Let’s Encrypt是免费的HTTPS证书，有效期是90天。到期后需要手动续期，或者编写一个定时任务自动去续期。

我当前所用Ubuntu版本为：

root@hgdm:~# lsb_release -a
LSB Version: security-11.1.0ubuntu2-noarch
Distributor ID: Ubuntu
Description: Ubuntu 20.04.3 LTS
Release: 20.04
Codename: focal
步骤1: 安装并启动nginx
$ sudo apt-get install nginx
$ sudo systemctl start nginx
具体可参考我之前写的：Ubuntu Linux 如何使用apt-get安装Nginx、MySQL、Redis、PHP。

步骤2
$ sudo apt install certbot python3-certbot-nginx
步骤3
假设需要部署HTTPS证书的域名为：m.xyz.com。

这个域名所对应的网站目录路径为：/data/web/m.xyz.com。

域名和网站目录所对应的nginx配置文件路径为：
/etc/nginx/conf.d/m.xyz.com.conf。

/etc/nginx/conf.d/m.xyz.com.conf这个配置文件的内容如下所示：

server {
listen 80 default_server;

 # 设置网站的域名为m.xyz.com
server_name m.xyz.com;

# 设置网站的目录路径
root /data/web/m.xyz.com;

index index.html index.htm;

location / {
    try_files $uri $uri/ =404;
}

}
不知道去哪里复制可重用的nginx配置？去这个路径找：
/etc/nginx/sites-available/default。

步骤4：重启nginx
必须重启nginx服务器，否则新增的网站配置不生效。

$ sudo systemctl restart nginx
域名m.xyz.com必须能通过网络访问，因为下一步执行certbot命令时，会在/data/web/m.xyz.com目录下创建一个隐藏的名称为
.well-known/acme-challenge的文件，然后在外网Let’s Encrypt访问
http://m.xyz.com/.well-known/acme-challenge。若Let’s Encrypt访问这个网址失败，那么Let’s Encrypt就会认为域名m.xyz.com不是你的，进而无法为m.xyz.com签发证书。

步骤5
$ sudo certbot certonly –webroot -w /data/web/m.xyz.com -d m.xyz.com
# 若是成功执行，最后一部分的输出信息为:
IMPORTANT NOTES:
– Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/m.xyz.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/m.xyz.com/privkey.pem
Your cert will expire on 2022-03-30. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew all of your certificates, run
“certbot renew”
– If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

这个命令的输出显示，生成了两个证书：

/etc/letsencrypt/live/m.xyz.com/fullchain.pem
/etc/letsencrypt/live/m.xyz.com/privkey.pem

/etc/letsencrypt/live/m.xyz.com目录是用于存放certbot命令生成的证书文件，但是，certbot生成的证书文件不止前面这两个，还有其他的。

root@hgdm:~# ls /etc/letsencrypt/live/m.xyz.com/
README cert.pem chain.pem fullchain.pem privkey.pem
这个目录里有三个证书文件是下面步骤配置nginx SSL时需要用到的：

第一个：/etc/letsencrypt/live/m.xyz.com/fullchain.pem
第二个：/etc/letsencrypt/live/m.xyz.com/privkey.pem
第三个：/etc/letsencrypt/live/m.xyz.com/chain.pem
步骤6 查找openssl的版本

方法1

$ openssl version
OpenSSL 1.1.1f 31 Mar 2020

方法2

$ dpkg -l | grep openssl
步骤7
使用mozilla提供的SSL配置生成器生成nginx SSL配置，然后复制到
/etc/nginx/conf.d/m.xyz.com.conf，并修改4个地方。

需要修改的4个地方为：

ssl_certificate：上文的certbot命令已生成这个文件，文件路径为/etc/letsencrypt/live/m.xyz.com/fullchain.pem。
ssl_certificate_key：上文的certbot命令已生成这个文件，文件路径为/etc/letsencrypt/live/m.xyz.com/privkey.pem。
ssl_dhparam：这个文件还没生成，先填写为预设的文件路径：/etc/nginx/ssl/dhparam.pem，下一步执行命令去生成。
ssl_trusted_certificate：上文的certbot命令已生成这个文件，文件路径为/etc/letsencrypt/live/m.xyz.com/chain.pem。

