HTTPS/SSL 证书完全指南：从申请到部署再到自动续期 | 2026最新实践

1
客户端请求 → TCP 握手 → TLS 握手 → 加密通信
2
              ↓              ↓
3
         建立连接      证书验证 + 密钥交换

1
# 推荐的加密套件优先级（Nginx 配置）
2
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256;
3

4
# 禁用的弱加密套件
5
# - MD5, SHA1（哈希算法太弱）
6
# - RC4（流密码不安全）
7
# - 3DES（过时且慢）
8
# - RSA 密钥交换（不支持前向保密）

1
客户端(certbot)          ACME服务器(Let's Encrypt)          DNS服务器
2
      │                        │                               │
3
      ├─→ 请求证书 ────────────→│                               │
4
      │                        │                               │
5
      │←─ 挑战类型 ────────────┤                               │
6
      │                        │                               │
7
      │─→ HTTP-01 挑战 ────────→│                               │
8
      │                        │                               │
9
      │←─ 验证成功 ────────────┤                               │
10
      │                        │                               │
11
      │←─ 签发证书 ────────────┤                               │
12
      │                        │                               │

1
server {
2
    listen 80;
3
    server_name example.com www.example.com;
4

5
    # HTTP 强制重定向到 HTTPS
6
    return 301 https://$host$request_uri;
7
}
8

9
server {
10
    listen 443 ssl http2;
11
    server_name example.com www.example.com;
12

13
    # 证书文件路径
14
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
15
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
16

17
    # TLS 版本配置
18
    ssl_protocols TLSv1.2 TLSv1.3;
19

20
    # 加密套件
21
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
22
    ssl_prefer_server_ciphers on;
23

24
    # 会话缓存（提升性能）
25
    ssl_session_cache shared:SSL:10m;
26
    ssl_session_timeout 10m;
27
    ssl_session_tickets off;
28

29
    # OCSP Stapling（提升性能和隐私）
30
    ssl_stapling on;
31
    ssl_stapling_verify on;
32

33
    # HSTS（强制 HTTPS）
34
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
35

36
    # 安全相关头部
37
    add_header X-Content-Type-Options nosniff;
38
    add_header X-Frame-Options DENY;
39
    add_header X-XSS-Protection "1; mode=block";
40
    add_header Referrer-Policy strict-origin-when-cross-origin;
41

42
    # 网站根目录
43
    root /var/www/example.com;
44
    index index.html;
45
}

1
<VirtualHost *:80>
2
    ServerName example.com
3
    ServerAlias www.example.com
4

5
    # 重定向到 HTTPS
6
    Redirect permanent / https://example.com/
7
</VirtualHost>
8

9
<VirtualHost *:443>
10
    ServerName example.com
11
    ServerAlias www.example.com
12

13
    # 证书配置
14
    SSLEngine on
15
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
16
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
17

18
    # TLS 配置
19
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
20
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
21
    SSLHonorCipherOrder on
22

23
    # HSTS
24
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
25

26
    # 安全头部
27
    Header always set X-Content-Type-Options nosniff
28
    Header always set X-Frame-Options DENY
29
    Header always set X-XSS-Protection "1; mode=block"
30

31
    # 文档根目录
32
    DocumentRoot /var/www/example.com
33
</VirtualHost>

1
# Caddy 2.x 配置（自动获取和续期证书）
2
example.com {
3
    # 自动 HTTPS（Let's Encrypt）
4
    tls {
5
        dns cloudflare YOUR_CLOUDFLARE_API_TOKEN
6
    }
7

8
    # 重定向 www 到 non-www
9
    redir www.example.com example.com permanent
10

11
    # 静态文件服务
12
    root * /var/www/example.com
13
    file_server
14

15
    # HSTS 默认启用，max-age=15768000
16
}

1
# 基础配置（推荐）
2
add_header Strict-Transport-Security "max-age=31536000" always;
3

4
# 包含子域名
5
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
6

7
# 申请加入 HSTS 预加载列表
8
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

1
# prometheus.yml 配置
2
scrape_configs:
3
  - job_name: 'ssl_certificates'
4
    scrape_interval: 1d
5
    metrics_path: /probe
6
    params:
7
      module: [ssl_expiry]
8
    static_configs:
9
      - targets:
10
        - example.com:443
11
        - api.example.com:443
12
    relabel_configs:
13
      - source_labels: [__address__]
14
        target_label: __param_target
15
      - source_labels: [__param_target]
16
        target_label: instance
17
      - target_label: __address__
18
        replacement: localhost:9115  # blackbox exporter
19

20
# blackbox exporter 配置
21
modules:
22
  ssl_expiry:
23
    prober: http
24
    http:
25
      tls_config:
26
        insecure_skip_verify: false
27
      valid_http_versions: ["HTTP/1.1", "HTTP/2"]
28
      preferred_ip_protocol: "ip4"