From 607b8aa763c66d5e1afce3194cdde4a6b4ef3adc Mon Sep 17 00:00:00 2001 From: wangjia <809946525@qq.com> Date: Fri, 3 Jul 2026 10:55:24 +0800 Subject: [PATCH] =?UTF-8?q?devops:=20jiu=20=E8=AF=81=E4=B9=A6=E5=88=87=20c?= =?UTF-8?q?ertbot=20webroot=20=E8=87=AA=E5=8A=A8=E7=BB=AD=E6=9C=9F?= =?UTF-8?q?=EF=BC=88letsencrypt=20live=20=E8=B7=AF=E5=BE=84=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ali 上重签 jiu.51yanmei.com（authenticator 由 dns-cloudflare 切 webroot，NS 迁阿里云后 旧方式必失败）；certbot-renew.timer 启用 + deploy 钩子自动 reload；dry-run 通过； EC2 同步的证书副本（/etc/nginx/ssl）已删除。 Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o --- deploy/nginx-jiu-ali.conf | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/deploy/nginx-jiu-ali.conf b/deploy/nginx-jiu-ali.conf index ff08dc4..36ffb35 100644 --- a/deploy/nginx-jiu-ali.conf +++ b/deploy/nginx-jiu-ali.conf @@ -17,11 +17,10 @@ server { listen 443 ssl http2 default_server; # 正式入口（备案后回切 2026-07-03） server_name jiu.51yanmei.com _; - # 证书现为 EC2 同步副本（2026-08-28 到期）。ACME 通道已就绪：待批准后在 ali 跑 - # `certbot certonly --webroot -w /var/www/acme -d jiu.51yanmei.com` 签新证， - # 然后把这两行换成 /etc/letsencrypt/live/jiu.51yanmei.com/ 并配 reload 部署钩子。 - ssl_certificate /etc/nginx/ssl/jiu.51yanmei.com/fullchain.pem; - ssl_certificate_key /etc/nginx/ssl/jiu.51yanmei.com/privkey.pem; + # 证书：certbot webroot 自动续期（certbot-renew.timer 每日 + deploy 钩子 reload； + # 2026-07-03 签发，authenticator=webroot，dry-run 验证通过） + ssl_certificate /etc/letsencrypt/live/jiu.51yanmei.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/jiu.51yanmei.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on;