";
                expires +1y;
                try_files $uri $uri/ /get.php$is_args$args;
            }
            location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
                add_header Cache-Control "no-store";
                add_header X-Frame-Options "SAMEORIGIN";
                expires    off;
                try_files $uri $uri/ /get.php$is_args$args;
            }
            add_header X-Frame-Options "SAMEORIGIN";
      }

      location /media/customer/ {
            deny all;
      }

      location /media/downloadable/ {
            deny all;
      }

      location /media/import/ {
            deny all;
      }

      location /media/custom_options/ {
            deny all;
      }

      location /errors/ {
            location ~* \.xml$ {
                deny all;
            }
      }

      # PHP entry point for main application
      location ~ ^/(index|get|static|errors/report|errors/404|errors/503|health_check)\.php$ {
            try_files $uri =404;
            fastcgi_pass   fastcgi_backend;
            fastcgi_buffers 1024 4k;

            fastcgi_paramPHP_FLAG"session.auto_start=off \n suhosin.session.cryptua=off";
            fastcgi_paramPHP_VALUE "memory_limit=756M \n max_execution_time=18000";
            fastcgi_read_timeout 600s;
            fastcgi_connect_timeout 600s;

            fastcgi_indexindex.php;
            fastcgi_paramSCRIPT_FILENAME$document_root$fastcgi_script_name;
            include      fastcgi_params;
      }

      gzip on;
      gzip_disable "msie6";

      gzip_comp_level 6;
      gzip_min_length 1100;
      gzip_buffers 16 8k;
      gzip_proxied any;
      gzip_types
            text/plain
            text/css
            text/js
            text/xml
            text/javascript
            application/javascript
            application/x-javascript
            application/json
            application/xml
            application/xml+rss
            image/svg+xml;
      gzip_vary on;

      # Banned locations (only reached if the earlier PHP entry point regexes don't match)
      location ~* (\.php$|\.phtml$|\.htaccess$|\.git) {
            deny all;
      }


      #error_page   404   /404.html;

      # Deny access to PHP files in specific directory
      #location ~ /(wp-content|uploads|wp-includes|images)/.*\.php$ { deny all; }

      include enable-php.conf;

      location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
      {
            expires      30d;
      }

      location ~ .*\.(js|css)?$
      {
            expires      12h;
      }

      location ~ /.well-known {
            allow all;
      }

      location ~ /\.
      {
            deny all;
      }

      access_log off;
    }

    server {
      listen 80;
      server_name www.eyeglassespro.com eyeglassespro.com;
      location ^~ /.well-known/acme-challenge/ {
            default_type "text/plain";
            root         /home/wwwroot/www.eyeglassespro.com;
      }

      location = /.well-known/acme-challenge/ {
             return 404;
      }

    rewrite ^(.*)$ https://${server_name}$1 permanent;
    }

licess 发表于 2022-9-6 08:37:28

yisou 发表于 2022-9-5 19:54
我直接将虚拟主机配置文件删除了， 再运行lnmp ssl add, 以前是可以的，现也不行了。出错：


因为acme.sh升级了默认用zerossl了，需要增加一个邮箱的参数到配置文件里面
执行：
/usr/local/acme.sh/acme.sh --register-account -m 你邮箱
后再添加就可以了

yisou 发表于 2022-9-5 10:11:59

军哥， 请问哪有问题呀？
谢谢了。

licess 发表于 2022-9-5 16:17:25

你这个规则写的有问题，你这样 /.well-known/acme-challenge/ 下面的http验证文件都访问不到，都直接301了
把 rewrite ^(.*)$ https://${server_name}$1 permanent;
改成
      location / {
            return 301 https://$host$request_uri;
      }

yisou 发表于 2022-9-5 19:54:29

我直接将虚拟主机配置文件删除了， 再运行lnmp ssl add, 以前是可以的，现也不行了。出错：
Please check log file for more details: /usr/local/acme.sh/acme.sh.log
Running cmd: issue
_main_domain='www.gloryoptical.com'
_alt_domains='gloryoptical.com'
Using config home:/usr/local/acme.sh
default_acme_server
ACME_DIRECTORY='https://acme.zerossl.com/v2/DV90'
DOMAIN_PATH='/usr/local/nginx/conf/ssl/www.gloryoptical.com'
Using ACME_DIRECTORY: https://acme.zerossl.com/v2/DV90
_init api for server: https://acme.zerossl.com/v2/DV90
Retrying GET
GET
url='https://acme.zerossl.com/v2/DV90'
timeout=
displayError='1'
_CURL='curl --silent --dump-header /usr/local/acme.sh/http.header-L-g '
ret='0'
_hcode='0'
ACME_KEY_CHANGE='https://acme.zerossl.com/v2/DV90/keyChange'
ACME_NEW_AUTHZ
ACME_NEW_ORDER='https://acme.zerossl.com/v2/DV90/newOrder'
ACME_NEW_ACCOUNT='https://acme.zerossl.com/v2/DV90/newAccount'
ACME_REVOKE_CERT='https://acme.zerossl.com/v2/DV90/revokeCert'
ACME_AGREEMENT='https://secure.trust-provider.com/repository/docs/Legacy/20201020_Certificate_Subscriber_Agreement_v_2_4_click.pdf'
ACME_NEW_NONCE='https://acme.zerossl.com/v2/DV90/newNonce'
Using CA: https://acme.zerossl.com/v2/DV90
_on_before_issue
_chk_main_domain='www.gloryoptical.com'
_chk_alt_domains='gloryoptical.com'
Le_LocalAddress
d='www.gloryoptical.com'
Check for domain='www.gloryoptical.com'
_currentRoot='/home/wwwroot/www.gloryoptical.com'
d='gloryoptical.com'
Check for domain='gloryoptical.com'
_currentRoot='/home/wwwroot/www.gloryoptical.com'
d
config file is empty, can not read CA_KEY_HASH
Using config home:/usr/local/acme.sh
ACME_DIRECTORY='https://acme.zerossl.com/v2/DV90'
_init api for server: https://acme.zerossl.com/v2/DV90
RSA key
config file is empty, can not read CA_EAB_KEY_ID
config file is empty, can not read CA_EAB_HMAC_KEY
config file is empty, can not read CA_EMAIL
No EAB credentials found for ZeroSSL, let's get one
acme.sh is using ZeroSSL as default CA now.
Please update your account with an email address first.
my@example.com
See: https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA
_on_issue_err
Please check log file for more details: /usr/local/acme.sh/acme.sh.log

yisou 发表于 2022-9-5 20:08:12

No EAB credentials found for ZeroSSL, let's get one
acme.sh is using ZeroSSL as default CA now.
Please update your account with an email address first.
acme.sh --register-account -m my@example.com
See: https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA

yisou 发表于 2022-9-6 21:11:09

非常感谢！
页: [1]
查看完整版本: 安全证书不能自己更新