/etc/nginx/conf.d/m.xyz.com.conf被修改为：

generated 2021-12-30, Mozilla Guideline v5.6, nginx 1.18, OpenSSL 1.1.1f, intermediate configuration

https://ssl-config.mozilla.org/#server=nginx&version=1.18&config=intermediate&openssl=1.1.1f&guideline=5.6

server {
server_name m.xyz.com;
listen 80 default_server;
listen [::]:80 default_server;

location / {
    return 301 https://$host$request_uri;
}

}

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;

# 第1个需被修改的地方(已改)
ssl_certificate /etc/letsencrypt/live/m.xyz.com/fullchain.pem;
# 第2个需被修改的地方(已改)
ssl_certificate_key /etc/letsencrypt/live/m.xyz.com/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
ssl_session_tickets off;

# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
# 第3个需被修改的地方(已改)
ssl_dhparam /etc/nginx/ssl/dhparam.pem;

# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;

# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;

# verify chain of trust of OCSP response using Root CA and Intermediate certs
# 第4个需被修改的地方(已改)
ssl_trusted_certificate /etc/letsencrypt/live/m.xyz.com/chain.pem;

# replace with the IP address of your resolver
resolver 127.0.0.1;

server_name m.xyz.com;
root /data/web/m.xyz.com;

location ~ \.py$ {
    return 403;
}

}
步骤8
执行以下命令，用于生成第7步nginx配置里预设的ssl_dhparam文件。下面第二个命令比较耗时，快的话需要等一两分钟，慢的话则更久。

$ sudo mkdir /etc/nginx/ssl
$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
步骤9：重启nginx
要想前面修改过的nginx配置生效，必须重启nginx服务。

$ sudo systemctl restart nginx
步骤10
打开浏览器，访问m.xyz.com，检查https是否生效了。若配置正确，nginx也重启了，也没有生效，可能需要等待一小会。

检查https是否生效的步骤如下图所示：

步骤11：HTTPS证书到期了，需要更新证书
执行以下命令去更新HTTPS证书，且更新后必须重启nginx服务器，否则无法在浏览器看到HTTPS证书的失效日期被更新了。

$ sudo certbot renew

执行certbot renew命令后，必须重启nginx服务器，否则在浏览器查看不到HTTPS证书的失效日期被更新了

$ sudo systemctl restart nginx
最后 贴上完整的nginx配置
前端是nginx，后端是一个运行着django项目的gunicorn服务。

generated 2021-12-30, Mozilla Guideline v5.6, nginx 1.18, OpenSSL 1.1.1f, intermediate configuration

https://ssl-config.mozilla.org/#server=nginx&version=1.18&config=intermediate&openssl=1.1.1f&guideline=5.6

server {
server_name m.xyz.com;
listen 80 default_server;
listen [::]:80 default_server;

location / {
    return 301 https://$host$request_uri;
}

}

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;

ssl_certificate /etc/letsencrypt/live/m.xyz.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/m.xyz.com/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
ssl_session_tickets off;

# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
ssl_dhparam /etc/nginx/ssl/dhparam.pem;

# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;

# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;

# verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /etc/letsencrypt/live/m.xyz.com/chain.pem;

# replace with the IP address of your resolver
resolver 127.0.0.1;

server_name m.xyz.com;

# 找不到入口的请求(在gunicorn,/static, /media都没找到入口)，最后访问/data/web/m.xyz.com_other这个目录，试试看是否能访问成功
root /data/web/m.xyz.com_other;

# 网站的js和css文件所在目录
location /static/ {
    alias /data/web/m.xyz.com/static/;
    add_header Cache-Control no-cache;
    expires -1; # kill cache;
    access_log        off;
    log_not_found     off;
}

# 网站的媒体文件所在的目录
location /media/ {
    alias /data/web/m.xyz.com/media/;
    expires max;
}

location ~ \.py$ {
    return 403;
}

# 将非文件的请求发给运行django项目的gunicorn服务，gunicorn服务的端口号为8999
location / { 
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-NginX-Proxy true;
    proxy_redirect off;
    if (!-f $request_filename) {
        proxy_pass http://127.0.0.1:8999;
        break;
    }
}

}